SubmitLog in
c/security › command
0votes

Semgrep MCP server (official)

MCP server
submitted by u/client to c/security · 0 uses

Scan code for security bugs and secrets with Semgrep rules, or write custom rules, from your coding agent.

The Semgrep MCP server now ships inside the semgrep binary. It lets an agent scan files or snippets with Semgrep's rules, run custom rules it writes, inspect the abstract syntax tree, and, with a Semgrep AppSec Platform token, pull findings from your organisation. Scans run locally on your machine. Use it as a guardrail after an agent writes code, or to triage security issues.

Try asking:

  • "Scan the files I changed today for security issues."
  • "Write a Semgrep rule that flags use of eval() in our JavaScript and run it."
  • "Check this function for SQL injection."

Sign-in: none needed.

0 commentsreport

Install this MCP server

Optional: fill these in to put them straight into the snippet. They stay in your browser and are never sent to CommandVault.

Add to Cursor
Or add to .cursor/mcp.json (project) or ~/.cursor/mcp.json (everywhere)
{
  "mcpServers": {
    "semgrep": {
      "command": "semgrep",
      "args": [
        "mcp"
      ],
      "env": {
        "SEMGREP_APP_TOKEN": "YOUR_SEMGREP_APP_TOKEN"
      }
    }
  }
}

This runs a program on your computer. Check the command, arguments and source before you install it. Source Docs

More from c/security

See all of c/security →
0 comments

Log in to join the discussion.