Semgrep
Static code analysis with rules that look like source code, plus a built-in MCP server for AI agents
Install
brew install semgrepOr python3 -m pip install semgrep.
This is third-party code. Review the repository files before installing.
What it does
Semgrep finds bugs, vulnerabilities and standards violations using rules written as patterns in the project's own language. It supports 30+ languages and runs locally; by default code is not uploaded. The semgrep mcp command starts an MCP server over stdio or streamable HTTP so the agent can run scans and write rules itself. For Claude Code and Cursor there is a plugin with hooks and skills that scans code the agent generates.
Who it is for. For developers and security engineers who want static analysis on agent-written code.
Good fit when
- You want the agent to scan its own code for vulnerabilities before committing
- You need custom rules for project standards
- You need checks in CI or pre-commit
Not a fit when
- You need cross-file dataflow analysis but the Semgrep platform is not an option
- You need runtime behavior checks rather than source scanning
Example request
Scan the changes in this branch with Semgrep and fix the vulnerabilities it findsLimitations
Community Edition analyzes only within a single function or file and misses some vulnerabilities. Pro rules, dependency and secrets scanning require logging in to the Semgrep AppSec Platform; for MCP that is the SEMGREP_APP_TOKEN variable. Registry rules send pseudonymous metrics, disabled with --metrics=off. Cloud platform availability from Russia is unverified; local analysis works without it.
How to disable. Remove the semgrep server from the MCP config or the plugin via /plugin; uninstall the CLI with brew uninstall semgrep or pip uninstall semgrep.
Security check
- Reads the whole project codebase
- When logged in, results go to the Semgrep cloud
README in short
The README explains semantic code search and the difference between the open edition and the AppSec platform. It covers installation via Homebrew, pip and Docker, and the semgrep login and semgrep ci commands. A separate MCP document describes transports and setup for Claude Code, Cursor, VS Code, Windsurf and Kiro. LGPL-2.1 licensed.
FAQ
Is the separate semgrep/mcp repository still needed?
No, the MCP server is now built into the main CLI and starts with semgrep mcp.
Is code sent to a server?
According to the README, analysis runs locally and code is not uploaded by default.
Related
NVIDIA's open stack for running OpenClaw, Hermes and LangChain Deep Agents in OpenShell sandboxes with network policy and managed inference
Trail of Bits skills
Trail of Bits Skills Marketplace
Trail of Bits plugin marketplace for security work: smart contracts, C/C++ and Rust review, Semgrep, CodeQL and fuzzing
A cybersecurity skill library: forensics, incident response, pentesting, cloud and malware analysis mapped to MITRE ATT&CK and NIST
A Claude Code skill that decompiles APK, XAPK, JAR and AAR files and finds the HTTP endpoints an app calls