Semgrep CLI
Static code analysis with rules that look like source code, plus a built-in MCP server for AI agents
- 17,345 ★ on the repository
- Last commit
- LGPL-2.1
Extended access
Why this level
- Reads the whole project codebase
- When logged in, results go to the Semgrep cloud
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add cli/semgrepDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Reads the whole project codebase
- When logged in, results go to the Semgrep cloud
This is third-party code. Review the repository files before installing.
What it does
Semgrep finds bugs, vulnerabilities and standards violations using rules written as patterns in the project's own language. It supports 30+ languages and runs locally; by default code is not uploaded. The semgrep mcp command starts an MCP server over stdio or streamable HTTP so the agent can run scans and write rules itself. For Claude Code and Cursor there is a plugin with hooks and skills that scans code the agent generates.
Who it is for. For developers and security engineers who want static analysis on agent-written code.
Good fit when
- You want the agent to scan its own code for vulnerabilities before committing
- You need custom rules for project standards
- You need checks in CI or pre-commit
Not a fit when
- You need cross-file dataflow analysis but the Semgrep platform is not an option
- You need runtime behavior checks rather than source scanning
Example request
Scan the changes in this branch with Semgrep and fix the vulnerabilities it findsLimitations
Community Edition analyzes only within a single function or file and misses some vulnerabilities. Pro rules, dependency and secrets scanning require logging in to the Semgrep AppSec Platform; for MCP that is the SEMGREP_APP_TOKEN variable. Registry rules send pseudonymous metrics, disabled with --metrics=off. Cloud platform availability from Russia is unverified; local analysis works without it.
How to disable. Remove the semgrep server from the MCP config or the plugin via /plugin; uninstall the CLI with brew uninstall semgrep or pip uninstall semgrep.
FAQ
Is the separate semgrep/mcp repository still needed?
No, the MCP server is now built into the main CLI and starts with semgrep mcp.
Is code sent to a server?
According to the README, analysis runs locally and code is not uploaded by default.
Discussion
No questions or reviews yet.
Related
CLI toolsA security scanner CLI for code and AI agents: vets .claude, hooks, MCP configs and SKILL.md before cloning and finds leaked keys
A repository scanner with an MCP server: dependency graph, secrets, vulnerabilities and an API map with code line citations
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
An authorized bug-bounty suite: 50 subagents, 26 commands and 2 bug-bounty-platform MCP servers for Claude Code, Codex and five more agents
AgentShield audits the .claude folder for plaintext keys, broad permissions, dangerous hooks and risky MCP servers and grades the setup from A to F
A Snyk CLI that discovers installed MCP servers, skills and agents on your machine and checks them for prompt injections and malicious payloads
README in short
The README explains semantic code search and the difference between the open edition and the AppSec platform. It covers installation via Homebrew, pip and Docker, and the semgrep login and semgrep ci commands. A separate MCP document describes transports and setup for Claude Code, Cursor, VS Code, Windsurf and Kiro. LGPL-2.1 licensed.