A Model Context Protocol (MCP) server for using Semgrep to scan code for security vulnerabilities. Secure your vibe coding! 😅
semgrep-mcp is an MCP project maintained in the semgrep/mcp repository. The maintainer describes its purpose as “A Model Context Protocol (MCP) server for using Semgrep to scan code for security vulnerabilities. Secure your vibe coding! 😅”. Read the project documentation for the complete scope.
The documented pypi package is semgrep-mcp. The configuration below comes from the maintainer’s example; adapt its paths and account values to your environment.
The example declares SEMGREP_APP_TOKEN. Secret-looking values have been replaced with placeholders. Required and optional labels are shown only when the documentation states them.
Project documentation · Repository · Discovery listing. This profile records the public documentation checked on 2026-10-08.
Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.
| Tool | What it does |
|---|---|
| security_check | Scan code for security vulnerabilities |
| semgrep_scan | Scan code files for security vulnerabilities with a given config string |
| semgrep_scan_with_custom_rule | Scan code files using a custom Semgrep rule |
| get_abstract_syntax_tree | Output the Abstract Syntax Tree (AST) of code |
| semgrep_findings | Fetch Semgrep findings from the Semgrep AppSec Platform API |
| supported_languages | Return the list of languages Semgrep supports |
| semgrep_rule_schema | Fetches the latest semgrep rule JSON Schema |
{
"mcpServers": {
"semgrep": {
"command": "uvx",
"args": [
"semgrep-mcp"
],
"env": {
"SEMGREP_APP_TOKEN": "YOUR_SEMGREP_APP_TOKEN"
}
}
}
}From the project documentation. Replace placeholders and example paths before connecting.
| Variable | Description | Required |
|---|---|---|
| SEMGREP_APP_TOKEN | Declared in the maintainer’s client configuration. | Check documentation |
Queries the NIST National Vulnerability Database (NVD) via its API.
Scans projects for security vulnerabilities and automatically updates vulnerable dependencies using Trivy.
Search 1,032 verified smart contract vulnerability findings from Sherlock audits by pattern.
Remote MCP for A2A dependency inspector MCP, structured receipts, audit logs, and reviewer-ready evi
Remote MCP for A2A failure replay MCP, structured receipts, audit logs, and reviewer-ready evidence.
A comprehensive Model Context Protocol (MCP) server for ABP.IO framework with 48+ tools for application development, UI generation, and management