How do I install the semgrep mcp server?

Use a recorded configuration for your client, replace example credential values and paths, and verify the documented runtime. Restart or reconnect the client, then inspect the available tools.

What credentials does it need?

It reads `SEMGREP_APP_TOKEN`, `MCP_SERVER_SEMGREP_ALLOWED_ROOTS` from the environment. Store these in your client's env block or a secrets manager — never commit them to a repository — and grant the narrowest scope that still covers your use case.

SSyncDev

Start a project

Semgrep MCP Server

MCP Server for Semgrep Integration - static code analysis with AI

Remote serverstreamable-httpPython

What is the Semgrep MCP Server?

MCP Server for Semgrep Integration - static code analysis with AI

What you get

MCP Server Semgrep is a Model Context Protocol compliant server that integrates the powerful Semgrep static analysis tool with AI assistants like Anthropic Claude. It enables advanced code analysis, security vulnerability detection, and code quality improvements directly through a conversational interface.

Direct integration with the official MCP SDK
Simplified architecture with consolidated handlers
Clean ES Modules implementation
Efficient error handling and path validation for security
Interface and documentation in both English and Polish
Comprehensive unit tests

Configuration and credentials

Node.js v18+ - TypeScript (for development)

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

Recorded tools

Check the linked publisher documentation and your connected client's tool list. Names and availability can vary with the server version and account permissions.

Tool	What it does
scan_directory	Scanning source code for potential issues
list_rules	Displaying available rules and languages supported by Semgrep
analyze_results	Detailed analysis of scan results
create_rule	Creating custom Semgrep rules
filter_results	Filtering results by various criteria
export_results	Exporting results in various formats
compare_results	Comparing two sets of results (e.g., before and after changes)

How to install the Semgrep MCP Server

{
  "mcpServers": {
    "semgrep": {
      "command": "node",
      "args": [
        "/your_path/mcp-server-semgrep/build/index.js"
      ],
      "env": {
        "SEMGREP_APP_TOKEN": "YOUR_SEMGREP_APP_TOKEN",
        "MCP_SERVER_SEMGREP_ALLOWED_ROOTS": "/Users/you/projects"
      }
    }
  }
}

From the project documentation. Replace placeholders and example paths before connecting.

Configuration

Node.js v18+ - TypeScript (for development)

Variable	Description	Required
SEMGREP_APP_TOKEN	Declared in the maintainer’s client configuration.	Check documentation
MCP_SERVER_SEMGREP_ALLOWED_ROOTS	Declared in the maintainer’s client configuration.	Check documentation

Example prompts to try

“Use Semgrep to scan directory.”
“Use Semgrep to list rules.”
“Use Semgrep to analyze results.”

Frequently asked questions

MCP Server for Semgrep Integration - static code analysis with AI Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.

Alternatives to the Semgrep MCP Server

NVD Database

Queries the NIST National Vulnerability Database (NVD) via its API.

DatabasesPython★ 14

Cursor Trivy

Scans projects for security vulnerabilities and automatically updates vulnerable dependencies using Trivy.

Security & IdentityPython★ 10

3ilm-mcp

Search 1,032 verified smart contract vulnerability findings from Sherlock audits by pattern.

Security & Identity

A2adependencyinspector-mcp

Remote MCP for A2A dependency inspector MCP, structured receipts, audit logs, and reviewer-ready evi

Security & IdentityRemote

A2areplayreceipt-mcp

Remote MCP for A2A failure replay MCP, structured receipts, audit logs, and reviewer-ready evidence.