Attestix vs Semgrep
A side-by-side look at the Attestix and Semgrep MCP servers: transport, auth, tools, quality signals, and the config to install either one in Claude, Cursor, Windsurf or VS Code.
Verdict: choose Attestix for security work as a local process; choose Semgrep for security as a local process. You can also run both side by side in one mcpServers block.
Which MCP server should you choose?
Choose Attestix when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- Its auth model fits you: No auth required.
- You want tools like
create_agent_identity, resolve_identity, verify_identity.
Choose Semgrep when
- You need dedicated capabilities in the Security domain.
- You prefer a local stdio subprocess transport.
- Its auth model fits you: No auth required.
Feature & specification comparison
Rows where the two servers differ are marked.
| Spec | ||
|---|---|---|
| Category | Security | Security |
| Quality signal | 61/100 · Good | 48/100 · Fair |
| Install command | Confirmed | Confirmed |
| Transport | Local subprocess (stdio) | Local subprocess (stdio) |
| Auth | No auth required | No auth required |
| Pricing | Free | Free |
| Required env vars | None listed | None listed |
| Verified owner | Community listing | Community listing |
| GitHub stars | 846 | 17,215 |
| Directory activity | 3 views 0 installs 0 upvotes | 1 views 0 installs 0 upvotes |
| Tools | 47 | Not listed |
| Full listing | View Attestix | View Semgrep |
Tools & capabilities
Attestix tools 47
create_agent_identityCreate a UAIT from any identity sourceresolve_identityAuto-detect token type and registerverify_identityCheck existence, revocation, expiry, signaturetranslate_identityConvert to A2A, DID Document, OAuth, or summarylist_identitiesList UAITs with protocol/revocation filtersget_identityGet full UAIT detailsrevoke_identityMark a UAIT as revokedpurge_agent_dataRemove locally managed records and parseable local backups; external copies need separate handlingparse_agent_cardParse an A2A Agent Card JSONgenerate_agent_cardGenerate agent.json for hostingdiscover_agentFetch `/.well-known/agent.json` from a URLcreate_did_keyGenerate ephemeral `did:key` with Ed25519 keypair- +35 more on the listing page
Semgrep tools
No tool names declared yet. Check the project README from the listing page.
Ready-to-paste client configs
Paste either block (or both) into your client config, e.g. claude_desktop_config.json or ~/.cursor/mcp.json. We only show a config when the install command is confirmed.
Attestix
{
"mcpServers": {
"attestix": {
"command": "uvx",
"args": [
"attestix"
]
}
}
}
Semgrep
{
"mcpServers": {
"semgrep-semgrep": {
"command": "uvx",
"args": [
"semgrep"
]
}
}
}
Frequently asked questions
Attestix is categorized under Security and uses a local stdio subprocess. Semgrep belongs to Security and uses a local stdio subprocess. Pick Attestix for security work and Semgrep for security.
Copy the mcpServers block from the config section on this page into your client's config (for example claude_desktop_config.json or ~/.cursor/mcp.json), then fully restart the client.
Attestix is listed as free. Auth: no auth required. Semgrep is listed as free. Auth: no auth required. If a server needs environment variables such as API keys, define them under the env key in your client's MCP config.
Yes. MCP clients support multiple servers: add attestix and semgrep-semgrep as separate keys in the same mcpServers object, and your assistant will call tools from either one.
On AllMCPs, Attestix has a quality signal of 61/100 (Good) with 3 views, 0 installs and 846 GitHub stars. Semgrep has 48/100 (Fair) with 1 views, 0 installs and 17,215 GitHub stars.