Semgrep

What semgrep/semgrep MCP server does

The semgrep/semgrep MCP server makes Semgrep’s code-analysis capabilities available to an MCP client. Semgrep examines source code for bugs, security vulnerabilities, and coding-standard violations. It is a static-analysis tool rather than a runtime monitoring system: the input is source code, and the output is the set of matches and findings produced by Semgrep rules or queries.

Semgrep uses patterns that resemble the code being searched. This lets developers describe a code shape directly instead of relying only on literal text matching or regular expressions. The underlying Semgrep Code capability supports more than 30 languages, including Python, JavaScript, TypeScript, Java, Go, Ruby, Rust, PHP, C, C++, C#, Kotlin, Swift, Terraform, YAML, and Dockerfile.

How it works

An MCP client sends a code-scanning request to the server, which uses Semgrep to analyze the available source. Semgrep can apply rules for known bug and security patterns, or evaluate an ad hoc query. The README also documents interactive pattern searches through the CLI, such as matching Python expressions where both sides of an equality are the same.

Analysis runs locally on the computer or in the build environment by default, so the README states that code is not uploaded by default. Semgrep can be used in an IDE, as a pre-commit check, or in CI/CD workflows. Its broader ecosystem also includes dependency scanning through Semgrep Supply Chain, although the supplied material does not document which of those product capabilities are exposed as MCP tools.

Setup and configuration

The supplied material documents installation for the Semgrep CLI, not MCP-specific server registration. CLI installation options include Homebrew on macOS, Python pip on Ubuntu, WSL, Linux, and macOS, or Docker without a local installation. The documented Docker workflow mounts the project at /src.

A Semgrep account is optional for basic use. Logging in provides access to features such as Supply Chain scanning, Pro rules, and the Pro analysis engine. CI examples use SEMGREP_APP_TOKEN with semgrep ci; the material does not establish that this variable is required for the MCP server itself.

Limitations and notes

Community Edition analysis can miss true positives in security work because it is limited to code within a single function or file. The README recommends the Semgrep AppSec Platform for SAST, software composition analysis, and secrets scanning when cross-file, cross-function, and data-flow analysis is needed.

The supplied documentation does not specify the MCP transport, client configuration format, tool names, request schema, or response schema. Confirm those details in the implementation before integrating it into an automated agent workflow. Semgrep’s supported language list also differs by product area: Code supports 30+ languages, while Supply Chain covers 12 languages across 15 package managers.