Semgrep
Free让 AI 代理使用 Semgrep 进行代码安全扫描。 (Semgrep 官方)
FreeFree tier
About Semgrep
Semgrep MCP is a Model Context Protocol (MCP) server that enables AI agents, IDEs, and tools like Cursor, VS Code, Windsurf, ChatGPT, and Claude to scan code for security vulnerabilities using Semgrep. Built on Semgrep's fast, deterministic static analysis engine with over 5,000 rules, it provides tools for scanning code, understanding code structure, and integrating with Semgrep Cloud Platform. The server supports multiple transport protocols (stdio, Streamable HTTP, SSE) and can be run via uv or Docker. It is designed to secure 'vibe coding' by embedding security scanning directly into AI-assisted development workflows.
Key Features
Scan code for security vulnerabilities using Semgrep's 5,000+ rules
Understand code structure with semgrep_understand tool
Integrate with Semgrep Cloud Platform for login and cloud scanning
Supports multiple transports: stdio, Streamable HTTP, and Server-Sent Events (SSE)
Run via uvx (CLI) or as a Docker container
Works with Cursor, VS Code, Windsurf, ChatGPT, Claude Desktop, Claude Code, and OpenAI Agents SDK
Open-source and free to use
Pros & Cons
Pros
- Fast, deterministic static analysis with semantic understanding of many languages
- Large rule library with over 5,000 pre-built rules
- Easy setup with uvx or Docker; no heavy dependencies
- Broad integration with popular IDEs and AI tools via MCP protocol
- Actively developed by Semgrep with community support
Cons
- Beta project under active development; may have breaking changes
- Hosted server (mcp.semgrep.ai) is experimental and may be unstable
- Repository has been archived and moved to the main Semgrep repo, potentially causing confusion
- Requires Semgrep token for cloud platform features
Best For
Secure AI-assisted coding by automatically scanning generated code for vulnerabilitiesAdd security scanning to LLM agents and MCP-compatible IDEsAutomated code review for security issues in CI/CD pipelinesEnhance developer workflows with on-demand Semgrep scans from the editor
FAQ
What is Semgrep MCP?
It is a Model Context Protocol (MCP) server that allows AI agents and IDEs to use Semgrep for scanning code for security vulnerabilities.
How do I run Semgrep MCP?
You can run it via uvx: `uvx semgrep-mcp`, or as a Docker container: `docker run -i --rm ghcr.io/semgrep/mcp -t stdio`.
Which IDEs and tools are supported?
It works with Cursor, VS Code, Windsurf, ChatGPT, Claude Desktop, Claude Code, and the OpenAI Agents SDK, as well as any MCP-compatible client.
Is Semgrep MCP free?
Yes, the MCP server is open source and free to use. Semgrep itself has both free and paid tiers.
What happened to the semgrep/mcp repository?
The repository has been deprecated and archived. The MCP server has been moved to the main Semgrep binary and official repository.