Semgrep MCP Server

Official Semgrep MCP server for static application security testing. Lets AI agents scan code for security vulnerabilities and bugs, run custom rules, and return findings with severity and remediation guidance, embedding SAST into AI-powered development workflows.

{
  "mcpServers": {
    "semgrep": {
      "command": "uvx",
      "args": [
        "semgrep-mcp"
      ],
      "env": {
        "SEMGREP_APP_TOKEN": "<YOUR_SEMGREP_APP_TOKEN>"
      }
    }
  }
}

{
  "type": "object",
  "required": [
    "path"
  ],
  "properties": {
    "path": {
      "type": "string",
      "description": "File or directory path to scan"
    },
    "config": {
      "type": "string",
      "description": "Ruleset to use (for example \"auto\" or a registry ruleset)"
    }
  }
}

{
  "type": "object",
  "required": [
    "code"
  ],
  "properties": {
    "code": {
      "type": "string",
      "description": "Code snippet to analyze"
    }
  }
}