MCP Server Semgrep
About
MCP Server Semgrep is a [Model Context Protocol](https://modelcontextprotocol.io) compliant server that integrates the powerful Semgrep static analysis tool with AI assistants like Anthropic Claude. It enables advanced code analysis, security vulnerability detection, and code qua
Details
- License
- MIT
Explore
- Direct integration with the official MCP SDK
- Simplified architecture with consolidated handlers
- Clean ES Modules implementation
- Efficient error handling and path validation for security
- Interface and documentation in both English and Polish
- Comprehensive unit tests
- Extensive documentation
- Cross-platform compatibility (Windows, macOS, Linux)
- Flexible Semgrep installation detection and management
- Node.js v18+
- TypeScript (for development)
The easiest way to install and use MCP Server Semgrep is through Smithery.ai:
1. Visit MCP Server Semgrep on Smithery.ai
2. Follow the installation instructions to add it to your MCP-compatible clients
3. Configure any optional settings like the Semgrep API token and allowed workspace roots
This is the recommended method for Claude Desktop and other MCP clients as it handles all dependencies and configuration automatically.
1. Clone the repository:
git clone https://github.com/VetCoders/mcp-server-semgrep.git
cd mcp-server-semgrep
2. Install dependencies (supports all major package managers):
This server does not implement its own Semgrep account handling. It shells out to the installed semgrep CLI and relies on Semgrep's normal authentication behavior.
- Local terminal and local development runs can often use an existing semgrep login session from the current OS account.
- Managed launches such as Claude Desktop, Smithery, containers, or CI should prefer an explicit SEMGREP_APP_TOKEN for deterministic behavior.
- SEMGREP_APP_TOKEN is still the safest option when you need portable configuration across machines or runners.
Semgrep can be installed in several ways:
- Via package managers:
1. Visit MCP Server Semgrep on Smithery.ai
2. Click "Install in Claude Desktop"
3. Follow the on-screen instructions
1. Install Claude Desktop
2. Update the Claude Desktop configuration file (claude_desktop_config.json) and add this to your servers section.
For local launches started under a user account that is already authenticated with semgrep login, the Semgrep CLI may be able to reuse that login. For desktop-managed or shared environments, we still recommend setting SEMGREP_APP_TOKEN explicitly:
{
"mcpServers": {
"semgrep": {
"command": "node",
"args": [
"/your_path/mcp-server-semgrep/build/index.js"
],
"env": {
"SEMGREP_APP_TOKEN": "your_semgrep_app_token",
"MCP_SERVER_SEMGREP_ALLOWED_ROOTS": "/Users/you/projects"
}
}
}
}
3. Launch Claude Desktop and start asking questions about code analysis.
If you want to scan more than one workspace, set MCP_SERVER_SEMGREP_ALLOWED_ROOTS to a platform-delimited list of absolute paths.
POWERED BY:
About the Project
This project was initially inspired by robustness of Semgrep tool, The Replit Team and their Agent V2, as well as the implementation by stefanskiasan/semgrep-mcp-server, but has evolved with significant architectural changes for enhanced and easier installation and maintenance.
MCP Server Semgrep is a Model Context Protocol compliant server that integrates the powerful Semgrep static analysis tool with AI assistants like Anthropic Claude. It enables advanced code analysis, security vulnerability detection, and code quality improvements directly through a conversational interface.
Benefits of Integration
For Developers and Development Teams:
- Holistic Source Code Analysis - detecting issues throughout the entire project, not just in individual files
- Proactive Error Detection - identifying potential problems before they become critical bugs
- Continuous Code Quality Improvement - regular scanning and refactoring lead to gradual codebase improvements
- Stylistic Consistency - identification and fixing of inconsistencies in code, such as:
- Arbitrary z-index layers in CSS
- Inconsistent naming conventions
- Code duplication
- "Magic numbers" instead of named constants
For Security:
- Automated Code Verification for Known Vulnerabilities - scanning for known security issue patterns
- Customized Security Rules - creating project-specific rules
- Team Education - teaching secure programming practices through detection of potential issues
For Project Maintenance and Development:
- "Live" Documentation - AI can explain why a code fragment is problematic and how to fix it
- Technical Debt Reduction - systematically detecting and fixing problematic areas
- Improved Code Reviews - automatic detection of common issues allows focus on more complex matters
Key Features
- Direct integration with the official MCP SDK
- Simplified architecture with consolidated handlers
- Clean ES Modules implementation
- Efficient error handling and path validation for security
- Interface and documentation in both English and Polish
- Comprehensive unit tests
- Extensive documentation
- Cross-platform compatibility (Windows, macOS, Linux)
- Flexible Semgrep installation detection and management
Functions
Semgrep MCP Server provides the following tools:
- scan_directory: Scanning source code for potential issues
- list_rules: Displaying available rules and languages supported by Semgrep
- analyze_results: Detailed analysis of scan results
- create_rule: Creating custom Semgrep rules
- filter_results: Filtering results by various criteria
- export_results: Exporting results in various formats
- compare_results: Comparing two sets of results (e.g., before and after changes)
Common Use Cases
- Code security analysis before deployment
- Detection of common programming errors
- Enforcing coding standards within a team
- Refactoring and improving quality of existing code
- Identifying inconsistencies in styles and code structure (e.g., CSS, component organization)
- Developer education regarding best practices
- Verification of fix correctness (comparing before/after scans)
Installation
Prerequisites
- Node.js v18+
- TypeScript (for development)
Option 1: Install from Smithery.ai (Recommended)
The easiest way to install and use MCP Server Semgrep is through Smithery.ai:
1. Visit MCP Server Semgrep on Smithery.ai
2. Follow the installation instructions to add it to your MCP-compatible clients
3. Configure any optional settings like the Semgrep API token and allowed workspace roots
This is the recommended method for Claude Desktop and other MCP clients as it handles all dependencies and configuration automatically.
Option 2: Install from NPM Registry
```bash
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
