Semgrep MCP Server: Setup for Claude, Cursor and Other Apps

• Scans your code files for security problems

  Runs Semgrep on files you name, which must be absolute paths inside your open project. It returns each finding with its file, line and rule. Files outside the project are refused unless you turn that on.

  Try: “Scan the files I just changed for security bugs.”

  Runs code · semgrep_scan

• Checks your project's dependencies for known vulnerabilities

  Scans the open project's lockfiles for risky third-party packages. It needs Semgrep's Pro Engine running in the background, so it fails with a clear error if that is not set up.

  Try: “I just added a dependency. Check the project for vulnerable packages.”

  Runs code · semgrep_scan_supply_chain

• Lists the findings already in your Semgrep account

  Pulls findings from past scans stored in Semgrep AppSec Platform. You can filter by repo, status, severity, confidence and Semgrep's own true or false positive verdict. It does not scan anything new.

  Try: “List the open critical findings for this repo and suggest fixes.”

  Network · semgrep_findings

• Tests a rule you wrote against code

  Takes code and a Semgrep rule in YAML, copies them to a temporary folder, scans and returns the matches. Use it to try out a rule for a bug pattern the default rules miss.

  Try: “Run this rule against my handler code and show what it matches.”

  Runs code · semgrep_scan_with_custom_rule

• Shows how Semgrep parses a piece of code

  Parses the code you pass in the language you name and returns its syntax tree as JSON. It helps when you are writing a rule and need to see the shape Semgrep matches on.

  Try: “Show me the syntax tree for this function so I can write a rule.”

  Runs code · get_abstract_syntax_tree

• Fetches the format Semgrep rules must follow

  Downloads the current rule schema from Semgrep. The assistant uses it so the rules it writes are valid.

  Try: “What fields can a Semgrep rule have?”

  Network · semgrep_rule_schema

• Lists the languages Semgrep can scan

  Asks the Semgrep program which languages it supports and returns the list. It is only for when the assistant is unsure.

  Try: “Does Semgrep support Kotlin?”

  Runs code · get_supported_languages

Watch out for

• Scans read files in your open project

  Scan tools accept only absolute paths inside the workspace and refuse files outside it. Setting SEMGREP_MCP_ALLOW_SCAN_OUTSIDE_WORKSPACE=true lifts that, so leave it off. github.com

• The default scan needs metrics turned on

  Without a rule config, the scan uses Semgrep auto rules and refuses to run when SEMGREP_SEND_METRICS is off. Pick a specific rule config if you want metrics off. github.com

• A Semgrep token lets it read your findings

  Findings from your Semgrep account are readable with SEMGREP_APP_TOKEN. Create the token in Semgrep settings and share it with this server only. github.com

• HTTP mode opens a local port

  In streamable-http mode the server listens on 127.0.0.1:8000 by default. Do not change the host to expose it to your network. github.com