CODE SECURITY / Semgrep
Semgrep CLI MCP
Run Semgrep scans and inspect rule or platform findings through the maintained MCP server inside the Semgrep CLI.
“Entry point for the MCP server”
01 / THE REASONING
Why this made the selection.
- Uses Semgrep’s current CLI implementation rather than the retired standalone MCP package.
- Local scan, custom-rule and rule-schema tools connect code generation with deterministic scanner output.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- Pinned in-tree MCP README, cli/pyproject.toml and root LGPL licence.
- Python MCP server registration, scan handlers and CLI wrapper.
Our findings
- The supported local entrypoint is semgrep mcp, defaulting to stdio; streamable HTTP is also documented.
- The implementation includes platform API calls and tracing as well as local scanning. Old semgrep-mcp package or hosted SSE examples are not used here.
Not established by this review
- Server launch, authenticated tool calls, and release-to-source parity were not tested.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Connect a server deliberately.
DOCUMENTED COMMAND
semgrep mcpCopying does not execute this command. It may retrieve a newer version than the reviewed source.
- Install the Semgrep CLI using the official instructions.
- Configure command semgrep with args [mcp] as a stdio server in your client; the displayed command starts that server.
- Set up optional platform credentials separately and review which scan modes and data flows you enable.
Before you start
- A current Semgrep CLI installation and supported project files.
- Optional Semgrep account/token and product entitlement for platform or commercial capabilities.
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://raw.githubusercontent.com/semgrep/semgrep/0516c0f23a3dceac5c8f5ff3fecd402af4450182/cli/src/semgrep/mcp/README.md
Supports: summary, upstreamDescription, whySelected, bestFor, limitations, install, access, compatibility, transports, review
https://raw.githubusercontent.com/semgrep/semgrep/0516c0f23a3dceac5c8f5ff3fecd402af4450182/cli/pyproject.toml
Supports: language, install
https://raw.githubusercontent.com/semgrep/semgrep/0516c0f23a3dceac5c8f5ff3fecd402af4450182/cli/src/semgrep/mcp/server.py
Supports: summary, access, review, transports
- Semgrep scan wrapper ↗Checked
https://raw.githubusercontent.com/semgrep/semgrep/0516c0f23a3dceac5c8f5ff3fecd402af4450182/cli/src/semgrep/mcp/semgrep.py
Supports: review, access
- Semgrep CLI LGPL terms ↗Checked
https://raw.githubusercontent.com/semgrep/semgrep/0516c0f23a3dceac5c8f5ff3fecd402af4450182/LICENSE
Supports: license