--- title: "Semgrep CLI MCP: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/mcp-servers/semgrep-cli/ description: "Run Semgrep scans and inspect rule or platform findings through the maintained MCP server inside the Semgrep CLI." --- # Semgrep CLI MCP: review, setup & limitations · Undominated.ai > Run Semgrep scans and inspect rule or platform findings through the maintained MCP server inside the Semgrep CLI. [← Explore all mcp servers](/mcp-servers/) CODE SECURITY / Semgrep # Semgrep CLI MCP Run Semgrep scans and inspect rule or platform findings through the maintained MCP server inside the Semgrep CLI. See setup guidance ↓Original source ↗ SOURCE REVIEW Reviewed 2026-09-21 Evidence 5 linked sources Publisher Semgrep Licence LGPL-2.1 (CLI source; commercial services separate) ↗ Revision 0516c0f23a3d Read what was—and wasn’t—checked ↓ “Entry point for the MCP server” Semgrep · upstream description ↗ Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - Uses Semgrep’s current CLI implementation rather than the retired standalone MCP package. - Local scan, custom-rule and rule-schema tools connect code generation with deterministic scanner output. ### A good fit for - Scan an approved working tree for code findings. - Explore a Semgrep rule or inspect authenticated platform findings. ### Weigh up before choosing - Scan output is evidence from a scanner, not a guarantee that generated code is secure. - Platform findings, Pro capabilities and some scan modes require account access or entitlements; local invocation is not proof of fully offline operation. - The README contains older commented marketplace examples and a Docker HTTP example missing its transport flag; use the straightforward local stdio setup here. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - Pinned in-tree MCP README, cli/pyproject.toml and root LGPL licence. - Python MCP server registration, scan handlers and CLI wrapper. ### Our findings - The supported local entrypoint is semgrep mcp, defaulting to stdio; streamable HTTP is also documented. - The implementation includes platform API calls and tracing as well as local scanning. Old semgrep-mcp package or hosted SSE examples are not used here. ### Not established by this review - Server launch, authenticated tool calls, and release-to-source parity were not tested. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Connect a server deliberately. Upstream setup instructions ↗ DOCUMENTED COMMAND semgrep mcp Copy command ↗ Copying does not execute this command. It may retrieve a newer version than the reviewed source. - Install the Semgrep CLI using the official instructions. - Configure command semgrep with args [mcp] as a stdio server in your client; the displayed command starts that server. - Set up optional platform credentials separately and review which scan modes and data flows you enable. ### Before you start - A current Semgrep CLI installation and supported project files. - Optional Semgrep account/token and product entitlement for platform or commercial capabilities. ### Compatibility VS Code · Kiro · stdio clients ### Implementation Python ### Transports stdio · Streamable HTTP ### Local scanner; optional platform credentials - Reads source files and invokes scanner tooling; source text/results are returned to the client. - Depending on mode, calls Semgrep services and authenticated findings APIs. ### Cost model Open-source CLI and commercial Semgrep services have different terms; account features and the AI client may add costs. 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - Semgrep CLI MCP setup and scope ↗ Checked 2026-09-21 https://raw.githubusercontent.com/semgrep/semgrep/0516c0f23a3dceac5c8f5ff3fecd402af4450182/cli/src/semgrep/mcp/README.md Supports: summary, upstreamDescription, whySelected, bestFor, limitations, install, access, compatibility, transports, review - Semgrep Python CLI manifest ↗ Checked 2026-09-21 https://raw.githubusercontent.com/semgrep/semgrep/0516c0f23a3dceac5c8f5ff3fecd402af4450182/cli/pyproject.toml Supports: language, install - Maintained Semgrep MCP registration and handlers ↗ Checked 2026-09-21 https://raw.githubusercontent.com/semgrep/semgrep/0516c0f23a3dceac5c8f5ff3fecd402af4450182/cli/src/semgrep/mcp/server.py Supports: summary, access, review, transports - Semgrep scan wrapper ↗ Checked 2026-09-21 https://raw.githubusercontent.com/semgrep/semgrep/0516c0f23a3dceac5c8f5ff3fecd402af4450182/cli/src/semgrep/mcp/semgrep.py Supports: review, access - Semgrep CLI LGPL terms ↗ Checked 2026-09-21 https://raw.githubusercontent.com/semgrep/semgrep/0516c0f23a3dceac5c8f5ff3fecd402af4450182/LICENSE Supports: license KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Snyk Studio MCP ↗ Invoke Snyk source, dependency, configuration and package-health checks through its CLI-integrated MCP server.](/mcp-servers/snyk/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)