Semgrep Code Security MCP

๐Ÿ›ก๏ธ Officialโœ“ VerifiedHTTP + SSEPublic ยท No Auth3 toolsยทDegraded228msยท30d uptime: 100%ยทLast checked 18m ago

Semgrep's public MCP (mcp.semgrep.ai) gives agents static-analysis tools โ€” scan code for vulnerabilities, check security posture and inspect ASTs โ€” with no authentication.

https://mcp.semgrep.ai/mcp
SSEhttps://mcp.semgrep.ai/sse
Provider
Semgrep โ†—
Source
https://github.com/semgrep/mcp โ†—
Categories
๐Ÿ› ๏ธ Developer Tools & Git
ไธญๆ–‡็ฎ€ไป‹

Semgrep ๅ…่ดน่ฟœ็จ‹ MCP ๆœๅŠกๅ™จ๏ผŒ้ขๅ‘ไปฃ็ ๅฎ‰ๅ…จใ€‚ๆ— ้œ€็™ปๅฝ•ๅณๅฏๆ‰ง่กŒ Semgrep ๆ‰ซๆใ€ๅฎ‰ๅ…จๆฃ€ๆŸฅๅ’Œ AST ๅˆ†ๆžใ€‚

HTTP + SSEhttps://mcp.semgrep.ai/mcp
Legacy SSE endpoint
SSEhttps://mcp.semgrep.ai/sse
Install in Cursor โ†’

Or add to ~/.cursor/mcp.json:

{
  "mcpServers": {
    "semgrep": {
      "url": "https://mcp.semgrep.ai/mcp"
    }
  }
}
๐Ÿ”ฌ Test Live in Online Inspector๐Ÿ” Audit OAuth 2.1 Config

๐Ÿงฐ Tools exposed by Semgrep MCP (3)

ToolSafetyDescriptionParameters
semgrep_scan๐ŸŸข ReadScan a code snippet with Semgrep rules and return findings.code*: stringlanguage: string
security_check๐ŸŸข ReadRun a security-focused check over provided code files.codeFiles*: arrayconfig: string
get_abstract_syntax_tree๐ŸŸข ReadReturn the abstract syntax tree Semgrep builds for a code snippet.code*: stringlanguage: string

๐Ÿ” OAuth 2.1 & Security

Auth type
None (public)
Dynamic Client Registration
โ€”
PKCE S256
โ€”
Protected resource metadata
https://mcp.semgrep.ai/.well-known/oauth-protected-resource (expected location)
๐Ÿ” Audit OAuth 2.1 Config โ†’

๐Ÿงฉ Recommended Agent Skills

๐Ÿ“– Guide

Semgrep MCP โ€” Remote MCP Server

Semgrep's hosted MCP puts a SAST engine behind tool calls: paste code and get back findings, security checks or the abstract syntax tree Semgrep sees. It is public and unauthenticated โ€” code you send goes to Semgrep's service, so avoid scanning secrets or proprietary code you cannot share.

Endpoint & Transport

  • Endpoint URL: https://mcp.semgrep.ai/mcp
  • Legacy SSE endpoint: https://mcp.semgrep.ai/sse
  • Transport: Streamable HTTP + legacy SSE

Authentication

Semgrep MCP is public and unauthenticated โ€” no OAuth, no API key, no headers. Any MCP client can connect and call its tools directly, which also makes it a great endpoint for smoke-testing your own MCP client or proxy.

Available Tools (3)

Tool Safety Description
semgrep_scan read Scan a code snippet with Semgrep rules and return findings.
security_check read Run a security-focused check over provided code files.
get_abstract_syntax_tree read Return the abstract syntax tree Semgrep builds for a code snippet.

Connect in 30 Seconds

Claude Code โ€” one command:

claude mcp add --transport http semgrep https://mcp.semgrep.ai/mcp

Cursor โ€” add to ~/.cursor/mcp.json:

{ "mcpServers": { "semgrep": { "url": "https://mcp.semgrep.ai/mcp" } } }

VS Code โ€” add to .vscode/mcp.json:

{ "servers": { "semgrep": { "type": "http", "url": "https://mcp.semgrep.ai/mcp" } } }

Claude Desktop & stdio clients โ€” bridge with mcp-remote:

{ "mcpServers": { "semgrep": { "command": "npx", "args": ["-y", "mcp-remote", "https://mcp.semgrep.ai/mcp"] } } }

Troubleshooting

  • Which URL should I use? Prefer https://mcp.semgrep.ai/mcp (Streamable HTTP). The SSE URL is only for older clients pinned to the pre-2025-03-26 spec.
  • "Session expired" / stale Mcp-Session-Id โ€” just re-send initialize; stateless clients can ignore session headers entirely.
  • No authentication required โ€” don't send proprietary code you can't share with a third-party service.
  • Both /mcp and /sse transports are available.

๐Ÿš€ How to Connect

  1. Copy the Semgrep MCP endpoint URL
    The remote endpoint is https://mcp.semgrep.ai/mcp. A legacy SSE endpoint is also available at https://mcp.semgrep.ai/sse.
  2. Add it to your MCP client
    Claude Code: claude mcp add --transport http semgrep https://mcp.semgrep.ai/mcp. Cursor: add "semgrep": { "url": "https://mcp.semgrep.ai/mcp" } under mcpServers in ~/.cursor/mcp.json. Other clients work similarly.
  3. Verify with the online inspector
    Paste https://mcp.semgrep.ai/mcp into remotemcp.net/inspector, run initialize and tools/list, and confirm Semgrep MCP's 3 tools respond.

โ“ FAQ

What is the Semgrep MCP remote MCP endpoint?

The primary endpoint is https://mcp.semgrep.ai/mcp, with a legacy SSE endpoint at https://mcp.semgrep.ai/sse. It is an official first-party server operated by Semgrep, speaking the Streamable HTTP + legacy SSE transport.

Should I use Semgrep MCP's /mcp or /sse endpoint?

Use https://mcp.semgrep.ai/mcp โ€” Streamable HTTP is the current MCP transport and what every modern client defaults to. https://mcp.semgrep.ai/sse exists only for clients still on the legacy HTTP+SSE transport from the 2024 spec.

How do I authenticate with Semgrep MCP?

You don't โ€” Semgrep MCP is public and unauthenticated. Connect and start calling tools; no OAuth flow or API key is needed.

I'm getting a 401 Unauthorized from Semgrep MCP โ€” what's wrong?

Semgrep MCP is authless, so a 401 is unusual. Check that you're hitting https://mcp.semgrep.ai/mcp exactly (including the path) and not an API endpoint that requires a different credential.

Which MCP clients work with Semgrep MCP?

Any client that supports remote MCP servers: Cursor, Claude Code (`claude mcp add --transport http semgrep https://mcp.semgrep.ai/mcp`), VS Code Copilot, ChatGPT connectors, Windsurf, and Claude Desktop via the `mcp-remote` bridge.

What tools does Semgrep MCP expose?

3 tools are cataloged in this directory โ€” including `semgrep_scan`, `security_check`, `get_abstract_syntax_tree`. Use our online inspector to fetch the live tool list straight from the endpoint.

๐Ÿ”— Connect Guides

Cursor
Connect Semgrep MCP โ†’
Claude
Connect Semgrep MCP โ†’
Claude Code
Connect Semgrep MCP โ†’
VS Code
Connect Semgrep MCP โ†’
ChatGPT
Connect Semgrep MCP โ†’
Windsurf
Connect Semgrep MCP โ†’

๐Ÿ“› Embed Status Badge in README

Semgrep MCP status badge
[![Remote MCP Status](https://remotemcp.net/api/badge/status/semgrep.svg)](https://remotemcp.net/servers/semgrep)
Semgrep MCP inspector badge
[![Test in Inspector](https://remotemcp.net/api/badge/inspect/semgrep.svg)](https://remotemcp.net/inspector?url=https%3A%2F%2Fmcp.semgrep.ai%2Fmcp)

Related Servers

GitHub MCPGitHub

GitHub's official remote MCP server hosted at api.githubcopilot.com. Gives AI agents first-party access to repositories, issues, pull requests and code search.

https://api.githubcopilot.com/mcp/
๐Ÿ›ก๏ธ Officialโœ“ VerifiedStreamable HTTPOAuth 2.15 toolsOnline232ms
Linear MCPLinear Orbit Inc.

Linear's official remote MCP server. Agents can search, create and update issues and query your team's workflow over Streamable HTTP or SSE.

https://mcp.linear.app/mcp
๐Ÿ›ก๏ธ Officialโœ“ VerifiedHTTP + SSEOAuth 2.14 toolsOnline7ms
DeepWiki MCPCognition AI (Devin)

Cognition Devin's free DeepWiki MCP. Ask questions and read AI-generated wiki documentation for any public GitHub repository โ€” no auth required.

https://mcp.deepwiki.com/mcp
๐Ÿง‘โ€๐Ÿ’ป Communityโœ“ VerifiedHTTP + SSEPublic ยท No Auth3 toolsOnline73ms
Context7 MCPUpstash

Upstash Context7's free, no-auth MCP server. Fetches up-to-date, version-specific library documentation straight into your agent's context.

https://mcp.context7.com/mcp
๐Ÿง‘โ€๐Ÿ’ป Communityโœ“ VerifiedStreamable HTTPPublic ยท No Auth2 toolsOnline310ms