What it is
Semgrep is a fast static analyser for more than 30 languages whose rules look like the code they match. Its MCP server, now built into the semgrep binary as semgrep mcp after the standalone semgrep/mcp repo was archived, lets an agent scan code with those rules. For Claude Code, Semgrep Guardian bundles the MCP server with hooks that scan every file the agent writes.
By default code is analysed locally and never uploaded. The free Community Edition analyses one function or file at a time; cross-file dataflow, Pro rules and dependency scanning need a Semgrep login.
Install
semgrep mcpOur review
The last line of defence for AI-written code should be the same one human code faces: a check outside the coding session that blocks the merge. Semgrep has been that check for years, across more than 30 languages, and its main repo has 17,000 GitHub stars and release 1.182.0. The MCP server and the Guardian plugin bring it into the session too.
That matters because the agent sees the finding while it is still working, and fixes it before you ever review the diff. And because Semgrep rules are written in the language's own syntax, a bug your team found once becomes a rule that catches it forever, in the editor, in the agent and in CI.
The catch: the free Community Edition looks at one function or file at a time, and Semgrep itself says that misses many real bugs in security use. Cross-file dataflow and dependency scanning need a login, and the full platform is commercial. Registry configs send pseudonymous rule metrics unless you pass --metrics=off.
Our take: whatever else you adopt, make semgrep scan --error a required status check on pull requests. On the free tier, OSV-Scanner for dependencies and Gitleaks for secrets fill the obvious gaps.
Where it earns its place
A 20-developer team using Claude Code on a TypeScript monorepo
Block insecure code from merging, whoever wrote it
Add semgrep scan --config auto --error --metrics=off as a required CI check; install Guardian so the agent sees the same findings while it works. The Community Edition is free.
An AppSec lead who keeps seeing the same bug class
Stop a recurring bug pattern for good
Write one Semgrep rule in the code's own syntax and add it to the shared config used by CI and the agent.
Before you commit
- Setup
- brew install semgrep or python3 -m pip install semgrep; run semgrep mcp for the server. Guardian installs from Claude Code's /plugin manager.
- Integrations
- Claude Code (Guardian plugin with hooks), Cursor, VS Code and other MCP clients; GitHub and GitLab CI; SARIF output.
- Data and privacy
- Code is analysed locally and not uploaded by default; registry configs send pseudonymous metrics unless --metrics=off. Guardian talks to semgrep.dev for login and deployment details.
- Cost at scale
- Community Edition is free; AppSec Platform pricing is per contributor on Semgrep's pricing page.
- Limits
- Community Edition is single-function or single-file analysis and misses cross-file bugs.
What's good
- Same rules in the agent, the editor and CI
- Code analysed locally by default
- Rules look like the code they match
- Over 30 languages
What's not
- Free tier analyses one function or file at a time
- Cross-file analysis and dependency scanning need a login
- Registry configs send metrics unless disabled
- Standalone MCP repo archived; check docs for current install
Best for
Any team that wants AI-written code to face the same static-analysis gate as human code.
Alternatives
Semgrep MCP: common questions
- Is Semgrep MCP worth it?
- A model can be talked out of a finding; a failed CI check can't, and Semgrep lets you run the same check in both places. We rate it 4.3 out of 5.
- How much does Semgrep MCP cost?
- Community Edition free under LGPL 2.1; Semgrep AppSec Platform (Pro rules, cross-file analysis, Supply Chain, Secrets) is paid.
- What are the downsides of Semgrep MCP?
- Free tier analyses one function or file at a time; cross-file analysis and dependency scanning need a login; registry configs send metrics unless disabled; standalone MCP repo archived; check docs for current install.
- Who is Semgrep MCP best for?
- Any team that wants AI-written code to face the same static-analysis gate as human code.
- How much does Semgrep MCP cost for a team or in production?
- Community Edition is free; AppSec Platform pricing is per contributor on Semgrep's pricing page.
- Is Semgrep MCP safe for company data?
- Code is analysed locally and not uploaded by default; registry configs send pseudonymous metrics unless --metrics=off. Guardian talks to semgrep.dev for login and deployment details.
- What are the best Semgrep MCP alternatives?
- The closest alternatives we have reviewed are Snyk MCP Server (Snyk Studio).
Answers checked Oct 24, 2026.
Make Semgrep MCP? Show this rating on your site
