semgrep/mcp
This repository has been deprecated, and further updates to the Semgrep MCP server will be made via the official semgrep binary. A Model Context Protocol (MCP) server for using Semgrep to scan code for security vulnerabilities. Secure your vibe coding! 😅 Model Context Protocol (MCP) is a standardized API for LLMs, Agents, and IDEs like Cursor, VS Code, Windsurf, or anything that supports MCP, to get specialized help, get context, and harness the power of tools. Semgrep is a fast, deterministic static analysis tool that semantically understands many languages and comes with over 5,000 rules. 🛠️
Ads
Overview
This repository has been deprecated, and further updates to the Semgrep MCP server will be made via the official semgrep binary. A Model Context Protocol (MCP) server for using Semgrep to scan code for security vulnerabilities. Secure your vibe coding! 😅 Model Context Protocol (MCP) is a standardized API for LLMs, Agents, and IDEs like Cursor, VS Code, Windsurf, or anything that supports MCP, to get specialized help, get context, and harness the power of tools. Semgrep is a fast, deterministic static analysis tool that semantically understands many languages and comes with over 5,000 rules. 🛠️
Capabilities
- security_check
Scan code for security vulnerabilities — Ask the assistant to run `security_check` or `semgrep_scan` on a code snippet or file to find security issues.
- semgrep_scan_with_custom_rule
Scan with a custom Semgrep rule — Use `semgrep_scan_with_custom_rule` to check code against a rule you provide inline.
- semgrep_findings
Fetch findings from Semgrep AppSec Platform — Retrieve existing project findings via `semgrep_findings` when a Semgrep token is configured.
- get_abstract_syntax_tree
Inspect code structure — Get the Abstract Syntax Tree of a code snippet with `get_abstract_syntax_tree` to understand its parsed structure.
- write_custom_semgrep_rule
Get help writing a custom rule — Use the `write_custom_semgrep_rule` prompt to generate a template for a new Semgrep rule.
Installation
uvx semgrep-mcp # see --help for more options
Configuration
{
"mcpServers": {
"mcp": {
"command": "uvx",
"args": [
"semgrep-mcp"
]
}
}
}Paste into ~/.cursor/mcp.json or .cursor/mcp.json
Tags
- security
- code-quality
- development
- devops
- awesome-list
Related MCP servers
Cryptography
ucsandman/DashClaw
Fail-closed approval layer for unattended agent runs: `guard` evaluates each declared action against org policy before it executes (allow/warn/block/require-approval with one-click human approval), records every decision to a causal ledger, and adds plan preflight, scoped delegation grants, and containment verdicts. `npx -y @dashclaw/mcp-server`
Cryptography
luiacuaniello/perspectivegraph
Attack-path engine for cloud and Kubernetes. Eight read-only tools let an agent list the reachable routes from internet exposure to sensitive assets, explain each hop and the evidence behind its probability, find choke points, and simulate cutting a relationship before recommending the fix. Connects to a running PerspectiveGraph: `perspectivegraph mcp --api http://localhost:8080`.
Cryptography
Gowthaman90/mcp-bastion
Reliability + security proxy that sits in front of MCP servers: TOFU tool-definition pinning against rug pulls, tool-poisoning and cross-server-exfiltration detection, argument/command-injection blocking, inline secret redaction, MCP 2026-07-28 header/body validation (`-32020`) and cache-policy clamping, and a compliance-mapped audit trail (NIST AI RMF / OWASP). Coverage measured on an open benchmark with a held-out corpus. `npx -y mcp-bastion`
Cryptography
elberacasa/umbra
Trust score and guardrails for AI-generated code: static security rules, Docker-verified build/boot checks, and claim receipts that catch agents lying about tests. Tools: `scan_repo`, `guard_content`, `get_score`. Run with `npx --yes -p @elberacasa/umbra umbra-mcp`.
Cryptography
M2M-Sentinel/m2m-sentinel-sdk
Deterministic EVM bytecode capability intelligence, EIP-1967 proxy resolution, gas recommendations, and preflight safety intelligence for autonomous agents on Base (`Chain ID: 8453`). Supports stdio and hosted SSE. `npx -y m2m-sentinel-sdk`
Cryptography
Drumworks/ssid-mcp
MAC-address (OUI) vendor lookup and router default-login directory for AI agents. Identify a device manufacturer from its MAC address, detect randomized/private (locally-administered) addresses instead of reporting "unknown", or fetch a router's default login IP and admin credentials — every router field cited to the manufacturer's own documentation. Free tier, no signup. `npx -y ssid-mcp`
Cryptography
aggrete/aggrete
Policy proxy that governs what AI assistants can reach and do: refuses forbidden tool calls before the upstream is contacted, with per-user memory and a tamper-evident audit. Stops prompt-injection exfiltration and forbidden data combinations across Slack, Drive, GitHub and more. `pip install aggrete`.
Cryptography
SaravananJaichandar/etch-mcp
Signed audit chain for AI agent decisions. Every event signed, Merkle-chained per project, anchored to public transparency logs, and offline-verifiable against a pinned public key without dependency on our infrastructure. Post-hoc evidence primitive, complementary to runtime enforcement (not a substitute). Zero-signup try-it-now: `curl -X POST https://etch.systems/v1/your-project` returns a bearer token you can drop into any MCP client.