The Semgrep MCP server, built by Semgrep, provides the official Semgrep MCP server lets an AI assistant run Semgrep — a fast, deterministic static analysis engine that semantically understands 30+ languages and ships over 5,000 security rules — directly against the code it is writing or reviewing, so you can "secure your vibe coding" without leaving Claude, Cursor, VS Code, or Windsurf. It is no longer maintained and best for Coding & Dev.
by Semgrep
This repository is archived
GitHub reports the repository below as archived, so it takes no further commits, issues or pull requests — but the published package has not been unpublished, so uvx semgrep-mcp still installs and runs. Read the section below before you build on it: where a maintained replacement exists, it is named there.
About
The official Semgrep MCP server lets an AI assistant run Semgrep — a fast, deterministic static analysis engine that semantically understands 30+ languages and ships over 5,000 security rules — directly against the code it is writing or reviewing, so you can "secure your vibe coding" without leaving Claude, Cursor, VS Code, or Windsurf. It exposes a focused tool surface: `security_check` scans code for vulnerabilities, `semgrep_scan` runs a scan with a given rule config, `semgrep_scan_with_custom_rule` applies a custom Semgrep rule you supply inline, `get_abstract_syntax_tree` returns the AST of a snippet so an agent can reason about code structure, `supported_languages` lists the languages Semgrep can parse, and `semgrep_rule_schema` fetches the latest rule JSON Schema for writing new rules. With a Semgrep AppSec Platform login and token, `semgrep_findings` pulls findings from your organization's cloud account. The server runs three ways — as a Python package via `uvx semgrep-mcp` (PyPI: semgrep-mcp), as a Docker container `ghcr.io/semgrep/mcp`, or against Semgrep's hosted endpoint at mcp.semgrep.ai — and supports stdio, Streamable HTTP, and SSE transports. Note: the standalone semgrep/mcp repository is now deprecated, with ongoing development folded into the main `semgrep` binary (semgrep/semgrep, under cli/src/semgrep/mcp), so future updates ship through the official Semgrep CLI itself.
Trust verdict
How grades are computed →Grade C (63/100, mixed) from 4 measured signals, based on live MCP handshakes.
What was measured
- Live MCP handshake85/100 · weight 30
Answered with an OAuth/Bearer challenge — the endpoint is alive and speaking MCP, it just requires credentials before it will list tools. (122 ms handshake)
- Measured uptime100/100 · weight 20
Answered 200 of 200 recorded checks (100%). A check counts as answered when the server completed the MCP handshake in any form, including an auth challenge.
- Tool-schema stability100/100 · weight 15
No tool-schema or protocol-version drift across 200 recorded checks. Tools an agent bound to last week are still the tools it will find today.
- Repository maintenance0/100 · weight 20
The repository is archived by its owner, so it is by definition no longer maintained.
- Source verification15/100 · weight 25
The repository resolves, but its owner has archived it. Archived means read-only: no fixes, no releases, no response to issues.
- Provenance90/100 · weight 10
Published and maintained by the vendor of the service it connects to, rather than by a third party.
- Listing ↔ repository match100/100 · weight 5
The listing name lines up with the linked repository semgrep/mcp.
Installation
uvx semgrep-mcpsemgrep-mcp confirmed live on PyPI — checked August 17, 2026.
Categories
Frequently Asked Questions
What is Semgrep MCP Server?
Who built Semgrep MCP Server?
Is Semgrep MCP Server free?
How do I install Semgrep MCP Server?
What does Semgrep MCP Server integrate with?
Related Guides
Live Status
- Latency
- 122 ms
OAuth-gated (HTTP 401): Streamable HTTP error: Error POSTing to endpoint: {"error": "invalid_token", "error_description": "Authentication required"}
Quick Info
- Install Type
- pip
- Author
- Semgrep
- Categories
- 2
- Integrations
- 5
Related Servers
Everything
Reference/test server with prompts, resources, and tools. Perfect for testing MCP implementations.
Git
Tools to read, search, and manipulate Git repositories. Full Git operations support.
Sequential Thinking MCP Server
a single structured-reasoning tool that lets a model plan, revise and branch its own chain of thought instead of answering in one shot. Published by Anthropic as part of the official modelcontextprotocol/servers monorepo (89,000+ stars, actively maintained), it exposes exactly one tool — sequential_thinking — and that tool is the whole product. Each call carries a `thought` string plus bookkeeping fields: `thoughtNumber`, `totalThoughts`, and `nextThoughtNeeded`, which the model flips to false when it is done. The interesting fields are the optional ones. `isRevision` and `revisesThought` let the model go back and correct an earlier step rather than plowing ahead on a bad assumption; `branchFromThought` and `branchId` let it fork into an alternative line of reasoning and carry both forward; `needsMoreThoughts` lets it extend past its own original estimate when a problem turns out to be deeper than it looked. In practice you never call the tool by hand. You connect the server to an MCP host and ask a question that deserves more than one pass — plan a PostgreSQL 14 to 16 migration and revise if downtime exceeds five minutes, work out why a deploy only fails in production, compare three architectures and branch when an assumption breaks. You can tell it is working when the host inspector shows repeated sequential_thinking calls with a rising `thoughtNumber` rather than a single response. Install with `npx -y @modelcontextprotocol/server-sequential-thinking` — note the hyphenated package name, which differs from both the `sequentialthinking` directory in the repo and the Docker image `mcp/sequentialthinking`, a mismatch that breaks a lot of copied configs. A Docker image is published alongside the npm package, and the README carries one-click VS Code install buttons for both transports. Set `DISABLE_THOUGHT_LOGGING=true` if you do not want every thought written to the server log.
21st.dev Magic
Create crafted UI components inspired by the best 21st.dev design engineers.
GitHub MCP Server
authenticated access to the whole GitHub platform — repositories, files, branches, issues, pull requests, Actions runs, security alerts, discussions and notifications — from Claude, Cursor, VS Code, Copilot CLI and any other MCP host. There is no npm package for this server, and that trips up most people who try to install it: `@github/mcp-server` is not published to the npm registry, so any `npx` line you find for it will fail. GitHub ships it three other ways. The easiest is the hosted remote server at https://api.githubcopilot.com/mcp/, which needs no install at all — point an HTTP-transport MCP client at that URL and log in with OAuth (VS Code 1.101+, Claude Desktop, Claude Code, Cursor and Windsurf all support this). The second is the official Docker image ghcr.io/github/github-mcp-server, which is what the copy-paste command on this page runs; on github.com it now performs a browser-based OAuth login on first use and keeps the token in memory only, which is why the published Docker configs map a fixed loopback callback port (-p 127.0.0.1:8085:8085 with GITHUB_OAUTH_CALLBACK_PORT=8085) so the container can receive the callback. Prefer a token? Set GITHUB_PERSONAL_ACCESS_TOKEN instead — it takes precedence over OAuth, and the minimum useful scopes are repo, read:org and read:packages. The third is the native Go binary from the repository's releases, which needs no fixed port for the OAuth flow. GitHub Enterprise Server has no hosted option: use the local server with --gh-host or GITHUB_HOST set to your instance (include the https:// scheme — it defaults to http://, which GHES rejects). Toolsets can be narrowed with GITHUB_TOOLSETS, and an insiders channel is available at /mcp/insiders or via the X-MCP-Insiders header.
Sponsored
Better Stack
Free PlanGet alerted when your APIs, browser tests, payment pipelines, or MCP server dependencies go down. Used by 100K+ developers.
Start monitoring free →