[beta] Use Semgrep in LLMs using MCP framework
MCP Server for using Semgrep to scan code.
MCP is like LSP or Unix pipes for LLMs, AI Agents, and coding tools such as Cursor.
This MCP Server provides a comprehensive interface to Semgrep through the Model Context Protocol, offering the following tools:
Scanning Code
semgrep_scan: Scan code snippets for security vulnerabilitiesscan_directory: Perform Semgrep scan on a directoryCustomization
list_rules: List available Semgrep rules with optional language filteringcreate_rule: Create custom Semgrep rulesResults
analyze_results: Analyze scan results including severity counts and top affected filesfilter_results: Filter scan results by severity, rule ID, file path, etc.export_results: Export scan results in various formats (JSON, SARIF, text)compare_results: Compare two scan results to identify new and fixed issuesInstall uv using their installation instructions
Ensure you have Python 3.13+ installed
Clone this repository
Install Semgrep (additional methods):
pip install semgrep
docker build -t mcp-server .
uv run mcp run server.py -t sse
Additional info on the python mcp sdk
docker run -p 8000:8000 mcp-server
Also published to ghcr.io/semgrep/mcp.
docker run -p 8000:8000 ghcr.io/semgrep/mcp:latest
from mcp.client import Client
client = Client()
client.connect("localhost:8000")
# Scan code for security issues
results = client.call_tool("semgrep_scan", {
"code": "def get_user(user_id):\n return User.objects.get(id=user_id)",
"language": "python"
})
MCP tabSemgrep, Type: sse, Server URL: http://127.0.0.1:8000/sse
You can also set it up by adding this to ~/.cursor/mcp.json
{
"mcpServers": {
"Semgrep": {
"url": "http://localhost:8000/sse"
}
}
}
The server supports advanced Semgrep functionality:
# Scan an entire directory
results = client.call_tool("scan_directory", {
"path": "/path/to/code",
"config": "p/security-audit"
})
# Filter results by severity
filtered = client.call_tool("filter_results", {
"results_file": "/path/to/results.json",
"severity": "ERROR"
})
Start the MCP server in development mode:
uv run mcp dev server.py
By default, the server runs on http://localhost:3000 with the inspector server on http://localhost:5173.
Note: When opening the inspector sever, add query parameters to the url to increase the default timeout of the server from 10s
http://localhost:5173/?timeout=300000
This project builds upon and is inspired by several awesome community projects: