mcpField
M
Mcp Semgrep Scanner

Mcp Semgrep Scanner

Local
github.com/archimedes-marketDeveloper Tools0Updated 24w ago
Repository

About Mcp Semgrep Scanner

Mcp Semgrep Scanner exposes Semgrep static security analysis to AI agents through MCP tools. It supports curated rulesets, severity-ranked findings, and baseline scans that focus on issues introduced since a chosen Git reference.

Key features

  1. 01Run default Semgrep scans
  2. 02Scan with named rulesets
  3. 03List available built-in rulesets
  4. 04Retrieve finding metadata and remediation hints
  5. 05Scan changes since a Git reference

Use cases

  1. 01Review a repository for security issues
  2. 02Check a pull request for newly introduced findings
  3. 03Inspect a finding's rule and remediation guidance

MCP support

Exposes Semgrep scanning, ruleset discovery, finding details, and baseline scanning as MCP tools for AI agents.

#mcp#semgrep#security#static-analysis#sast#devsecops#mcp-server

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

No install method listed yet

We haven’t collected a package or remote endpoint for this server. Follow the instructions in the project README.

Repository

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

Archimedes Trust Report — VERIFIED 92/100

Verified asset on Archimedes Market. View the full 4-dimension Trust Report (security · quality · license · complexity) and the curated catalog on the asset page.

MCP Semgrep Scanner

Run Semgrep static analysis from an AI agent. Lets an agent scan a repo with prebuilt rulesets (OWASP top 10, secrets, language-specific packs), surface findings with severity scoring, and run baseline diffs to focus only on newly-introduced issues.

Tools

  • scan — run a default scan (p/security-audit + p/secrets) and return findings sorted by severity
  • scan_with_ruleset — scan with one or more named rulesets (p/owasp-top-ten, p/python, etc.)
  • list_rulesets — built-in rulesets available without a Semgrep account
  • get_finding_details — full rule metadata + remediation hint for a finding ID
  • baseline_scan — scan only files modified since a git ref (HEAD~1, main, custom SHA)

What gets returned

Each finding includes:

  • rule_id — the Semgrep rule that matched
  • severity — ERROR | WARNING | INFO
  • cwe — CWE classification if available
  • owasp — OWASP category mapping
  • file + line_start + line_end
  • message — human-readable explanation
  • fix — suggested patch if available

Quick start

pip install mcp-semgrep-scanner
# Optional: Semgrep account token for Pro rules
export SEMGREP_APP_TOKEN="..."
mcp-semgrep-scanner serve

Typical agent workflow

Agent: "Are there any security issues in this PR?"
↓
1. baseline_scan(repo="/path/to/repo", base_ref="origin/main")
   → returns only findings introduced by the PR's diff
2. get_finding_details(finding_id=...) for the ERROR-severity ones
3. Agent suggests fixes inline in PR review

License

MIT.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.