Semgrep Guardian

​

Prerequisites

• A Semgrep account

​

Connect to your IDE

• Claude Code
• Codex
• Cursor
• GitHub Copilot
• VS Code
• Devin (Windsurf)
• Kiro
• Other IDEs

Uses Claude Code hooks and plugins. Claude Code uses Semgrep’s hosted remote server by default, so you do not need to install the Semgrep CLI locally.

The MCP server bundled with this plugin works on all platforms. On Windows, however, it requires Windows Subsystem for Linux (WSL) for the MCP server to work out of the box.

1

Start a Claude Code instance:

claude

2

Open the plugin manager:

/plugin

3

Go to Discover, search for Semgrep, and click Install.

4

Tell Claude to load the plugin:

/reload-plugins

5

Start a new session in Claude to begin the OAuth login flow:

/clear

The plugin registers a post-tool hook so Claude Code scans every file it writes.

Run Semgrep Guardian locally

The remote server is the recommended default. If you need to run Semgrep locally instead, you can install the local plugin from the semgrep/guardian-local repo.

1

Install the Semgrep CLI.

2

Start a Claude Code instance:

claude

3

Open the plugin manager:

/plugin

4

Go to Discover. Search for Semgrep, and then click Install.

5

Load the plugin:

/reload-plugins

Uses Codex MCP.

1

Install the Semgrep CLI.

2

Update your ~/.codex/config.toml file and paste the following:

[mcp_servers.semgrep]
command = "semgrep"
args = ["mcp"]

Codex does not expose a post-write hook, so Semgrep tools are surfaced through MCP and invoked when the agent calls them.

Uses Cursor hooks and MCP.

1

Install the Semgrep CLI.

2

Find Semgrep in the Cursor Plugin Marketplace, or open Cursor > ⌘⇧J > Plugins. Search “Semgrep” and click Add to Cursor.

3

Restart Cursor to apply configuration.

4

In Cursor’s chat, run the /setup-semgrep-plugin skill to finish wiring up the plugin.The plugin uses Cursor hooks (afterFileEdit and stop) to scan code as the agent writes it, and exposes Semgrep tools through Cursor MCP.

Uses GitHub Copilot MCP in Visual Studio, JetBrains IDEs, Xcode, or Eclipse. (For Copilot in VS Code, use the VS Code tab.)

1

Install the Semgrep CLI.

2

Register the Semgrep MCP server with your IDE’s Copilot configuration. The JSON shape is the same across IDEs:

  {
    "servers": {
      "semgrep": {
          "command": "semgrep",
          "args": ["mcp"]
      }
    }
  }

Follow your IDE’s instructions for where to put this entry: Extending Copilot Chat with MCP servers covers Visual Studio, JetBrains, Xcode, and Eclipse.

3

Restart your IDE and open Copilot Chat. Semgrep tools become available in Agent mode.

Copilot does not expose a post-write hook, so Semgrep tools are invoked when the agent calls them through MCP.

Uses VS Code MCP servers.

1

Install the Semgrep CLI.

2

Add the Semgrep MCP server to VS Code. Create .vscode/mcp.json in your workspace (or run the MCP: Open User Configuration command from the Command Palette for a user-wide entry) and paste the following:

  {
    "servers": {
      "semgrep": {
          "command": "semgrep",
          "args": ["mcp"]
      }
    }
  }

3

Reload VS Code. Semgrep tools become available in the Copilot Chat Agent mode.

VS Code does not expose a post-write hook today, so Semgrep tools are invoked when the agent calls them through MCP.

Uses Windsurf Cascade hooks.

1

Install the Semgrep CLI.

2

Create a hooks.json file at ~/.codeium/windsurf/hooks.json and paste the following configuration:

{
  "hooks": {
    "post_write_code": [
      {
        "command": "semgrep mcp -k post-tool-cli-scan -a windsurf",
        "show_output": true
      }
    ]
  }
}

3

Restart Windsurf to apply hook configuration.

The post_write_code event fires after Cascade writes or modifies any file.

Uses Kiro MCP. Kiro uses your locally installed Semgrep CLI to run Semgrep on your machine, so install the Semgrep CLI first. Clicking the box below opens Kiro directly so you can add the server; it will not open a new browser tab.Alternatively, add this file to your .kiro/settings/mcp.json:

{
  "mcpServers": {
    "semgrep": {
      "command": "semgrep",
      "args": ["mcp"],
      "env": {
        "SEMGREP_APP_TOKEN": "${SEMGREP_TOKEN}"
      }
    }
  }
}

Uses your IDE’s MCP (or hook) integration. Install the Semgrep CLI, then add the Semgrep MCP Server to your IDE. Semgrep provides sample configuration information that you can use as a starting point. Refer to your IDE’s documentation for specific details on where to add the MCP server configuration.If your IDE supports a post-write or post-tool hook, point it at semgrep mcp -k post-tool-cli-scan -a <ide-name> to scan generated code automatically. The Windsurf tab above shows this pattern.

​

What rules does Semgrep Guardian scan with?

• Claude Code remote server (default): scans with the default Guardian ruleset. This is not currently configurable. If you require custom rules, see Semgrep’s #mcp Slack community for assistance.
• Claude Code local and all other IDE integrations: scans with the rules enabled for your Semgrep organization through your Policies.

​

Install the Semgrep CLI

# preferred: install using pipx (https://pipx.pypa.io/stable/how-to/install-pipx/)
pipx install semgrep

# preferred: install using uv (https://docs.astral.sh/uv/)
uv tool install semgrep

# best-effort (macOS): install using Homebrew (maintained on a best-effort basis; often lags behind the latest release)
brew install semgrep

semgrep --version

semgrep login && semgrep install-semgrep-pro

​

Additional resources

• Enterprise deployment for authentication, OAuth credentials, and organization-wide rollout
• Semgrep’s #mcp Slack community
• The Semgrep MCP server repo on GitHub