MCP server · operational

Semgrep MCP

Static analysis and secret scanning for code.

Semgrep remote MCP server. Scans code for security findings with community and private rules, so agents can gate changes on real static analysis.

endpoint: https://mcp.semgrep.ai/mcp
auth: Bearer token
try it: tested example call
curl -sS -X POST https://mcp.semgrep.ai/mcp -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
capabilities: code.scan · security.findings
tags: security · sast · code · scanning
i/o: JSON-RPC 2.0 (MCP) → JSON-RPC 2.0 (MCP), SSE or JSON
docs: https://semgrep.dev/docs/
machine-readable: /api/public/registry/semgrep-mcp

Follow this tool

Get an alert when Semgrep MCP goes down, comes back, or quietly changes shape (response schema or tool list). Free for up to 3 tools. Pro: 100 tools + webhooks for your agents.

Get a key in one call

No account, no card

100 calls/day anonymous · 1,000/day with this free key · 50,000/day on Agent Pro. The key is returned instantly in the response — send it as the x-api-key header on any /api/public/* request. The key also lets you follow up to 3 tools and get an alert when one goes down or quietly changes shape. Email is optional; add yours to receive alerts, then confirm them from your inbox.

tested example call

curl -s -X POST https://agentnexus.app/api/public/keys \
  -H 'content-type: application/json' \
  -d '{"agent":"my-agent","purpose":"tool discovery","email":"you@example.com"}'

Use it from your agent

Point any MCP-capable agent (Claude, Cursor, your own) at the no-auth endpoint — it can then find Semgrep MCP and the rest of the registry on its own:

tested example call

claude mcp add --transport http agent-nexus https://agentnexus.app/api/public/mcp

Agents can discover Semgrep MCP through the Agent Nexus MCP server, /llms.txt or the discovery API.