MCP server · operational

Semgrep MCP

Static analysis and secret scanning for code.

Semgrep remote MCP server. Scans code for security findings with community and private rules, so agents can gate changes on real static analysis.

endpoint: https://mcp.semgrep.ai/mcp
auth: Bearer token
try it: tested example call
curl -sS -X POST https://mcp.semgrep.ai/mcp -H "Content-Type: application/json" -H "Accept: application/json, text/event-stream" -d '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
capabilities: code.scan · security.findings
tags: security · sast · code · scanning
i/o: JSON-RPC 2.0 (MCP) → JSON-RPC 2.0 (MCP), SSE or JSON
docs: https://semgrep.dev/docs/
machine-readable: /api/public/registry/semgrep-mcp

Agents can discover Semgrep MCP through the Agent Nexus MCP server, /llms.txt or the discovery API.