Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
-
No community reviews yet
Ran this server? Tell others if you would trust it in production. Reviews are separate from our grade.
Write a reviewWhy it got a B
This grade describes the server built into the Semgrep CLI (cli/src/semgrep/mcp in semgrep/semgrep, LGPL-2.1), not the old standalone semgrep/mcp repo or the semgrep-mcp PyPI package: that repo is archived (last commit Oct 2025) and says it moved. Claude's Semgrep plugin (semgrep/guardian) is different again. It runs a prebuilt Guardian binary that downloads from semgrep.dev, and its hooks send each file the agent writes to scanner.semgrep.ai, so the plugin isn't covered by this grade. The CLI server runs scans on your machine over stdio, or over HTTP bound to 127.0.0.1 by default, and reads only the project folder unless you switch that check off. Local scans need no login; a Semgrep token (or OAuth over HTTP) is only for platform findings, so auth is optional and earns 18 of 30. Biggest deduction: the transport score is 14 of 20, not full marks, because scans pull rules from semgrep.dev and send usage metrics unless you set SEMGREP_SEND_METRICS=off, and an "auto" rule config refuses to run with metrics off. Maintenance is strong (release v1.185.0 on 2026-11-10) and there are no advisories on record. Keep tool approval on and use a narrowly scoped token if you add one.
How to connect
semgrep mcp (needs the Semgrep CLI: brew install semgrep, or pip install semgrep)Is Semgrep MCP Server safe?
Is Semgrep MCP Server safe to use?
Semgrep MCP Server grades B (solid, with minor gaps). Login is optional, so check that it is turned on in your setup. It runs locally over stdio, so it acts with your machine's access.
Does Semgrep MCP Server have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does Semgrep MCP Server support authentication?
Optionally. It can run with a login, but it does not require one, so turn it on.
Alternatives in Developer Tools
- A Appwrite MCP ServerOfficial Appwrite server that exposes databases, users, functions, teams and storage as tools, hosted with OAuth or run locally with a project API key.
- A Atlassian Rovo MCP ServerOfficial hosted Atlassian server for Jira, Confluence, Jira Service Management, Compass, Bitbucket, Loom, Goals, Projects, and Teams, with OAuth 2.1 sign-in.
- A Buildkite MCP ServerOfficial Buildkite server for pipelines, builds, jobs, logs, annotations, and Test Engine data, hosted or local.
- A Dynatrace Remote MCP ServerDynatrace's hosted MCP server, running inside your Dynatrace SaaS environment, to run and explain DQL, look into problems, vulnerabilities and Kubernetes events, and forecast time series.
- A GitHub MCP ServerOfficial GitHub server for repos, issues, pull requests, Actions, and code security, hosted or local.
Embed this badge
[](https://trustedmcp.io/servers/semgrep-mcp)<a href="https://trustedmcp.io/servers/semgrep-mcp"><img src="https://trustedmcp.io/badge/semgrep-mcp.svg" alt="TrustedMCP grade B" height="80"></a>Community reviews
No published community reviews yet.
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.