# Semgrep MCP for AI Agents AI Agent Connect > Semgrep MCP connects your AI agent to the Semgrep AppSec platform. It lets you audit code security findings, update triage statuses, and deploy custom semantic rules to your repositories. Instead of switching between your IDE and the dashboard, you can manage vulnerabilities directly through your AI client. ## Overview - **Category:** fort-knox - **Price:** Free - **Endpoint:** https://edge.vinkius.com/vk_preview_419UaVAC33VwJmeeVBLCqRf2d8eEEPrGrsnPeNVU/ai-agent-connect - **Tags:** sast, sca, code-security, vulnerability-management, static-analysis, devsecops, compliance-auditing, automated-triage ## Description This Connector connects the AppSec platform directly to your AI agent to speed up code security triage. Instead of forcing developers to jump between their IDE and a separate dashboard, you can have your AI pull findings, analyze the vulnerable syntax, and close false positives instantly. You can request the AI to look at a new bad coding pattern and command it to write and deploy a matching custom semantic rule to your organization. It also maps out all repositories running scans and checks their security health scores in milliseconds. You can fetch granular flaw definitions, including exact snippets, CVE links, and the specific lines causing the trigger. It handles the heavy lifting of auditing, triage, and compliance reporting so you can stay in your flow. This is one of the many ways the Vinkius marketplace helps bridge the gap between complex security tools and daily development. It turns a manual research project into a conversational task where you just need to give the order and see the results. You can check your compliance metrics and pipeline fix rates natively and pipe them directly into an executive summary report via chat. This is a massive shift from the old way of manual data gathering, where you had to export CSVs and build your own charts. Now, the data comes to you exactly when you need it. ## Tools ### create_rule This tool lets you create a customized security rule within the platform. It helps you forbid project-specific bad patterns across your enterprise repositories. ### delete_rule This tool lets you remove a custom security rule from your deployment. Use it to clean up rules that are no longer relevant to your codebase. ### list_deployments This tool lets you list all organizational deployments. It helps you define the scope for rules, projects, and findings. ### list_findings This tool lets you fetch global static analysis security findings for a deployment. It provides snippet details and severity levels. ### get_finding_details This tool lets you get atomic details for a specific flaw. It explains the malicious code block and links to CVE data. ### get_project This tool lets you search for a precise project by repository name. It helps you find security status for specific codebases. ### get_metrics This tool lets you get AppSec metrics and compliance stats. Use it to render executive security dashboards and reports. ### list_rules This tool lets you list all Semgrep semantic rules deployed globally. It shows the YAML definitions for your security patterns. ### list_projects This tool lets you list all repositories monitored in a deployment. It helps you map out your security coverage. ### update_finding_status This tool lets you mark a finding state as fixed, false positive, or mitigated. It cleans up your developer experience. ## Prompt Examples **Prompt:** ``` What's blocking my PR on the cloud-infra repo? ``` **Response:** ``` I've checked the findings for `cloud-infra`. There is 1 blocker: * **Issue:** Exposed hardcoded AWS Secret Access Key * **Location:** `auth.py:L45` * **Severity:** Critical Would you like me to generate a fix for this line or mark it as a false positive? ``` **Prompt:** ``` Mark the last 5 findings as false positives. ``` **Response:** ``` I've identified the 5 most recent findings in your deployment. I am now marking them as `false_positive` in the Semgrep platform. **Summary:** - Status updated for 5 issues. - These will no longer appear in your active triage queue. ``` **Prompt:** ``` Give me a summary of our fix rate for last month. ``` **Response:** ``` I've pulled the latest AppSec metrics for your organization: | Metric | Value | | :--- | :--- | | **Overall Fix Rate** | 83% | | **Median Time-to-Resolve** | 3.4 Days | | **Active Blockers** | 12 | Your fix rate shows strong engagement from the development team before merges. ``` ## Capabilities ### Update vulnerability statuses This Connector lets you mark findings as fixed, false positives, or mitigated to clear your security queue. ### Deploy custom security rules This Connector lets you create and push new semantic patterns to block bad code across your repositories. ### Fetch security metrics This Connector lets you pull compliance stats and fix rates to build executive security dashboards. ### Audit specific code flaws This Connector lets you get the exact malicious code block and CVE data for a specific vulnerability. ### Map repository security This Connector lets you list all projects and their health scores to see your security coverage. ## Use Cases ### Triage a blocker A developer asks the agent to find the specific finding blocking a PR. The agent uses list_findings and get_finding_details to show the exact line of code and a fix. ### Rule deployment A security lead tells the agent to create a rule that forbids hardcoded AWS keys across all repos. The agent uses create_rule to push the new pattern globally. ### Compliance reporting A DevOps lead asks for a 30-day fix rate report. The agent pulls the data from get_metrics and summarizes it into an executive summary. ### False positive cleanup A dev asks the agent to mark 50 specific findings as false positives. The agent identifies them and uses update_finding_status to clear the queue. ## Benefits - Stop context switching by managing Semgrep findings and rules directly within your AI client. - Speed up triage by using update_finding_status to clear out false positives in seconds. - Enforce new security standards across the company by using create_rule to deploy custom patterns. - Get instant answers on CVE data and malicious code blocks using get_finding_details. - Build executive reports faster by pulling organization-wide stats with get_metrics. - Map your security coverage across all repositories using list_projects and list_deployments. ## How It Works The bottom line is you get to manage your entire AppSec lifecycle through a chat interface instead of a complex dashboard. 1. Add the Semgrep MCP to your AI client and provide your API token from your dashboard settings. 2. Describe the security task you want to perform, like triaging a specific bug or checking a repo's health. 3. The AI interacts with the platform to fetch data, perform actions, and report back to you. ## Frequently Asked Questions **Can the Semgrep MCP help me clear out false positives faster?** Yes. You can ask your agent to identify and mark specific findings as false positives. This clears them from your active queue so you can focus on real threats. **How do I use the Semgrep MCP to manage security rules?** You can tell your agent to create new custom rules for bad coding patterns or delete old ones. The agent handles the deployment across your organization for you. **Can my AI agent see the exact lines of code for a vulnerability?** Yes, the Connector pulls the specific malicious code block and the exact line numbers from the platform so your agent can explain the issue to you clearly. **Does the Semgrep MCP work for both SAST and SCA?** It supports both static analysis security testing and software composition analysis. You can retrieve CVE links for dependencies and scan results for your own code. **Can I use the Semgrep MCP to generate security reports?** Yes. You can ask your agent to pull compliance metrics and fix rates. It can then summarize that data into an executive report directly in your chat. **How does the Semgrep MCP help with CI/CD blockers?** The agent can fetch findings that are currently blocking your pipeline, explain what the vulnerability means, and even draft the semantic fix to help you pass the scan. **Can the AI resolve or close findings in Semgrep natively?** Yes. This server supports mutable actions. By invoking `update_finding_status`, your AI agent can shift a specific semantic flaw to 'mitigated', 'fixed', 'ignored', or 'false_positive' updating the registry in real-time. **How can I deploy a new custom SAST rule via chat?** Simply ask the LLM: 'Draft a semantic grep rule to ban hardcoded API keys in Python and deploy it'. The agent will natively format the JSON structure required and call `create_rule`, sending it directly to all repositories. **Do I need to supply a 'Deployment Slug' for every request?** Most API queries require the deployment context. To ensure smooth interactions, just tell the agent your organization slug once (or let it query `list_deployments` to fetch the default one). The agent will remember it for the rest of the conversation loop.