Download PDFMarkdown Version
ClaudeChatGPTPerplexityGeminiMicrosoft CopilotRaycastMeta AIGrokZ.aiQwenKimi
DeepSeekMistralCursorVS CodeWindsurfJetBrainsClineLovableVercel AI SDKLangChain

Use Semgrep with your AI.

Connect your account once and let the AI you already use work with it, without building another integration. Equip your AI agent with read/write access to Semgrep's SAST platform to audit code security findings, update triage statuses, and enforce custom semantic rules

Included with plan

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

ChatGPTClaudeCursorPerplexityGeminiMicrosoft CopilotRaycastMeta AI

Complete set · 10 capabilities

The complete Semgrep capability set.

These are the exact actions your AI can choose when you ask it to work with Semgrep.

Capability set01 / 03

01-04

4 capabilities in this set.

Part of 10 available through Semgrep.

  1. 01

    Create rule

    Allows developers to forbid project-specific bad patterns securely and continuously across the enterprise repositories. Create a customized Semgrep security rule within the platform

  2. 02

    Delete rule

    Delete a custom Semgrep security rule from the deployment

  3. 03

    Get finding details

    Explains the exact malicious code block, suggests semantic fixes, states whether it is blocking PRs in CI, and links to CVE data (if an SCA supply chain defect). Get atomic details for a specific Semgrep flaw

  4. 04

    Get metrics

    Typically consumed to render executive security dashboards. Get AppSec metrics and compliance stats for Semgrep

Capability set02 / 03

05-07

3 capabilities in this set.

Part of 10 available through Semgrep.

  1. 05

    Get project

    Search for a precise Semgrep project by exact repository name

  2. 06

    List deployments

    The primary key is the deployment slug identifier. Almost all subsequent API operations targeting rules, projects, or findings will require this deployment slug to define the scope. List Semgrep organizational deployments

  3. 07

    List findings

    Findings provide snippet details, file line numbers, severity, and rule types. Fetch globalThis static analysis security findings for a deployment

Capability set03 / 03

08-10

3 capabilities in this set.

Part of 10 available through Semgrep.

  1. 08

    List projects

    Projects maintain a link between developers and static security scan outputs over time. List Semgrep projects (repositories) monitored in a deployment

  2. 09

    List rules

    The rules are structured YAML definitions that search for semantic anti-patterns in codebases (e.g., unparameterized SQL queries, hardcoded AWS keys). List Semgrep semantic rules deployed globally

  3. 10

    Update finding status

    Valid states generally include active, fixed, false_positive, ignored, mitigated. Resolving findings through this API cleans up the developer experience when managing compliance queues. Mark a Semgrep finding state (e.g., fixed, false positive)

Observed, not estimated

898ms average. Fast in production.

Semgrep is checked daily against the live service.

Daily averagePeak 1121ms
Aug 20Today
Fastest day
653ms
Slowest day
1121ms
14-day trend
Slowing+53%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 10 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of Semgrep, so you can see the experience inside your AI.

It does not authenticate your account with Semgrep. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

Semgrep Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_419UaVAC33VwJmeeVBLCqRf2d8eEEPrGrsnPeNVU/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Semgrep capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "semgrep-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_419UaVAC33VwJmeeVBLCqRf2d8eEEPrGrsnPeNVU/mcp"
    }
  }
}
  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Step-by-step instructions for each client are in the guide. How to connect

FAQ

Questions Semgrep owners ask.

  • 01

    Can the AI resolve or close findings in Semgrep natively?

    Yes. This server supports mutable actions. By invoking update_finding_status, your AI agent can shift a specific semantic flaw to 'mitigated', 'fixed', 'ignored', or 'false_positive' updating the registry in real-time.

  • 02

    How can I deploy a new custom SAST rule via chat?

    Simply ask the LLM: 'Draft a semantic grep rule to ban hardcoded API keys in Python and deploy it'. The agent will natively format the JSON structure required and call create_rule, sending it directly to all repositories.

  • 03

    Do I need to supply a 'Deployment Slug' for every request?

    Most API queries require the deployment context. To ensure smooth interactions, just tell the agent your organization slug once (or let it query list_deployments to fetch the default one). The agent will remember it for the rest of the conversation loop.

Explore

More in Fort Knox

Suggestions