An astronaut overseeing a futuristic data hub
Download PDFMarkdown Version

Connect Semgrep to ChatGPT, Claude and Gemini

Set it up once and it works in ChatGPT, Claude, Cursor, and any other client you love. It all runs safely in the background, so you can relax and focus on what really matters. Triage vulnerabilities and manage security rules without leaving your IDE.

Ask AI about this Connector

Developed, maintained, and hosted by Vinkius.

MCP VERIFIED · PRODUCTION READY · VINKIUS GUARANTEED

Waiting for input…

Works with modern AI clients that support MCP, including ChatGPT, Claude, Cursor, and more.

ChatGPTClaudeCursorPerplexityGeminiMicrosoft CopilotRaycastMeta AI

Your AI does the work. We keep it safe and sound.

No other AI tool gives you this. Your workflow runs in the client you already love, your account stays protected, and you decide what the agent can and cannot do. It is the whole reason to make the switch.

Each Connector lives inside our infrastructure, the same place where your workflow runs. The three things below are already part of it, working quietly in the background so you never have to think about them. Nothing to add, nothing to set up, nothing to worry about.

A futuristic MCP client docking bay
V8 Isolate01

Each Connector runs inside its own sealed environment.

Each Connector runs inside its own sealed V8 runtime — no access to your files, your system, or other servers. A Connector never sees past its own request.

Kill Switch02

One switch stops every agent. Instantly.

One action deactivates every Connector, revokes every token, and ends every session at once. AI Governance keeps the record.

FinOps per User03

Spending limits that pause instead of surprise.

Every user keeps their own connections and credentials, isolated from everyone else. Anything that would cross your spending limit is held for your approval, not billed.

Three controls, built into the layer your AI connects through.

Curated set · 10 capabilities

We ship only the actions that matter.

Capability set01 / 03

01-04

4 capabilities in this set.

Part of 10 available through Semgrep.

  1. 01

    Create rule

    Creates a custom Semgrep security rule within your platform. Use this to forbid specific bad coding patterns across all enterprise repositories.

  2. 02

    Delete rule

    Removes a custom Semgrep security rule from your deployment. This is useful for cleaning up obsolete or inaccurate security checks.

  3. 03

    Get finding details

    Retrieves granular details for a specific security flaw. It provides the malicious code block, CVE links, and suggests semantic fixes.

  4. 04

    Get metrics

    Fetches AppSec metrics and compliance statistics. Use this to pull data for executive security dashboards.

Capability set02 / 03

05-07

3 capabilities in this set.

Part of 10 available through Semgrep.

  1. 05

    Get project

    Searches for a specific Semgrep project using its exact repository name.

  2. 06

    List deployments

    Lists all Semgrep organizational deployments. This provides the deployment slug needed for other capability operations.

  3. 07

    List findings

    Fetches static analysis security findings for a deployment. It returns snippet details, file lines, and severity levels.

Capability set03 / 03

08-10

3 capabilities in this set.

Part of 10 available through Semgrep.

  1. 08

    List projects

    Lists all Semgrep projects and repositories currently being monitored in a deployment.

  2. 09

    List rules

    Lists the YAML-based semantic rules currently deployed globally in your environment.

  3. 10

    Update finding status

    Updates the state of a Semgrep finding. You can mark issues as fixed, ignored, mitigated, or false positive.

Real work

What teams actually run

01

Unblocking Pull Requests

A developer asks the agent to explain a specific finding blocking a PR and then drafts the fix.

02

Rapid Rule Updates

A security engineer identifies a new pattern and tells the agent to deploy a rule to block it.

03

Security Auditing

An engineer uses the agent to pull a list of all unmitigated critical findings in a specific repo.

04

Executive Reporting

A DevOps lead asks the agent for the recent fix rate to include in a security status report.

Automate a task

Put Semgrep to work on one thing.

Step-by-step automations your AI runs through this Connector: the workflow, the prompts to start with, and the exact capabilities behind each move.

One connector, every AI

Semgrep works with the most popular AI clients.

These are the most popular clients, each with a step-by-step guide: one link, set up once, with governance and visibility built in. And because everything runs on the MCP standard, the same connection also works in any other compatible client — nothing to rebuild.

ClaudeClaudeChatGPTChatGPTGeminiGeminiPerplexityPerplexityGrokGrokMicrosoft CopilotMicrosoft CopilotCursorCursorVS CodeVS CodeWindsurfWindsurfJetBrainsJetBrainsClineClineLangChainLangChainVercel AI SDKVercel AI SDKLovableLovableZ.aiZ.aiRaycastRaycastQwen CodeQwen CodeKimi CodeKimi CodeLe ChatLe Chat

Building your own app? The connector is yours to use.

You don't need a client to put Semgrep to work: the same hosted connection plugs into your own applications and agent code, with the same governance on every request. Build with it, chat with it — one connection for both.

Observed, not estimated

942ms average. Fast in production.

Semgrep is checked daily against the live service.

Daily averagePeak 1388ms
Oct 3Today
Fastest day
744ms
Slowest day
1388ms
14-day trend
Slowing+6%

Connect your client

One URL. Every client.

Activate the Connector, copy your link, and paste it into the client you already use. 10 capabilities arrive ready to run.

Preview access · not provider authentication

The vk_preview_* token belongs to Vinkius preview infrastructure. It lets Claude discover and display the capabilities of Semgrep, so you can see the experience inside your AI.

It does not authenticate your account with Semgrep. Actions requiring credentials or live account data may not run until you activate the Connector and authorize the service.

Semgrep Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_419UaVAC33VwJmeeVBLCqRf2d8eEEPrGrsnPeNVU/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Semgrep capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "semgrep-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_419UaVAC33VwJmeeVBLCqRf2d8eEEPrGrsnPeNVU/mcp"
    }
  }
}
  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Step-by-step instructions for each client are in the guide. How to connect

Guided setup for Claude? Set up Semgrep in Claude and other AIs

See all the AI clients this connector works with ↑

Who it's for

Built for the work Semgrep owners hand off.

This MCP is built for teams that need to bridge the gap between security scanning and active development.

  • 01

    Security Engineers

    They use the agent to manage and delete rules across deployments without using the dashboard.

  • 02

    DevOps

    They pull compliance metrics and pipeline fix rates directly into chat for reporting.

  • 03

    Software Developers

    They use the agent to fetch finding IDs and draft semantic fixes to unblock PRs.

FAQ

Questions Semgrep owners ask.

  • 01

    How do I connect my Semgrep account?

    You need to provide a standard API Token from your Semgrep Dashboard settings after enabling the MCP in Vinkius.

  • 02

    Which AI clients can use this MCP?

    You can use this with any MCP-compatible client, including Claude, Cursor, Windsurf, and VS Code.

  • 03

    Can the AI actually fix my code?

    The agent can fetch the exact code causing a vulnerability and draft the semantic fix, which you can then review and apply.

  • 04

    Can I use this to manage my security rules?

    Yes, you can use the agent to list, create, or delete custom semantic rules across your deployments.

  • 05

    What happens when I mark a finding as a false positive?

    The agent uses the update_finding_status capability to tell Semgrep the issue is a false positive, which prevents it from flagging that specific line again.

  • 06

    Can the AI resolve or close findings in Semgrep natively?

    Yes. This server supports mutable actions. By invoking update_finding_status, your AI agent can shift a specific semantic flaw to 'mitigated', 'fixed', 'ignored', or 'false_positive' updating the registry in real-time.

  • 07

    How can I deploy a new custom SAST rule via chat?

    Simply ask the LLM: 'Draft a semantic grep rule to ban hardcoded API keys in Python and deploy it'. The agent will natively format the JSON structure required and call create_rule, sending it directly to all repositories.

  • 08

    Do I need to supply a 'Deployment Slug' for every request?

    Most API queries require the deployment context. To ensure smooth interactions, just tell the agent your organization slug once (or let it query list_deployments to fetch the default one). The agent will remember it for the rest of the conversation loop.

Explore

More in Fort Knox

Suggestions

Connect Semgrep to Claude, Cursor, ChatGPT & more