• ACTIVE
  • AUDIT
  • REVIEW
  • CLEANUP

How to deploy custom security rules with your AI

Connect Semgrep to your AI client to turn security requirements into active scanning rules.

Ask AI about this page

Short answer

How can I use AI to deploy Semgrep rules?

You describe a code pattern to your agent, and it uses the Semgrep MCP to write and push a new rule to your environment. This keeps your security posture updated without manual YAML editing.

The results of your request.

Where your rules land.

The AI handles the rule syntax and deployment logic.

ACTIVE

Live rule sets

The AI pushes the new rule to your Semgrep deployment. Your scanners immediately start looking for the pattern you defined.

AUDIT

Rule inventory

The AI pulls a list of existing rules. This ensures the new rule doesn't conflict with your current configuration.

REVIEW

Human oversight

The AI shows you the rule logic first. You decide if the pattern is correct before it goes live.

CLEANUP

Rule removal

If a rule causes false positives, your AI can remove it from the deployment for you.

The workflow

What your AI does when a new pattern arrives.

The AI acts as the bridge between your security reasoning and the Semgrep engine.

  1. Check existing rules

    The AI pulls your current rule set to ensure the new pattern doesn't overlap with what you already have.

    list_rules

  2. Write the rule

    The AI generates the semantic rule syntax based on the vulnerability you described.

    create_rule

  3. Push to deployment

    The AI sends the new rule to your Semgrep instance so it can start blocking code.

    create_rule

  4. Remove old rules

    The AI deletes rules that are no longer needed or are causing issues.

    delete_rule

Try it

Copy these to start.

Use these prompts to trigger the Semgrep MCP.

Starting points

Replace the bracketed text with your specific rule names or code patterns.

Semgrep Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_419UaVAC33VwJmeeVBLCqRf2d8eEEPrGrsnPeNVU/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Semgrep capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "semgrep-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_419UaVAC33VwJmeeVBLCqRf2d8eEEPrGrsnPeNVU/mcp"
    }
  }
}
Copy into chat04

  • List all my current Semgrep rules so I can see what is active.

  • Create a new Semgrep rule to block any use of the insecure function [function_name] in my [repo_name] repository.

  • I need to remove the rule named [rule_id] from my Semgrep deployment.

  • Check my existing rules and then create a new one that catches similar patterns to [rule_id].

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Semgrep once, then ask.

One connection gives your AI access to your Semgrep rules. Your credentials stay encrypted on our side.

Connect Semgrep to your AI

FAQ

How this task behaves.

  • 01

    Can the AI run the actual code scans?

    No. The AI manages the rules that the scanner uses, but it does not trigger the scan execution itself.

  • 02

    Will the AI delete all my rules if I'm not careful?

    No. The AI only deletes specific rules that you explicitly instruct it to remove.

  • 03

    Does the AI need to see my source code?

    The AI writes rules based on the patterns you describe. It uses the tools to interact with the Semgrep API, not to read your entire codebase.

  • 04

    Can the AI fix the code vulnerabilities it finds?

    No. The AI can create rules to detect vulnerabilities, but it does not have the capability to rewrite your application code.

  • 05

    How does the AI know which rules already exist?

    It uses the list_rules tool to pull your current rule set before attempting to create anything new.

  • More questions about Semgrep? See everything the Semgrep Connector can do

Connect Semgrep to Claude, Cursor, ChatGPT & more