• READ
  • INSPECT
  • UPDATE
  • HUMAN

How to triage security findings with your AI

Connect Semgrep to your AI client to manage vulnerabilities through chat. You can pull scan results and update statuses without switching tabs.

Ask AI about this page

Short answer

How can I triage security findings with my AI?

Your AI pulls live Semgrep findings and lets you inspect the specific code context for each vulnerability. You can then tell your agent to update the status of any finding to keep your dashboard current. Here is how it works.

Triage outcomes.

Where your findings land.

The AI moves data between your chat and Semgrep to keep your security posture updated.

READ

Live scan data

The AI pulls your current Semgrep findings into the chat. You get a real-time view of what's broken in your code.

INSPECT

Deep vulnerability context

Your agent looks up the exact details and location of a specific finding. This helps you decide if a hit is a real threat or a false positive.

UPDATE

Status management

Tell your AI to change the status of a finding. It syncs that change back to Semgrep immediately.

HUMAN

Final decision making

The AI handles the data fetching and status updates, but you decide which vulnerabilities actually matter.

The workflow

What your AI does when findings arrive.

The AI acts as the bridge between your security scans and your decision making.

  1. Fetch scan results

    The AI pulls a list of all current security issues from your Semgrep account.

    list_findings

  2. Analyze specific hits

    Once you pick a finding, the AI pulls the specific metadata and code context.

    get_finding_details

  3. Update the dashboard

    After you review a finding, the AI pushes the new status back to the platform.

    update_finding_status

  4. Verify the fix

    You can ask the AI to check the latest findings list to ensure a status change was successful.

    list_findings

Try it

Copy these to start.

Use these prompts to begin triaging your security issues.

Starting points

These are just ways to kick off a conversation. Swap out the repo names or finding IDs for your own.

Semgrep Connector

You're all set. Choose your MCP client and follow the setup instructions.

Connector linkhttps://edge.vinkius.com/vk_preview_419UaVAC33VwJmeeVBLCqRf2d8eEEPrGrsnPeNVU/mcp

Claude Desktop

Follow the steps below to connect in seconds.

  1. 1In Claude Desktop, open Settings → Connectors.
  2. 2Click “Add custom connector” and paste the connector link above as the remote MCP server URL.
  3. 3Click Add and start a new chat — Semgrep capabilities are ready to use.
Configuration · claude_desktop_config.jsonCopy
{
  "mcpServers": {
    "semgrep-mcp": {
      "url": "https://edge.vinkius.com/vk_preview_419UaVAC33VwJmeeVBLCqRf2d8eEEPrGrsnPeNVU/mcp"
    }
  }
}
Copy into chat04

  • List all the current Semgrep findings for my main repository.

  • Get the details for finding ID 12345 and tell me if it looks like a real risk.

  • Mark finding ID 67890 as 'fixed' in Semgrep.

  • Show me all the high-severity findings currently active in my Semgrep account.

  • Claude
  • ChatGPT
  • Cursor
  • VS Code
  • Windsurf
  • Claude Code
  • JetBrains
  • Cline

Start here

Connect Semgrep once, then ask.

Just link your Semgrep account to Vinkius. Your credentials stay encrypted and you can start chatting with your security data immediately.

Connect Semgrep to your AI

FAQ

How this task behaves.

  • 01

    Can the AI fix the code for me?

    No. The AI can pull the code context and update the status of a finding, but it cannot write or commit code changes to your repository.

  • 02

    Will the AI delete my findings?

    No. The tools only allow the AI to update the status of a finding. It cannot delete findings from your Semgrep dashboard.

  • 03

    Can I use this with any AI client?

    Yes, as long as the client supports the Model Context Protocol (MCP).

  • 04

    Does the AI see all my code?

    The AI only sees the specific finding details and code snippets that it requests through the Semgrep tools to answer your questions.

  • 05

    Can the AI create new scan rules?

    No. This MCP is designed for triaging existing findings, not for managing or creating Semgrep rules.

  • More questions about Semgrep? See everything the Semgrep Connector can do

Connect Semgrep to Claude, Cursor, ChatGPT & more