Vinkius

Semgrep MCP. Govern code security and compliance directly from chat.

Semgrep lets your AI client read and write directly to Semgrep's security platform. It gives you the ability to audit code vulnerabilities, analyze specific flaws, mark findings as fixed or false positives, and deploy custom semantic rules without leaving your chat window.

Semgrep MCP is compatible with Claude Claude
Semgrep MCP is compatible with ChatGPT ChatGPT
Semgrep MCP is compatible with Cursor Cursor
Semgrep MCP is compatible with Gemini Gemini
Semgrep MCP is compatible with Windsurf Windsurf
Semgrep MCP is compatible with VS Code VS Code
Semgrep MCP is compatible with JetBrains JetBrains
Semgrep MCP is compatible with Vercel Vercel
See Vinkius in Action

Give Claude and any AI agent real-world access

Update finding status

Mark specific security findings as fixed, ignored, false positives, or mitigated directly from your chat.

Deploy custom rules

Create and deploy new semantic security rules to forbid newly discovered bad coding patterns across the entire organization.

Delete existing rules

Remove obsolete or unnecessary custom security rules from your active deployment set.

Fetch all security findings

Retrieve a global list of static analysis vulnerabilities, including file lines and severity levels, for any given project deployment.

Get flaw details

Analyze an individual vulnerability to see the exact malicious code block, suggested fixes, and associated CVE data.

List monitored projects

See a list of all repositories and projects currently being scanned by Semgrep within your organization's deployment scope.

Waiting for input…

AI Agent
Semgrep

What AI agents can do with Semgrep with 10 Tools

These tools allow you to audit security issues, view compliance metrics, create new enforcement rules, and mark vulnerability findings directly through your AI agent.

Make your AI actually useful.

Add this MCP to Claude, Cursor, or Windsurf and your AI stops guessing. It gets real tools to look things up, take action, and handle the stuff you keep doing by hand.

Start using Semgrep MCP

Create Rule

Deploys a customized security rule that forbids specific bad coding patterns across your enterprise repositories.

Delete Rule

Removes an existing custom Semgrep security rule from the deployment scope entirely.

List Deployments

Lists all defined organizational deployments, providing necessary slugs to define...

List Findings

Fetches a comprehensive list of global static analysis vulnerabilities within a...

Get Finding Details

Retrieves deep, atomic information on a specific flaw, including malicious code...

Get Project

Searches for an exact Semgrep project using its precise repository name to scope security queries.

List Rules

Displays all current semantic rules that are actively deployed globally across your codebase.

Get Metrics

Gathers AppSec metrics and compliance statistics, ideal for generating high-level...

List Projects

Lists all monitored repositories or projects within a defined deployment scope over...

Update Finding Status

Marks the state of a specific vulnerability finding, changing it to 'fixed', 'false...

Security and governance baked right in.

Pick your AI client below to get set up. Just create a Vinkius account, subscribe, and you're instantly up and running. We handle the entire backend infrastructure, delivering out-of-the-box support for HTTPS Streamable, SSE, and OAuth2—zero messy routing required.

Semgrep MCP is compatible with Claude

Claude AI

1

Open Claude Settings

Go to claude.ai, click your profile icon, then navigate to Customize → Connectors.

2

Add Custom Connector

Click the "+" button and select Add custom connector. Paste your Vinkius endpoint URL:

https://edge.vinkius.com/[YOUR_TOKEN_HERE]/mcp

Replace [YOUR_TOKEN_HERE] with your token from cloud.vinkius.com. For OAuth-protected servers, expand Advanced settings to add credentials.

3

Start a conversation

Open a new chat. The Semgrep integration is available immediately — no restart needed.

Choose How to Get Started

Build a custom MCP for your own tools, or connect a ready-made integration from our catalog.

Build Your Own

Turn any API into an MCP. Import a spec, define Agent Skills, or deploy with MCPFusion.

  • Import from OpenAPI, Swagger, or YAML specs
  • Create Agent Skills with progressive disclosure
  • Deploy to edge with MCPFusion framework
  • Built in DLP, auth, and compliance on each call
  • Real time usage dashboard and cost metering
  • Publish to catalog or keep private
Start building

Make Your AI Do More

Start with Semgrep, then connect any of our 5,200+ other servers whenever your AI needs more. One click, no limits.

  • Use this MCP plus 5,200+ others, all in one place
  • Add new capabilities to your AI anytime you want
  • Connections are secured and governed automatically
  • Track usage and costs across all your servers
  • Works with Claude, ChatGPT, Cursor, and more
  • New servers added to the catalog weekly
Semgrep MCP server cover

Independent Platform Disclaimer: Vinkius is an independent platform and is not affiliated with, endorsed by, sponsored by, verified by, or otherwise authorized by Semgrep. All third-party trademarks, logos, and brand names are the property of their respective owners. Their use on this website is strictly for informational purposes to identify service compatibility and interoperability.

VINKIUS CLOUD

Cloud Hosted

Managed infra

V8 Isolated

Sandboxed per request

Zero-Trust Proxy

No stored credentials

DLP Enforced

Policy on each call

GDPR Compliant

EU data residency

Token Compression

~60% cost reduction

Your data is protected. See how we built it.

Dealing with Security Findings Feels Like Juggling Tabs

Right now, dealing with security vulnerabilities means context switching: you open your IDE to write code. When the build fails, you jump to the Semgrep dashboard to read findings. Then, if a team member asks about it, you copy data into Jira or Slack. You spend more time managing the workflow than actually fixing the bug.

With this MCP connected via Vinkius, that process collapses. Your AI agent pulls the raw finding details directly from Semgrep and gives you an analysis right in your chat. You can then use `update_finding_status` to mark it as fixed without ever leaving your conversation.

Deploying Rules with Semgrep MCP

Manually deploying a new security rule requires navigating the platform, writing YAML, testing against a staging environment, and then finally pushing it to production. It’s slow and prone to human error.

Now, you can have your agent draft or adjust the semantic rule definition using `create_rule`. You get immediate feedback and deployment control from chat. The enforcement is instant.

What Semgrep MCP does for your AI

Managing code security shouldn't mean abandoning your IDE for a web dashboard. This MCP connects your AI agent directly to Semgrep’s AppSec platform, letting you audit security findings right where you work. Instead of copying vulnerability details into a ticket and waiting for a human to triage it, your agent can pull the latest CI scan results, analyze the bad code snippet, and instantly update its status—whether that means marking it as fixed or confirming it’s a false positive.

You can also use it to enforce custom security standards by having your AI client write and deploy new semantic rules across all your repositories. By connecting this MCP via Vinkius, you give your agent access to the full catalog of code quality tools, accelerating compliance auditing instantly.

Built · Hosted · Managed by Vinkius Semgrep MCP - Code Security & Compliance Auditing
Server ID 019d7605-b00e-71f5-ab3f-aa8a74304cf7
Vinkius Inspector
Compliance Grade A+
Score 100/100
Vinkius Inspector Badge — Score 100/100

Frequently asked questions about Semgrep MCP

How do I use Semgrep MCP to check my overall security health? +

You run the list_findings tool, specifying the target deployment slug. This retrieves a comprehensive report of all vulnerabilities found across the code base in one go.

Can I update finding status using Semgrep MCP? +

Yes, you use the update_finding_status tool. You just need to provide the specific finding ID and the desired status (e.g., 'false_positive').

What is the best way to review compliance data with Semgrep MCP? +

To get high-level stats, use the get_metrics tool. This returns AppSec performance metrics and overall compliance statistics for executive reporting.

Does Semgrep MCP help me write new security rules? +

Yes, you can use create_rule to deploy a custom semantic rule. You define the pattern once, and it enforces that rule across all your repositories.

Which tool do I use to find out which projects Semgrep is monitoring? +

Use list_projects. This tool reads the monitored repository list for a specific deployment scope, giving you visibility into your entire security footprint.