Skip to content
Vinkius

Semgrep Connector for AI agents.

10 live capabilities

Manage your code security and triage SAST findings directly from your AI client.

Live agent request Semgrep / Connector

Waiting for input…

AI Agent

Why people use Semgrep

Semgrep for Faster AppSec Triage and Vulnerability Management

With this Connector, that manual loop disappears. You can ask your agent to pull the latest findings, explain the malicious syntax, and update the status to fixed or false positive in a single step. You get the results you need without ever leaving your workspace.

  • Claude
  • ChatGPT
  • Gemini
  • Cursor
  • Visual Studio Code
  • Windsurf

What Vinkius changes

You get to manage your entire AppSec lifecycle through a chat interface instead of a complex dashboard.

Use it from Claude, ChatGPT, Cursor or another AI client you already have.

One account · 5,900+ Connectors

  1. Real-world use case 01

    Triage a blocker

    A developer asks the agent to find the specific finding blocking a PR.

  2. Real-world use case 02

    Rule deployment

    A security lead tells the agent to create a rule that forbids hardcoded AWS keys across all repos.

  3. Real-world use case 03

    Compliance reporting

    A DevOps lead asks for a 30-day fix rate report.

Complete set · 10capabilities

The complete Semgrep capability set.

These are the exact actions your AI can choose when you ask it to work with Semgrep.

Capability set01 / 03

01—04

4 capabilities in this set.

Part of 10 available through Semgrep.

  1. 01 Capability

    Create rule

    This capability lets you create a customized security rule within the platform. It helps you forbid project-specific bad patterns across your enterprise repositories.

  2. 02 Capability

    Delete rule

    This capability lets you remove a custom security rule from your deployment. Use it to clean up rules that are no longer relevant to your codebase.

  3. 03 Capability

    List deployments

    This capability lets you list all organizational deployments. It helps you define the scope for rules, projects, and findings.

  4. 04 Capability

    List findings

    This capability lets you fetch global static analysis security findings for a deployment. It provides snippet details and severity levels.

Capability set02 / 03

05—07

3 capabilities in this set.

Part of 10 available through Semgrep.

  1. 05 Capability

    Get finding details

    This capability lets you get atomic details for a specific flaw. It explains the malicious code block and links to CVE data.

  2. 06 Capability

    Get project

    This capability lets you search for a precise project by repository name. It helps you find security status for specific codebases.

  3. 07 Capability

    Get metrics

    This capability lets you get AppSec metrics and compliance stats. Use it to render executive security dashboards and reports.

Capability set03 / 03

08—10

3 capabilities in this set.

Part of 10 available through Semgrep.

  1. 08 Capability

    List rules

    This capability lets you list all Semgrep semantic rules deployed globally. It shows the YAML definitions for your security patterns.

  2. 09 Capability

    List projects

    This capability lets you list all repositories monitored in a deployment. It helps you map out your security coverage.

  3. 10 Capability

    Update finding status

    This capability lets you mark a finding state as fixed, false positive, or mitigated. It cleans up your developer experience.

Set up in minutes

One URL. Then ask Semgrep to work.

Claude and ChatGPT only need the Connector URL. Copy it once, add it in settings, and use Semgrep from the conversation.

Choose your client

Live preview
Advanced clients IDE · CLI

Claude · Web + desktop

Official guide ↗

Connector URL · ready to paste

Streamable HTTP
https://edge.vinkius.com/vk_preview_419UaVAC33VwJmeeVBLCqRf2d8eEEPrGrsnPeNVU/mcp
  1. Step 01

    Open Connectors

    In Claude Web or Claude Desktop, open Settings and choose Connectors.

  2. Step 02

    Add the URL

    Choose Add custom connector, name it Semgrep, and paste the URL above.

  3. Step 03

    Turn it on in chat

    Select +, open Connectors, and enable Semgrep for the conversation.

Where the request belongs

Work Semgrep can move forward.

Built around the request

This is for security engineers who are drowning in alerts, DevOps folks managing pipeline compliance, and developers who want to fix bugs without leaving their IDE.

01

AppSec Engineer

Triages hundreds of SAST findings daily to prioritize real threats and manage false positives.

02

DevOps Engineer

Pulls compliance metrics and fix rates to generate executive reports for leadership.

03

Software Developer

Identifies the exact line of code causing a build failure and gets a fix suggestion instantly.

Build the capability set

Add more capabilities.

Each Connector adds new actions and data without changing how you work.

Browse Connectors
Veracode logo
01 10 capabilities

Veracode

Bring Veracode AppSec to your AI. Analyze source code flaws, extract application profiles, and track vulnerabilities conversationaly.

View Connector
Checkmarx logo
02 10 capabilities

Checkmarx

Automate AppSec via Checkmarx One. trigger core scans, analyze vulnerabilities, discover Best Fix Locations (BFL), and monitor KICS results.

View Connector
SonarCloud logo
03 9 capabilities

SonarCloud

Merge your SaaS DevOps workflow with SonarCloud to review AI code and prevent production vulnerabilities.

View Connector
Aikido Security logo
04 16 capabilities

Aikido Security

Query security vulnerabilities via Aikido. list open issues, check repositories, monitor cloud assets, and track compliance directly from any AI agent.

View Connector
Snyk logo
05 9 capabilities

Snyk

Bring your Snyk code security ecosystem directly to your AI. Analyze vulnerabilities, project metadata, and scan issues right from your editor.

View Connector
GitGuardian logo
06 49 capabilities

GitGuardian

Automate secret detection and incident response via GitGuardian. manage secret incidents, deploy honeytokens, and audit workspace security directly from your AI agent.

View Connector

Bring your own AI

Change the model, client or framework. Keep Semgrep connected.

  • Claude
  • ChatGPT
  • Gemini
  • Cursor
  • VS Code
  • Windsurf
  • ZCode
  • Cline
  • Zed
  • Continue
  • Kiro
  • Roo Code
  • Zencoder
  • Goose
  • Void
  • Augment Code
  • Amp
  • Qodo
  • Tabnine
  • Pieces
  • Sourcegraph Cody
  • JetBrains
  • Warp
  • Amazon Q
  • Antigravity
  • BoltAI
  • Raycast
  • Jan
  • LM Studio
  • AnythingLLM
  • Open WebUI
  • Msty
  • Cherry Studio
  • LibreChat
  • TypingMind
  • Chorus
  • 5ire
  • n8n
  • LangChain
  • LlamaIndex
  • CrewAI
  • Vercel AI SDK

Before you connect

Questions about Semgrep.

The practical details behind the request, access and result.

Can the Semgrep MCP help me clear out false positives faster?

Yes. You can ask your agent to identify and mark specific findings as false positives. This clears them from your active queue so you can focus on real threats.

How do I use the Semgrep MCP to manage security rules?

You can tell your agent to create new custom rules for bad coding patterns or delete old ones. The agent handles the deployment across your organization for you.

Can my AI agent see the exact lines of code for a vulnerability?

Yes, the Connector pulls the specific malicious code block and the exact line numbers from the platform so your agent can explain the issue to you clearly.

Does the Semgrep MCP work for both SAST and SCA?

It supports both static analysis security testing and software composition analysis. You can retrieve CVE links for dependencies and scan results for your own code.

Can I use the Semgrep MCP to generate security reports?

Yes. You can ask your agent to pull compliance metrics and fix rates. It can then summarize that data into an executive report directly in your chat.

How does the Semgrep MCP help with CI/CD blockers?

The agent can fetch findings that are currently blocking your pipeline, explain what the vulnerability means, and even draft the semantic fix to help you pass the scan.

Can the AI resolve or close findings in Semgrep natively?

Yes. This server supports mutable actions. By invoking update_finding_status, your AI agent can shift a specific semantic flaw to 'mitigated', 'fixed', 'ignored', or 'false_positive' updating the registry in real-time.

How can I deploy a new custom SAST rule via chat?

Simply ask the LLM: 'Draft a semantic grep rule to ban hardcoded API keys in Python and deploy it'. The agent will natively format the JSON structure required and call create_rule, sending it directly to all repositories.

Do I need to supply a 'Deployment Slug' for every request?

Most API queries require the deployment context. To ensure smooth interactions, just tell the agent your organization slug once (or let it query list_deployments to fetch the default one). The agent will remember it for the rest of the conversation loop.

One connection away

Give your agent a direct line to Semgrep.

Connect Semgrep once. Keep it beside 5,900+ managed Connectors when the next task needs more.

Explore every Connector No credit card required · Free tier available