Skip to main content
Add the hosted MCP server to Codex. For help choosing an authentication method, see Authentication and access.

​
Prerequisites

Single-tenant URLThe steps on this page use https://semgrep.dev/api/mcp. On a single-tenant deployment, replace that URL with https://YOUR_TENANT.semgrep.dev/api/mcp. Use your subdomain for YOUR_TENANT. To connect to the read-only URL instead, see Read-only URL.

​
Connect with OAuth

1
Add this entry to ~/.codex/config.toml, or update the existing semgrep entry:
2
Start the browser sign-in:
3
Sign in and select an organization in your browser.
4
Start a new Codex session, or reload the MCP servers in the Codex app. Run /mcp and confirm that semgrep is connected.

​
Connect with an API token

1
Add this entry to ~/.codex/config.toml instead of the OAuth entry:
Codex sends the value of SEMGREP_APP_TOKEN as a bearer token. Export SEMGREP_APP_TOKEN, set to a Web API or Read-only API token, in the environment where you start Codex.
2
Start a new Codex session, or reload the MCP servers in the Codex app. Run /mcp and confirm that semgrep is connected. You don’t need to sign in through your browser.
For more information, see OpenAI MCP documentation.