Skip to main content
Add the hosted MCP server to Cursor. For help choosing an authentication method, see Authentication and access.

​
Prerequisites

Single-tenant URLThe steps on this page use https://semgrep.dev/api/mcp. On a single-tenant deployment, replace that URL with https://YOUR_TENANT.semgrep.dev/api/mcp. Use your subdomain for YOUR_TENANT. To connect to the read-only URL instead, see Read-only URL.

​
Connect with OAuth

1
Add the server to ~/.cursor/mcp.json to make it available in every project, or to .cursor/mcp.json in a single project:
2
Open Cursor Settings and find semgrep under Custom MCP Servers.
3
Start sign-in for semgrep.
4
Sign in and select an organization in your browser.
5
Confirm that semgrep shows as connected and lists its tools.

​
Connect with an API token

1
Add the server to ~/.cursor/mcp.json or .cursor/mcp.json with an Authorization header:
Cursor replaces ${env:SEMGREP_APP_TOKEN} with the value of the SEMGREP_APP_TOKEN environment variable. Export it, set to a Web API or Read-only API token, in the environment where you start Cursor.
2
Restart Cursor. In Cursor Settings, under Custom MCP Servers, confirm that semgrep shows as connected and lists its tools.
For more information, see Cursor MCP documentation.