Skip to main content
Any MCP client that supports the Model Context Protocol’s streamable HTTP transport and OAuth can connect to the hosted MCP server. For help choosing an authentication method, see Authentication and access. For where to add the server, see your client’s documentation.
Single-tenant URLThe steps on this page use https://semgrep.dev/api/mcp. On a single-tenant deployment, replace that URL with https://YOUR_TENANT.semgrep.dev/api/mcp. Use your subdomain for YOUR_TENANT. To connect to the read-only URL instead, see Read-only URL.

​
Connect with OAuth

Configure the client with:
  • Transport: streamable HTTP
  • URL: https://semgrep.dev/api/mcp
  • Authentication: OAuth
When the client starts the OAuth flow, sign in and select an organization in your browser. If your client supports only local servers over standard input/output (stdio), use a bridge such as mcp-remote, a third-party npm package:

​
Connect with an API token

Configure the client with:
  • Transport: streamable HTTP
  • URL: https://semgrep.dev/api/mcp
  • Header: Authorization: Bearer YOUR_SEMGREP_APP_TOKEN
Replace YOUR_SEMGREP_APP_TOKEN with a Web API or Read-only API token. If your client supports only local servers over stdio, pass the header through mcp-remote. The following example stores the token in the configuration file. Keep that file out of version control.