> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect other MCP clients

> Add the hosted MCP server for Semgrep AppSec Platform to any MCP client that supports streamable HTTP, or bridge it to a stdio-only client.

Any MCP client that supports the Model Context Protocol's streamable HTTP transport and OAuth can connect to the hosted MCP server. For help choosing an authentication method, see [Authentication and access](https://docs.semgrep.dev/mcp/authentication.md). For where to add the server, see your client's documentation.

> [!NOTE]
>
> **Single-tenant URL**
>
> The steps on this page use `https://semgrep.dev/api/mcp`. On a single-tenant deployment, replace that URL with `https://YOUR_TENANT.semgrep.dev/api/mcp`. Use your subdomain for `YOUR_TENANT`. To connect to the read-only URL instead, see [Read-only URL](https://docs.semgrep.dev/mcp/authentication.md#read-only-url).

## Connect with OAuth

Configure the client with:

* **Transport:** streamable HTTP
* **URL:** `https://semgrep.dev/api/mcp`
* **Authentication:** OAuth

When the client starts the OAuth flow, sign in and select an organization in your browser.

If your client supports only local servers over standard input/output (stdio), use a bridge such as [`mcp-remote`](https://www.npmjs.com/package/mcp-remote), a third-party npm package:

```json theme={null}
{
  "mcpServers": {
    "semgrep": {
      "command": "npx",
      "args": ["-y", "mcp-remote", "https://semgrep.dev/api/mcp"]
    }
  }
}
```

## Connect with an API token

Configure the client with:

* **Transport:** streamable HTTP
* **URL:** `https://semgrep.dev/api/mcp`
* **Header:** `Authorization: Bearer YOUR_SEMGREP_APP_TOKEN`

Replace `YOUR_SEMGREP_APP_TOKEN` with a **Web API** or **Read-only** [API token](https://docs.semgrep.dev/mcp/authentication.md#token-scopes).

If your client supports only local servers over stdio, pass the header through `mcp-remote`. The following example stores the token in the configuration file. Keep that file out of version control.

```json theme={null}
{
  "mcpServers": {
    "semgrep": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://semgrep.dev/api/mcp",
        "--header",
        "Authorization:${SEMGREP_AUTH_HEADER}"
      ],
      "env": {
        "SEMGREP_AUTH_HEADER": "Bearer YOUR_SEMGREP_APP_TOKEN"
      }
    }
  }
}
```