> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Connect VS Code

> Add the hosted MCP server for Semgrep AppSec Platform to VS Code with OAuth or an API token.

Add the hosted MCP server to VS Code. For help choosing an authentication method, see [Authentication and access](https://docs.semgrep.dev/mcp/authentication.md).

## Prerequisites

* The [prerequisites for the hosted MCP server](https://docs.semgrep.dev/mcp/overview.md#prerequisites).

> [!NOTE]
>
> **Single-tenant URL**
>
> The steps on this page use `https://semgrep.dev/api/mcp`. On a single-tenant deployment, replace that URL with `https://YOUR_TENANT.semgrep.dev/api/mcp`. Use your subdomain for `YOUR_TENANT`. To connect to the read-only URL instead, see [Read-only URL](https://docs.semgrep.dev/mcp/authentication.md#read-only-url).

## Connect with OAuth

**Step 1**

Run **MCP: Open User Configuration** from the Command Palette to add the server for every workspace, or create `.vscode/mcp.json` in a single workspace. Add the following:

```json theme={null}
{
  "servers": {
    "semgrep": {
      "type": "http",
      "url": "https://semgrep.dev/api/mcp"
    }
  }
}
```

**Step 2**

Run **MCP: List Servers** from the Command Palette and select `semgrep`.

**Step 3**

Start the `semgrep` server.

**Step 4**

When VS Code prompts you to authenticate, sign in and select an organization in your browser.

**Step 5**

Run **MCP: List Servers** again and confirm that `semgrep` is running. Semgrep tools are available in Copilot Chat **Agent** mode.

## Connect with an API token

**Step 1**

Add the server to your user configuration or `.vscode/mcp.json` with an input that prompts for the token:

```json theme={null}
{
  "inputs": [
    {
      "type": "promptString",
      "id": "semgrep-app-token",
      "description": "Semgrep API token",
      "password": true
    }
  ],
  "servers": {
    "semgrep": {
      "type": "http",
      "url": "https://semgrep.dev/api/mcp",
      "headers": {
        "Authorization": "Bearer ${input:semgrep-app-token}"
      }
    }
  }
}
```

**Step 2**

Start the `semgrep` server.

**Step 3**

Enter a **Web API** or **Read-only** [API token](https://docs.semgrep.dev/mcp/authentication.md#token-scopes) when VS Code prompts for it. VS Code stores the value securely for later sessions.

**Step 4**

Run **MCP: List Servers** from the Command Palette and confirm that `semgrep` is running.

For more information, see [VS Code MCP documentation](https://code.visualstudio.com/docs/copilot/customization/mcp-servers).