Skip to main content
Semgrep AppSec Platform provides a hosted Model Context Protocol (MCP) server. Connect your AI agent to the hosted MCP server to search and triage findings, generate fixes, debug scans, and manage policies from your editor or terminal.
To scan code locally as your agent writes it, use Semgrep Guardian, which runs the MCP server with semgrep mcp.
With the hosted MCP server, you can:
  • Search and filter findings, triage them in bulk, and read finding history.
  • Generate fixes, inspect failed scans, and start new scans.
  • Look up projects, dependencies, and advisories.
  • Test rules, manage policies, and open Jira or Linear tickets.
If your agent only needs to investigate, connect it to the read-only URL instead. It provides only the tools that read data. Available tools depend on your role or token scope, your organization’s plan, and the URL you connect to. For more information, see Tools and capabilities.

​
Prerequisites

  • An AppSec Platform account in an organization on a Teams or Enterprise plan, including trials.
  • An MCP client that supports remote servers over HTTP, such as Claude Code, Codex, Cursor, or VS Code.

​
Get started

Authentication and access

Find the server URL for your deployment, choose between OAuth and an API token, and limit access with the read-only URL.

Connect an MCP client

Add the hosted MCP server to Claude Code, Codex, Cursor, VS Code, or another MCP client.

Tools and capabilities

See what your agent can do with findings, fixes, scans, rules, policies, and integrations.

Run scans and workflows

Start rule-based scans, AI-powered detection scans, and Agentic Workflows jobs from your agent.

Troubleshooting

Fix common connection, permission, and plan errors.