> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Run scans and workflows

> Start scans and Agentic Workflows jobs from the hosted MCP server for Semgrep AppSec Platform, and get a summary of their findings.

Use the `semgrep_run_job` tool to start a scan or workflow on a project and get a summary of the findings it produces.

## Prerequisites

* A connection to the full MCP server URL. The `semgrep_run_job` tool isn't available on the [read-only URL](https://docs.semgrep.dev/mcp/authentication.md#read-only-url).
* An MCP client that supports the [MCP tasks extension](https://modelcontextprotocol.io/extensions/tasks/overview). The `semgrep_run_job` tool appears only if your client supports it. If you don't see the tool, check your client's documentation for tasks support.
* To run `workflow` and `deep` jobs, the admin role.

## Choose a job type

Set `jobType` to choose what runs:

| `jobType` | What runs | Required inputs |
| :- | :- | :- |
| `sms` | A rule-based scan with Semgrep Managed Scans. | A project. |
| `aiDetection` | An AI-powered detection scan. Set `baseBranch` to scan only the changes compared to that branch. | A project. |
| `workflow` | An Agentic Workflows run. | A project and `workflowName`. |
| `deep` | A scan with Managed Scans, an AI-powered detection scan, and your organization's Agentic Workflows, all on one branch. | A project. |

To choose the branch, set `branch`. Otherwise, the job runs on the branch that Managed Scans uses for full scans of the project, or on the project's primary branch if no full-scan branch is set.

AI-powered detection scans and Agentic Workflows runs consume credits.

> [!NOTE]
>
> Only admins can run `workflow` and `deep` jobs, because both run Agentic Workflows.

## How jobs run

Scans can take several minutes, so `semgrep_run_job` uses the MCP tasks extension. Instead of waiting for the job to finish, the tool returns a task right away. Your MCP client checks the task until the job is completed, failed, or canceled, then reads the result. The result describes the job and summarizes the findings from each scan or workflow that ran. Tasks expire 24 hours after they're created.

## Cancel a job

You can cancel a `workflow` job. You can't stop a Managed Scans or AI-powered detection scan after it starts, so `sms`, `aiDetection`, and `deep` jobs keep running until they finish.