Skip to main content
The hosted MCP server provides tools in the following areas. Which tools you can use depends on your role or token scope, your organization’s plan, and the URL you connect to. For more information, see Authentication and access. On the read-only URL, each area provides only its read tools. For example, you can search findings, read scan logs, test patterns, and dry-run policies, but you can’t triage findings, generate fixes, or start scans.

Utility tools

Both URLs also provide these tools:
  • discover: Your agent can call it to find the right tool for a task.
  • semgrep_account: Returns the organization you’re connected to.
  • semgrep_app_link: Builds links to pages in AppSec Platform.
The full MCP server URL also provides a FeedbackService_SendFeedback tool, which your agent can use to send feedback about the hosted MCP server to the Semgrep team.

Skills

The hosted MCP server also publishes a semgrep-automations skill through the MCP skills extension. The skill guides your agent through scheduling Agentic Workflows and setting up the automations that act on their findings. Not every AppSec Platform feature is available through the hosted MCP server. To request a capability, contact Semgrep support.