> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Tools and capabilities

> See which tools the hosted MCP server for Semgrep AppSec Platform provides for findings, fixes, scans, projects, rules, policies, reports, and integrations.

The hosted MCP server provides tools in the following areas. Which tools you can use depends on your role or token scope, your organization's plan, and the URL you connect to. For more information, see [Authentication and access](https://docs.semgrep.dev/mcp/authentication.md).

On the [read-only URL](https://docs.semgrep.dev/mcp/authentication.md#read-only-url), each area provides only its read tools. For example, you can search findings, read scan logs, test patterns, and dry-run policies, but you can't triage findings, generate fixes, or start scans.

| Capability | What you can do |
| :- | :- |
| Findings and triage | Search and filter findings from Semgrep Code, Semgrep Supply Chain, Semgrep Secrets, and Semgrep Agentic Workflows. Count findings by severity, project, or rule. Triage, ignore, and reopen findings one at a time or in bulk, and add notes to them. Read code snippets and finding history. |
| Fixes | Generate [Autofix](https://docs.semgrep.dev/semgrep-code/triage-remediation/autofix.md) suggestions, start Autofix jobs, and reuse your organization's [Memories](https://docs.semgrep.dev/semgrep-multimodal/overview#memories). |
| Scans | Find failed scans, read scan logs and errors, and retry scans. Start rule-based scans, [AI-powered detection](https://docs.semgrep.dev/semgrep-code/ai-powered-detection-concepts) scans, and [Agentic Workflows](https://docs.semgrep.dev/workflows/overview.md) jobs. See [Run scans and workflows](https://docs.semgrep.dev/mcp/run-scans-and-workflows.md). |
| Projects | List projects, and look up a project or branch. |
| Supply chain | Look up advisories, list dependencies, and find the repositories that an advisory affects. |
| Rules and policies | Search the Semgrep Registry, test patterns against code, create, update, and delete your organization's custom rules, check each rule's open findings, fix rate, and ignore rate, dry-run and apply policies, manage project and tag exceptions to your policies, and configure Guardian rules. |
| Reports | Get backlog by severity, product, or rule, median open age, findings activity, [secure guardrails](https://docs.semgrep.dev/secure-guardrails/secure-guardrails-in-semgrep) adoption, and Guardian scan activity and the rules Guardian flags most often. |
| Agentic Workflows | Trigger workflows, schedule them for one project or many at once, read job status and task logs, and track credit usage. Only admins can trigger or schedule workflows. |
| Integrations and automations | Create and link Jira and Linear tickets, and build automations. View Slack notification settings, and check and sync SCM connections. |
| Settings | View and update your organization's product settings, and view a project's Managed Scans settings. |

## Utility tools

Both URLs also provide these tools:

* `discover`: Your agent can call it to find the right tool for a task.
* `semgrep_account`: Returns the organization you're connected to.
* `semgrep_app_link`: Builds links to pages in AppSec Platform.

The full MCP server URL also provides a `FeedbackService_SendFeedback` tool, which your agent can use to send feedback about the hosted MCP server to the Semgrep team.

## Skills

The hosted MCP server also publishes a `semgrep-automations` skill through the [MCP skills extension](https://modelcontextprotocol.io/seps/2640-skills-extension). The skill guides your agent through scheduling Agentic Workflows and setting up the automations that act on their findings.

Not every AppSec Platform feature is available through the hosted MCP server. To request a capability, contact [Semgrep support](https://docs.semgrep.dev/support.md).