The connection fails with “Invalid or expired bearer token”
The client receives a401 error. The token was revoked, was created in a different deployment than the server URL, or has the Member scope.
To fix this, use a token with the Web API scope from the same deployment as the server URL, or connect with OAuth.
Only the semgrep_account tool appears
The connection isn’t tied to an organization that can use the hosted MCP server. Either your organization is on the Free plan, or you connected with a token that isn’t bound to an organization.
To fix this, connect to an organization on a Teams or Enterprise plan. If you use an API token, create it in that organization’s Settings > Tokens > API tokens.
A tool returns “status 404: The requested URL was not found”
Your token or role doesn’t have the permission that the tool requires. The hosted MCP server reports permission denials as404, not 403, even for an organization you belong to.
To fix this, check Token scopes, or switch to a Web API token or OAuth.
Autofix returns AUTOFIX_ERROR_TYPE_PERMISSION_DENIED
Read-only tokens can’t open Autofix pull requests. Use a Web API token or OAuth.
A tool returns “Please upgrade your plan” or “Writes through this API are not yet enabled”
Your organization’s plan or feature settings don’t include this operation. Changing the token doesn’t fix this error. Contact your Semgrep account team.A capability you expect is missing
If you connected to the read-only URL, tools that make changes aren’t available. To triage findings, generate fixes, or start scans, connect to the full MCP server URL instead. If you expect thesemgrep_run_job tool, check that your client supports the MCP tasks extension. See Run scans and workflows.
Not every AppSec Platform feature is available through the hosted MCP server. To request a capability, contact Semgrep support.