Skip to main content
Guardian has two integration paths. They differ in how you authenticate, where credentials are stored, and which rules run, so choose before you install.

​
Compare the two paths

If OAuth credentials are present in guardian.yml, Guardian uses them instead of any API token in settings.yml. See Authentication if scans run under an unexpected account.
Rules are the most consequential difference between these paths. The recommended Claude Code and Codex plugins run a fixed ruleset and ignore your Policies configuration. The local CLI integrations use your Policies. If you’ve tuned your Policies and expect those rules to run, see Rules and configuration.
Follow the Quickstart, or see the Claude Code setup or Codex setup for more information.

​
Set up with another coding agent

Each of these integrations needs the Semgrep CLI installed and signed in first.

Cursor

Hooks and MCP through the Cursor Plugin Marketplace.

GitHub Copilot

MCP in Visual Studio, JetBrains, Xcode, or Eclipse.

VS Code

MCP server for Copilot Chat Agent mode.

Devin (Windsurf)

Cascade hooks after file writes.

Kiro

MCP server with local Semgrep CLI.

Other agents

Generic MCP or hook configuration.

Claude Code (local)

Run Guardian against a local Semgrep CLI instead of the remote server.