Skip to main content
Guardian has two integration paths. They differ in how you authenticate, where credentials are stored, and which rules run, so choose before you install.

​
Compare the two paths

If OAuth credentials are present in guardian.yml, Guardian uses them instead of any API token in settings.yml. See Authentication if scans run under an unexpected account.
Rules are the most consequential difference between these paths. The recommended remote plugin runs a fixed ruleset and ignores your Policies configuration; the local CLI integrations use your Policies. If you have tuned your Policies and expect those rules to run, see Rules and configuration.
Follow the Quickstart, or see Claude Code setup for the local plugin option and more detail.

​
Set up with another coding agent

Each of these integrations needs the Semgrep CLI installed and signed in first.

Cursor

Hooks and MCP through the Cursor Plugin Marketplace.

Codex

MCP server via ~/.codex/config.toml.

GitHub Copilot

MCP in Visual Studio, JetBrains, Xcode, or Eclipse.

VS Code

MCP server for Copilot Chat Agent mode.

Devin (Windsurf)

Cascade hooks after file writes.

Kiro

MCP server with local Semgrep CLI.

Other agents

Generic MCP or hook configuration.

Claude Code (local)

Run Guardian against a local Semgrep CLI instead of the remote server.