Semgrep Guardian enterprise deployment

To roll out Semgrep Guardian organization-wide, standardize the installation process so that the plugin is automatically installed by the developer’s agent, rather than relying on each developer to install it manually.

Use your agent’s built-in enterprise controls

Many coding agents let you pin an approved marketplace or plugin for your whole team. This is the simplest way to make Guardian available, or required, everywhere:

Claude Code: Require marketplaces for your team
Cursor: Team marketplaces

Deploy through a mobile device management (MDM) platform for more granularity

Deploy through your MDM platform to scope rollout by device group, or to combine Guardian with other managed configurations deployed through your MDM. Anthropic maintains a set of MDM deployment examples and best practices that cover managed settings for macOS, including .plist and .mobileconfig profiles through Jamf, Kandji, and similar, and Windows, including PowerShell file deployment or ADMX/registry policy via Intune and Group Policy, along with how to verify that managed settings are applied. For Claude Code, the managed settings enable the Giardian plugin from the Claude official marketplace for every user, so they don’t have to run /plugin themselves. The same payload is reused across the MDM paths below, just delivered differently (MDM mobileconfig or MDM plist). Settings deployed through MDM cannot be overridden by users, so the plugin stays enabled. The minimal managed-settings payload looks like the following:

{
  "enabledPlugins": {
    "semgrep@claude-plugins-official" : true
  }
}

Guardian is published to the Claude official marketplace (claude-plugins-official), so the payload only needs to enable the plugin. There’s no separate marketplace to declare. For the Iru and Jamf paths, the same payload is provided as a ready-to-upload property list com.anthropic.claudecode.plist.

These are community-maintained templates and may be unsupported or incorrect. You are responsible for verifying the configuration before deploying it to a fleet.

Expand to view com.anthropic.claudecode.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>enabledPlugins</key>
	<dict>
		<key>semgrep@claude-plugins-official</key>
		<true/>
	</dict>
</dict>
</plist>

Iru
Jamf

Deploy a Custom Profile by uploading the semgrep-marketplace.mobileconfig configuration profile.

Go to Library > Add Library Item > Custom Profile and upload the semgrep-marketplace.mobileconfig file.

Click to expand and view the semgrep-marketplace.mobileconfig file

Update PayloadIdentifier and PayloadOrganization to match your organization before uploading.

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>PayloadDisplayName</key>
    <string>Claude Code – Semgrep Guardian Plugin Settings</string>
    <key>PayloadDescription</key>
    <string>Enforces the Semgrep Guardian plugin enable/disable policy.</string>
    <key>PayloadIdentifier</key>
    <string>com.yourorg.com</string>
    <key>PayloadOrganization</key>
    <string>yourorg</string>
    <key>PayloadScope</key>
    <string>System</string>
    <key>PayloadType</key>
    <string>Configuration</string>
    <key>PayloadUUID</key>
    <string>DA9306A3-D913-47D0-95D9-0594D39CFE76</string>
    <key>PayloadVersion</key>
    <integer>1</integer>
    <key>PayloadContent</key>
    <array>
        <dict>
            <key>PayloadDisplayName</key>
            <string>Claude Code Marketplace Settings</string>
            <key>PayloadIdentifier</key>
            <string>B85904F9-D6ED-4D4C-BD27-A49B9CCF0E6F</string>
            <key>PayloadType</key>
            <string>com.apple.ManagedClient.preferences</string>
            <key>PayloadUUID</key>
            <string>B85904F9-D6ED-4D4C-BD27-A49B9CCF0E6F</string>
            <key>PayloadVersion</key>
            <integer>1</integer>
            <key>PayloadContent</key>
            <dict>
                <key>com.anthropic.claudecode</key>
                <dict>
                    <key>Forced</key>
                    <array>
                        <dict>
                            <key>mcx_preference_settings</key>
                            <dict>
                                <!-- Plugin enable/disable policy -->
                                <key>enabledPlugins</key>
                                <dict>
                                    <key>semgrep@claude-plugins-official</key>
                                    <true/>
                                </dict>
                            </dict>
                        </dict>
                    </array>
                </dict>
            </dict>
        </dict>
    </array>
</dict>
</plist>

Name the profile Semgrep Guardian - Managed Settings.

Assign the profile to your blueprint as needed.

Save.

Deploy a Custom Settings payload with preference domain com.anthropic.claudecode through a Configuration Profile.To do so, refer to Jamf’s guide,Deploying Custom Computer Configuration Profiles Using the Application and Custom Settings Payload. Ensure that you use the preference domain com.anthropic.claudecode and the provided com.anthropic.claudecode.plist file as the uploaded property list.

Tips

Test the rollout on a single machine before pushing to the whole fleet.
After deploying, confirm that Guardian loaded by running /plugin (it should show as installed and enabled) and that the Guardian MCP appears.
Users still need to log in to Semgrep once Guardian is installed. See the setup steps in Connect to your IDE.

Get help with a custom rollout

Contact Semgrep or send a message to the #mcp channel on Slack if you would like help building something custom for your MDM or agent fleet.

Get started

Set up and deploy scans

Scan and triage

Semgrep Multimodal

Semgrep Community Edition

References

Semgrep Guardian enterprise deployment

Use your agent’s built-in enterprise controls

Deploy through a mobile device management (MDM) platform for more granularity

Get help with a custom rollout

​Use your agent’s built-in enterprise controls

​Deploy through a mobile device management (MDM) platform for more granularity

​Get help with a custom rollout

Use your agent’s built-in enterprise controls

Deploy through a mobile device management (MDM) platform for more granularity

Get help with a custom rollout