Free trial
How do I start the free trial?
How do I start the free trial?
Install the plugin, then sign in or sign up for Semgrep, and Guardian checks the next file your agent writes. No credit card is required. The trial is 30 days.Claude Code and Codex are the recommended setups. Follow the Quickstart.
What does the trial cost when it ends?
What does the trial cost when it ends?
After 30 days, Guardian is $10 per seat per month for individuals and teams of any size. The bundle with Semgrep Code is $40 per seat per month. There is also an enterprise option.
What do I need installed first?
What do I need installed first?
Install the coding agent first. For the recommended setups, that is Claude Code (
claude command) or the Codex CLI (codex command). You also need a Semgrep account. After you install the plugin, sign up if you don’t have one, or sign in if you do.Other coding agents are supported too. See Choose your setup.On Windows, Windows Subsystem for Linux (WSL) is required. Native Windows is unsupported.Do I need to install the Semgrep CLI for the trial?
Do I need to install the Semgrep CLI for the trial?
No, if you use the Claude Code or Codex plugin. Both use Semgrep’s hosted scanner, and you sign in or sign up for Semgrep through the browser. Install the CLI only for other coding agents, or for the local Claude Code plugin. See Choose your setup.
How do I know Guardian is running?
How do I know Guardian is running?
In Claude Code, start a new session after installing the plugin. You’re prompted to sign in or sign up for Semgrep, and the plugin scans each file Claude Code writes. You can also run
claude mcp get plugin:semgrep:guardian and confirm it reports as connected.In Codex, start a new session and sign in or sign up for Semgrep. Ask Codex who you are logged in as in Semgrep Guardian. You can also run codex plugin list --json and confirm the semgrep plugin is listed.When a scan finds something, Guardian returns the findings to the agent. See the Quickstart.Why do I have to approve hooks in Codex?
Why do I have to approve hooks in Codex?
Review and trust Guardian’s hooks in Codex to enable scans after file writes.
What if I'm not signed in?
What if I'm not signed in?
Sign in or sign up once in the browser. New users create an account on that page. Semgrep refreshes access tokens after that.In Codex, ask the agent to log in to Semgrep Guardian. In Claude Code, start a new session and complete the prompt. See Authentication.
How Guardian works
What does Semgrep Guardian do?
What does Semgrep Guardian do?
Guardian scans files an AI coding agent writes, before that code is committed. It scans with Semgrep Code, Supply Chain, and Secrets to catch vulnerable code patterns, vulnerable dependencies, and hardcoded secrets. See the overview and Rules and configuration.
When does a scan run?
When does a scan run?
A hook, or an MCP tool call, scans what the agent just wrote or edited. The scan runs on the developer’s machine at authoring time, not in CI.
Does Guardian rewrite the code?
Does Guardian rewrite the code?
No. Guardian returns findings to the agent. The agent decides whether to regenerate the code. If it does, the new code is scanned again.
Does Guardian replace scans in CI?
Does Guardian replace scans in CI?
No. CI and platform scans still run on push, pull request, or a schedule, and they enforce your Policies. Keep running Semgrep in CI. See Set up and deploy scans.
Is Guardian the same as the Malware Firewall?
Is Guardian the same as the Malware Firewall?
No. Guardian scans code an agent generates before it is committed. The Semgrep Malware Firewall blocks malicious packages when developers install dependencies. After Guardian is installed, developers can run
/install-mfw in the agent to install the Malware Firewall.The Malware Firewall is in private beta. It requires a macOS or Linux terminal or shell.
Setup
Which coding agents does Guardian support?
Which coding agents does Guardian support?
Claude Code and Codex are the recommended setups. Other agents are supported too. See Choose your setup.
What's the difference between the two setup paths?
What's the difference between the two setup paths?
The paths differ in how you sign in or sign up for Semgrep, whether you need a local CLI, and which rules run. See Choose your setup.
How do I install Guardian in Claude Code?
How do I install Guardian in Claude Code?
Follow the Quickstart. For the local plugin, see Claude Code setup.
How do I install Guardian in Codex?
How do I install Guardian in Codex?
Follow the Quickstart.
How do I install Guardian in Cursor or another agent?
How do I install Guardian in Cursor or another agent?
Follow the page for your agent under Choose your setup.
Rules and findings
Does Guardian use my organization's Policies?
Does Guardian use my organization's Policies?
It depends on the setup. The recommended plugins don’t. See Rules and configuration.
What does the guardian-default ruleset include?
What does the guardian-default ruleset include?
See Rules and configuration for which rules that ruleset includes and why some are left out.
Why did CI report an issue that Guardian missed?
Why did CI report an issue that Guardian missed?
A CI scan can use rules the recommended plugins don’t run. See Rules and configuration.
Sign-in
How does sign-in work?
How does sign-in work?
Claude Code and Codex use a one-time browser sign-in or sign-up. Other agents use the CLI. See Authentication.
Where are credentials stored?
Where are credentials stored?
Where credentials are stored depends on how you signed in. See Authentication.
Why are scans running under a different account?
Why are scans running under a different account?
An existing sign-in can take precedence over another. See Authentication.
Roll out to a team
Can I install Guardian for developers instead of asking each person to do it?
Can I install Guardian for developers instead of asking each person to do it?
Yes. Each developer still signs in or signs up for Semgrep after the plugin is installed. See Enterprise deployment.
What if developers can't sign in or sign up for Semgrep through a browser?
What if developers can't sign in or sign up for Semgrep through a browser?
Semgrep Enterprise has an option for that case. See Enterprise deployment.
Where do I get help?
Where do I get help?
Ask in Semgrep’s
#mcp Slack community. For deployment questions, see Support.