> ## Documentation Index
> Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Semgrep Guardian FAQ

> Answers to common questions about Semgrep Guardian, including setup, rules, sign-in, team deployment, and the free trial.

## Free trial

<AccordionGroup>
  <Accordion title="How do I start the free trial?">
    Install the plugin, then sign in or sign up for Semgrep, and Guardian checks the next file your agent writes. No credit card is required. The trial is 30 days.

    Claude Code and Codex are the recommended setups. Follow the [Quickstart](/semgrep-guardian/quickstart).
  </Accordion>

  <Accordion title="What does the trial cost when it ends?">
    After 30 days, Guardian is \$10 per seat per month for individuals and teams of any size. The bundle with Semgrep Code is \$40 per seat per month. There is also an enterprise option.
  </Accordion>

  <Accordion title="What do I need installed first?">
    Install the coding agent first. For the recommended setups, that is Claude Code (`claude` command) or the Codex CLI (`codex` command). You also need a Semgrep account. After you install the plugin, sign up if you don't have one, or sign in if you do.

    Other coding agents are supported too. See [Choose your setup](/semgrep-guardian/choose-your-setup).

    On Windows, [Windows Subsystem for Linux (WSL)](https://learn.microsoft.com/en-us/windows/wsl/install) is required. Native Windows is unsupported.
  </Accordion>

  <Accordion title="Do I need to install the Semgrep CLI for the trial?">
    No, if you use the Claude Code or Codex plugin. Both use Semgrep's hosted scanner, and you sign in or sign up for Semgrep through the browser. Install the CLI only for other coding agents, or for the local Claude Code plugin. See [Choose your setup](/semgrep-guardian/choose-your-setup).
  </Accordion>

  <Accordion title="How do I know Guardian is running?">
    In Claude Code, start a new session after installing the plugin. You're prompted to sign in or sign up for Semgrep, and the plugin scans each file Claude Code writes. You can also run `claude mcp get plugin:semgrep:guardian` and confirm it reports as connected.

    In Codex, start a new session and sign in or sign up for Semgrep. Ask Codex who you are logged in as in Semgrep Guardian. You can also run `codex plugin list --json` and confirm the `semgrep` plugin is listed.

    When a scan finds something, Guardian returns the findings to the agent. See the [Quickstart](/semgrep-guardian/quickstart).
  </Accordion>

  <Accordion title="Why do I have to approve hooks in Codex?">
    Review and trust Guardian's hooks in Codex to enable scans after file writes.
  </Accordion>

  <Accordion title="What if I'm not signed in?">
    Sign in or sign up once in the browser. New users create an account on that page. Semgrep refreshes access tokens after that.

    In Codex, ask the agent to log in to Semgrep Guardian. In Claude Code, start a new session and complete the prompt. See [Authentication](/semgrep-guardian/authentication).
  </Accordion>
</AccordionGroup>

## How Guardian works

<AccordionGroup>
  <Accordion title="What does Semgrep Guardian do?">
    Guardian scans files an AI coding agent writes, before that code is committed. It scans with Semgrep Code, Supply Chain, and Secrets to catch vulnerable code patterns, vulnerable dependencies, and hardcoded secrets. See the [overview](/semgrep-guardian/overview) and [Rules and configuration](/semgrep-guardian/rules-and-configuration).
  </Accordion>

  <Accordion title="When does a scan run?">
    A hook, or an MCP tool call, scans what the agent just wrote or edited. The scan runs on the developer's machine at authoring time, not in CI.
  </Accordion>

  <Accordion title="Does Guardian rewrite the code?">
    No. Guardian returns findings to the agent. The agent decides whether to regenerate the code. If it does, the new code is scanned again.
  </Accordion>

  <Accordion title="Does Guardian replace scans in CI?">
    No. CI and platform scans still run on push, pull request, or a schedule, and they enforce your Policies. Keep running Semgrep in CI. See [Set up and deploy scans](/deployment/checklist).
  </Accordion>

  <Accordion title="Is Guardian the same as the Malware Firewall?">
    No. Guardian scans code an agent generates before it is committed. The [Semgrep Malware Firewall](/semgrep-supply-chain/malware-firewall) blocks malicious packages when developers install dependencies. After Guardian is installed, developers can run `/install-mfw` in the agent to install the Malware Firewall.

    <Note>
      The Malware Firewall is in private beta. It requires a macOS or Linux terminal or shell.
    </Note>
  </Accordion>
</AccordionGroup>

## Setup

<AccordionGroup>
  <Accordion title="Which coding agents does Guardian support?">
    Claude Code and Codex are the recommended setups. Other agents are supported too. See [Choose your setup](/semgrep-guardian/choose-your-setup).
  </Accordion>

  <Accordion title="What's the difference between the two setup paths?">
    The paths differ in how you sign in or sign up for Semgrep, whether you need a local CLI, and which rules run. See [Choose your setup](/semgrep-guardian/choose-your-setup).
  </Accordion>

  <Accordion title="How do I install Guardian in Claude Code?">
    Follow the [Quickstart](/semgrep-guardian/quickstart). For the local plugin, see [Claude Code setup](/semgrep-guardian/ide-setup/claude-code).
  </Accordion>

  <Accordion title="How do I install Guardian in Codex?">
    Follow the [Quickstart](/semgrep-guardian/quickstart).
  </Accordion>

  <Accordion title="How do I install Guardian in Cursor or another agent?">
    Follow the page for your agent under [Choose your setup](/semgrep-guardian/choose-your-setup).
  </Accordion>
</AccordionGroup>

## Rules and findings

<AccordionGroup>
  <Accordion title="Does Guardian use my organization's Policies?">
    It depends on the setup. The recommended plugins don't. See [Rules and configuration](/semgrep-guardian/rules-and-configuration).
  </Accordion>

  <Accordion title="What does the guardian-default ruleset include?">
    See [Rules and configuration](/semgrep-guardian/rules-and-configuration) for which rules that ruleset includes and why some are left out.
  </Accordion>

  <Accordion title="Why did CI report an issue that Guardian missed?">
    A CI scan can use rules the recommended plugins don't run. See [Rules and configuration](/semgrep-guardian/rules-and-configuration).
  </Accordion>
</AccordionGroup>

## Sign-in

<AccordionGroup>
  <Accordion title="How does sign-in work?">
    Claude Code and Codex use a one-time browser sign-in or sign-up. Other agents use the CLI. See [Authentication](/semgrep-guardian/authentication).
  </Accordion>

  <Accordion title="Where are credentials stored?">
    Where credentials are stored depends on how you signed in. See [Authentication](/semgrep-guardian/authentication).
  </Accordion>

  <Accordion title="Why are scans running under a different account?">
    An existing sign-in can take precedence over another. See [Authentication](/semgrep-guardian/authentication).
  </Accordion>

  <Accordion title="Can the team share one API token?">
    Shared tokens aren't recommended. See [Authentication](/semgrep-guardian/authentication). When a browser sign-in or sign-up isn't possible, see [Enterprise deployment](/semgrep-guardian/enterprise-deployment).
  </Accordion>
</AccordionGroup>

## Roll out to a team

<AccordionGroup>
  <Accordion title="Can I install Guardian for developers instead of asking each person to do it?">
    Yes. Each developer still signs in or signs up for Semgrep after the plugin is installed. See [Enterprise deployment](/semgrep-guardian/enterprise-deployment).
  </Accordion>

  <Accordion title="What if developers can't sign in or sign up for Semgrep through a browser?">
    Semgrep Enterprise has an option for that case. See [Enterprise deployment](/semgrep-guardian/enterprise-deployment).
  </Accordion>

  <Accordion title="Where do I get help?">
    Ask in Semgrep's `#mcp` [Slack community](https://go.semgrep.dev/slack). For deployment questions, see [Support](/support).
  </Accordion>
</AccordionGroup>