Skip to main content
Integrate Semgrep Guardian with Claude Code for scans of AI-generated code through hooks and plugins. Claude Code is a recommended Guardian setup, alongside Codex. The remote plugin uses Semgrep’s hosted server and OAuth, so you don’t need to install the Semgrep CLI locally.

​
Prerequisites

  • A Semgrep account
  • Claude Code installed (claude command)

​
Setup (remote plugin)

Install the Guardian plugin from the Claude Marketplace:
Start a new Claude Code session (claude) to sign in to Semgrep. The plugin registers a post-tool hook so Claude Code scans every file it writes.
For Windows machines: Windows Subsystem for Linux (WSL) is required. Native Windows is unsupported.

​
Run Semgrep Guardian locally

The remote server is the recommended default. If you need to run Semgrep locally instead, you can install the local plugin from the semgrep/guardian-local repo.
1
Install the Semgrep CLI.
2
Start a Claude Code instance:
3
Open the plugin manager:
4
Go to Discover. Search for Semgrep, and then click Install.
5
Load the plugin:

​
What rules does this setup use?

  • Remote plugin (default): scans with the fixed guardian-default ruleset. Rules enabled in your organization’s Policies don’t apply.
  • Local plugin: scans with the rules enabled for your Semgrep organization through your Policies.
See Rules and configuration for more information.

​
Next steps