Skip to main content
Integrate Semgrep Guardian with Claude Code for scans of AI-generated code through hooks and plugins. Claude Code is a recommended Guardian setup, alongside Codex. The remote plugin uses Semgrep’s hosted server and OAuth, so you don’t need to install the Semgrep CLI locally.

​
Prerequisites

  • A Semgrep account
  • Claude Code installed (claude command)

​
Setup (remote plugin)

Install the Guardian plugin from the Claude Marketplace:
Start a new Claude Code session (claude) to sign in to Semgrep. The plugin registers a post-tool hook so Claude Code scans every file it writes.
For Windows machines: Windows Subsystem for Linux (WSL) is no longer required. Guardian works in native Windows shells such as PowerShell and Cygwin, as well as in WSL.

​
Run Semgrep Guardian locally

The remote server is the recommended default. If you need to run Semgrep locally instead, you can install the local plugin from the semgrep/guardian-local repo.
1
Install the Semgrep CLI.
2
Start a Claude Code instance:
3
Open the plugin manager:
4
Go to Discover. Search for Semgrep, and then click Install.
5
Load the plugin:

​
What rules does this setup use?

  • Remote plugin (default): scans with the guardian-default ruleset, which you can customize with Guardian Policies. You configure Guardian’s rules separately from your CI and platform scans.
  • Local plugin: no Guardian-specific policy available. Pulls all rules enabled on Policies.
See Rules and configuration for more information.

​
Local PHP version check

Guardian checks the PHP version installed on your machine. See Why did Guardian show a PHP version error? for when the check runs, which versions are affected, and how to turn it off. For the full list of incidents Guardian checks for, including Node2Shell, see Semgrep Guardian incident advisories.

​
Next steps