Skip to main content
Integrate Semgrep Guardian with Claude Code for scans of AI-generated code via hooks and plugins. Claude Code is the recommended Guardian setup. The remote plugin uses Semgrep’s hosted server and OAuth, so you do not need to install the Semgrep CLI locally.

​
Prerequisites

  • A Semgrep account
  • Claude Code installed (claude command)

​
Setup (remote plugin)

Install the Guardian plugin from the Claude Marketplace:
Start a new Claude Code session (claude) to log in to Semgrep. The plugin registers a post-tool hook so Claude Code scans every file it writes.
For Windows machines: Windows Subsystem for Linux (WSL) is required. Native Windows is unsupported.

​
Run Semgrep Guardian locally

The remote server is the recommended default. If you need to run Semgrep locally instead, you can install the local plugin from the semgrep/guardian-local repo.
1
Install the Semgrep CLI.
2
Start a Claude Code instance:
3
Open the plugin manager:
4
Go to Discover. Search for Semgrep, and then click Install.
5
Load the plugin:

​
What rules does this setup use?

  • Remote plugin (default): scans with the fixed guardian-default ruleset. Rules enabled in your organization’s Policies do not apply.
  • Local plugin: scans with the rules enabled for your Semgrep organization through your Policies.
See Rules and configuration for details.

​
Next steps