Set up Semgrep Guardian with Devin (Windsurf) - Semgrep

Integrate Semgrep Guardian with Devin (Windsurf) through Cascade hooks.

Prerequisites

A Semgrep account
Semgrep CLI installed and signed in

Setup

1

Install the Semgrep CLI.

2

Create a hooks.json file at ~/.codeium/windsurf/hooks.json and paste the following configuration:

{
  "hooks": {
    "post_write_code": [
      {
        "command": "semgrep mcp -k post-tool-cli-scan -a windsurf",
        "show_output": true
      }
    ]
  }
}

3

Restart Windsurf to apply hook configuration.

The post_write_code event fires after Cascade writes or modifies any file.

What rules does this setup use?

This integration has no Guardian-specific policy available. It pulls all rules enabled on Policies. See Rules and configuration for how this differs from the Claude Code and Codex plugins.

Next steps

Enterprise deployment for authentication and organization-wide rollout
Semgrep Guardian overview
Rules and configuration