Set up Semgrep Guardian with Devin (Windsurf) - Semgrep

Integrate Semgrep Guardian with Devin (Windsurf) through Cascade hooks.

Prerequisites

A Semgrep account
Semgrep CLI installed and signed in

Setup

1

Install the Semgrep CLI.

2

Create a hooks.json file at ~/.codeium/windsurf/hooks.json and paste the following configuration:

{
  "hooks": {
    "post_write_code": [
      {
        "command": "semgrep mcp -k post-tool-cli-scan -a windsurf",
        "show_output": true
      }
    ]
  }
}

3

Restart Windsurf to apply hook configuration.

The post_write_code event fires after Cascade writes or modifies any file.

What rules does this setup use?

This integration scans with the rules enabled for your Semgrep organization through your Policies. See Rules and configuration for how this differs from the Claude Code remote plugin.

Next steps

Enterprise deployment for authentication and organization-wide rollout
Semgrep Guardian overview
Rules and configuration