Semgrep Guardian quickstart

Claude Code and Codex are the recommended Semgrep Guardian setups. Both use Semgrep’s hosted remote server and authenticate through OAuth, so you don’t need a local Semgrep CLI. If you use a different coding agent, see Choose your setup.

For Windows machines: Windows Subsystem for Linux (WSL) is required. Native Windows is unsupported.

Claude Code
Codex

Prerequisites

A Semgrep account
Claude Code installed (claude command)

Set up Guardian

Install the plugin

Install the Guardian plugin from the Claude Marketplace:

claude plugin install semgrep@claude-plugins-official

Start a new Claude Code session:

claude

You’re prompted to sign in to Semgrep through your browser. This is a one-time sign-in. Semgrep refreshes access tokens automatically, so you rarely need to sign in again.

This integration uses Claude Code hooks and plugins. By default, it uses Semgrep’s hosted remote server, so you don’t need to install the Semgrep CLI locally.

Prerequisites

A Semgrep account
Codex CLI installed (codex command)

Set up Guardian

Install the plugin

Add the Semgrep marketplace, then install the Guardian plugin from it:

codex plugin marketplace add https://github.com/semgrep/guardian --sparse .claude-plugin --sparse plugin
codex plugin add semgrep@semgrep-marketplace

Start a new Codex session

Start a new Codex session so the plugin loads:

codex

Ask Codex:

Log in to Semgrep Guardian.

Complete the sign-in prompts in your browser. This is a one-time sign-in. Semgrep refreshes access tokens automatically, so you rarely need to sign in again.

Confirm you're signed in

Ask Codex:

Who am I logged in as in Semgrep Guardian?

Codex confirms your identity and Semgrep deployment.

Verify the installation

From your terminal, run:

codex plugin list --json

By default, this integration uses Semgrep’s hosted remote server, so you don’t need to install the Semgrep CLI locally.

Next steps

Claude Code setup for the local plugin option, or Codex setup for more information
Rules and configuration for which rules Guardian scans with
Authentication for credential details and how to switch accounts
Deploy across your organization for fleet-wide deployment