Semgrep Guardian quickstart

Claude Code is the recommended Semgrep Guardian setup. It uses Semgrep’s hosted remote server and authenticates through OAuth, so you do not need a local Semgrep CLI. If you use a different coding agent, see Choose your setup.

Prerequisites

A Semgrep account
Claude Code installed (claude command)

For Windows machines: Windows Subsystem for Linux (WSL) is required. Native Windows is unsupported.

Set up Guardian

Install the plugin

Install the Guardian plugin from the Claude Marketplace:

claude plugin install semgrep@claude-plugins-official

Start a new Claude Code session:

claude

You are prompted to log in to Semgrep through your browser. This is a one-time login; Semgrep refreshes access tokens automatically, so you rarely need to sign in again.

This integration uses Claude Code hooks and plugins. By default it uses Semgrep’s hosted remote server, so you don’t need to install the Semgrep CLI locally.

Next steps

Claude Code setup for the local plugin option and more detail
Rules and configuration for which rules Guardian scans with
Authentication for credential details and how to switch accounts
Deploy across your organization for fleet-wide rollout