Customize Semgrep Multimodal

Documentation Index

Fetch the complete documentation index at: https://docs.semgrep.dev/llms.txt

Use this file to discover all available pages before exploring further.

​

Remediation

Multimodal Suggested fix allows you to receive AI-generated code snippets for true positives. Perform the following to enable it:

​

Weekly priority emails

Weekly priority emails allows organization admins to receive information on top backlog tasks according to Multimodal. If this feature isn’t enabled for your deployment, you can do so as follows:

​

Noise filtering

Multimodal is over 95% accurate in categorizing Semgrep Code findings as false positives, so you can minimize the number of findings shown by enabling Noise filter for Code PR/MR comments. To do so: Findings filtered out by Multimodal can be reviewed at any time in Semgrep by going to the Code > Pre-production backlog page. Semgrep also allows you to agree with the filtering to close the finding or disagree to reopen.

​

Add Memories

Memories allow admins to tailor Multimodal’s remediation guidance to their organization’s standards and defaults. You can provide feedback by adding custom instructions whenever Multimodal gives a suggested fix. Memories are enabled by default for all organizations with Multimodal enabled.

​

Add a memory

See Best practices for writing Memories for information on writing effective memories.

​

Add a memory based on Multimodal’s suggested fix

To add a memory based on a suggested fix presented by Multimodal: Memories are scoped to remediation guidance on a per-project, per-vulnerability class, or per-rule basis. A saved memory only affects future guidance for findings triggered by the same rule in the same project.

​

Add memory during triage and receive memory suggestions from Multimodal

When you identify findings that are safe to ignore and provide reasoning for your actions, Semgrep Multimodal can use this triage feedback to suggest memories. It can start suggesting memories from the very first triage feedback it receives, or it may suggest memories from multiple pieces of feedback, depending on the level of detail in the feedback and the finding’s unique context. If Multimodal creates a new memory, it will use the memory to assess if similar findings are safe to ignore and hide from developers. To triage and create a memory (Semgrep automatically attempts to create a memory during triage if possible): Permissions:

• Automatic generation of memories: if you are an admin user, Multimodal tries to generate active memories from your triage feedback.
• If you are a non-admin user, such as a manager, Multimodal creates a suggested memory that needs an admin to activate it.

​

View and edit memories

There are two tabs on the Memories page for your review:

• The Active tab displays a list of memories that Multimodal is actively using to generate triage advice
• The Suggested tab displays a list of memories Multimodal has generated based on past triage actions and developer feedback. For each suggestion, you can:
  • Activate the suggested memory to inform Multimodal’s advice on current and future findings
  • Edit the memory, then activate it
  • Delete the suggested memory

Only users assigned the admin role in Semgrep can activate suggested memories.

​

Remove memories

​

Select your AI provider

By default, Semgrep Multimodal uses OpenAI and AWS Bedrock with Semgrep’s API keys. Semgrep evaluates available models from multiple providers and selects the most performant option for each Multimodal feature, based on the providers enabled for your organization. For optimal results, keep both OpenAI and AWS Bedrock enabled. Enabling additional model providers can further improve performance. You can opt to:

• Use OpenAI with your own API key
• Use your own AWS Bedrock account
• Use Azure OpenAI
• Use Google Gemini.
• Use xAI.

​

OpenAI API with your own key

If you want complete control over how OpenAI handles your data, you can use your OpenAI API key instead of Semgrep’s. To provide your OpenAI API key: Click Save to proceed. By switching from Semgrep’s key to your key, note that you lose access to the following:

• Semgrep’s fine-tuned models that can increase the quality of results.
• Semgrep’s Zero Data Retention agreement that prevents OpenAI from saving input or output data.
• Semgrep paying for the cost of your AI usage.

​

Your own AWS Bedrock account

If you want to keep all data within your AWS account, you can use your own AWS Bedrock instance: Note that the IAM role that is being used must have access to the AmazonBedrockLimitedAccess AWS IAM Permissions preset. Semgrep constantly evaluates new models for Multimodal features and frequently swaps out requested models, so it is recommended to always have the most recent models in Bedrock enabled. Currently, Multimodal is using the model ARN us.anthropic.claude-sonnet-4-20250514-v1:0

​

Azure OpenAI

To use Azure OpenAI with Semgrep Multimodal, you must retrieve the endpoint URL and API key for your model from Azure, then provide it to Semgrep.

1. To retrieve the endpoint URL and API key from Azure:
   1. Log in to Azure OpenAI Studio.
   2. Navigate to Deployments, and select the deployment you want to use.
   3. In Endpoint, find and copy both the Target URI and the API key. You will provide both values to Semgrep.
2. To configure Semgrep to use Azure OpenAI:
   1. Sign in to Semgrep AppSec Platform and navigate to Settings > Global.
   2. Click the icon next to AI provider.
   3. Select Azure OpenAI.
   4. Paste the Target URI you copied from Azure into Your Azure OpenAI Endpoint.
   5. Paste the API key you copied from Azure into Your Azure OpenAI API key.
   6. Click Save to proceed.

​

Google Gemini

To use Google Gemini with Semgrep Multimodal:

Semgrep Multimodal only supports Google Gemini with Google AI Studio, not Vertex AI.

​

xAI

To use xAI with Semgrep Multimodal, you must retrieve the endpoint URL and API key from xAI, then provide it to Semgrep.