Information
## API
### Tools
Enable LLMs to perform actions, make deterministic computations, and interact with external services.
#### Scan Code
- \`security_check\`: Scan code for security vulnerabilities
- \`semgrep_scan\`: Scan code files for security vulnerabilities with a given config string
- \`semgrep_scan_with_custom_rule\`: Scan code files using a custom Semgrep rule
#### Understand Code
- \`get_abstract_syntax_tree\`: Output the Abstract Syntax Tree (AST) of code
#### Cloud Platform (login and Semgrep token required)
- \`semgrep_findings\`: Fetch Semgrep findings from the Semgrep AppSec Platform API
#### Meta
- \`supported_languages\`: Return the list of languages Semgrep supports
- \`semgrep_rule_schema\`: Fetches the latest semgrep rule JSON Schema
### Prompts
Reusable prompts to standardize common LLM interactions.
- \`write_custom_semgrep_rule\`: Return a prompt to help write a Semgrep rule
### Resources
Expose data and content to LLMs
- \`semgrep://rule/schema\`: Specification of the Semgrep rule YAML syntax using JSON schema
- \`semgrep://rule/\{rule_id\}/yaml\`: Full Semgrep rule in YAML format from the Semgrep registry
## Usage
This Python package is published to PyPI as [semgrep-mcp](https://pypi.org/p/semgrep-mcp) and can be installed and run with [pip](https://packaging.python.org/en/latest/guides/installing-using-pip-and-virtual-environments/#install-a-package), [pipx](https://pipx.pypa.io/), [uv](https://docs.astral.sh/uv/), [poetry](https://python-poetry.org/), or any Python package manager.
\`\`\`text
$ pipx install semgrep-mcp
$ semgrep-mcp --help
Usage: semgrep-mcp [OPTIONS]
Entry point for the MCP server
Supports both stdio and sse transports. For stdio, it will read from stdin
and write to stdout. For sse, it will start an HTTP server on port 8000.
Options:
-v, --version Show version and exit.
-t, --transport [stdio|sse] Transport protocol to use (stdio or sse)
-h, --help Show this message and exit.
\`\`\`
### Standard Input/Output (stdio)
The stdio transport enables communication through standard input and output streams. This is particularly useful for local integrations and command-line tools. See the [spec](https://modelcontextprotocol.io/docs/concepts/transports#built-in-transport-types) for more details.
#### Python
\`\`\`bash
semgrep-mcp
\`\`\`
By default, the Python package will run in \`stdio\` mode. Because it's using the standard input and output streams, it will look like the tool is hanging without any output, but this is expected.
#### Docker
This server is published to Github's Container Registry ([ghcr.io/semgrep/mcp](http://ghcr.io/semgrep/mcp))
\`\`\`
docker run -i --rm ghcr.io/semgrep/mcp -t stdio
\`\`\`
By default, the Docker container is in \`SSE\` mode, so you will have to include \`-t stdio\` after the image name and run with \`-i\` to run in [interactive](https://docs.docker.com/reference/cli/docker/container/run/#interactive) mode.
### Streamable HTTP
Streamable HTTP enables streaming responses over JSON RPC via HTTP POST requests. See the [spec](https://modelcontextprotocol.io/specification/draft/basic/transports#streamable-http) for more details.
By default, the server listens on [127.0.0.1:8000/mcp](https://127.0.0.1/mcp) for client connections. To change any of this, set [FASTMCP\_\*](https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/fastmcp/server.py#L78) environment variables. _The server must be running for clients to connect to it._
#### Python
\`\`\`bash
semgrep-mcp -t streamable-http
\`\`\`
By default, the Python package will run in \`stdio\` mode, so you will have to include \`-t streamable-http\`.
#### Docker
\`\`\`
docker run -p 8000:0000 ghcr.io/semgrep/mcp
\`\`\`
### Server-sent events (SSE)
> [!WARNING]
> The MCP communiity considers this a legacy transport portcol and is really intended for backwards compatibility. [Streamable HTTP](#streamable-http) is the recommended replacement.
SSE transport enables server-to-client streaming with Server-Send Events for client-to-server and server-to-client communication. See the [spec](https://modelcontextprotocol.io/docs/concepts/transports#server-sent-events-sse) for more details.
By default, the server listens on [127.0.0.1:8000/sse](https://127.0.0.1/sse) for client connections. To change any of this, set [FASTMCP\_\*](https://github.com/modelcontextprotocol/python-sdk/blob/main/src/mcp/server/fastmcp/server.py#L78) environment variables. _The server must be running for clients to connect to it._
#### Python
\`\`\`bash
semgrep-mcp -t sse
\`\`\`
By default, the Python package will run in \`stdio\` mode, so you will have to include \`-t sse\`.
#### Docker
\`\`\`
docker run -p 8000:0000 ghcr.io/semgrep/mcp -t sse
\`\`\`
## Semgrep AppSec Platform
Optionally, to connect to Semgrep AppSec Platform:
1. [Login](https://semgrep.dev/login/) or sign up
1. Generate a token from [Settings](https://semgrep.dev/orgs/-/settings/tokens/api)
1. Add the token to your environment variables:
- CLI (\`export SEMGREP_APP_TOKEN=