SSemgrep MCP (official)

Tested PyPI semgrep 1.185.0 (LGPL-2.1-or-later; repo semgrep/semgrep, 17,601 GitHub stars when checked) through `semgrep mcp`, the command Semgrep's docs give for local scanning; the server reports itself as Semgrep 1.29.0. Stdio, 7 tools, no account. Real calls: semgrep_scan_with_custom_rule ran our one-line no-eval rule over a small inline Express snippet and returned the finding on line 3; get_abstract_syntax_tree returned the AST for a Python expression. get_supported_languages is counted as a self-check. semgrep_findings and the supply-chain scan need a Semgrep account or token and were not called. On start it printed 'Tracing initialized' with an app.datadoghq.com trace link, so tracing appears to be on by default; we did not inspect its network traffic.
Tool-call test (2026-11-11, direct MCP stdio client, no LLM): pass. 2 of 2 function calls passed (plus 1 self-check). Account tools (findings, supply chain) not tested. Evidence: local test run, Nov 11, 2026.

Transport (tested 2026-11-11): stdio

Score 88/100 · Tools 7 · Token cost approx. 1,506 tokens · Compare · Last tested 2026-11-11 · Version tested 1.185.0 · Package semgrep · Repo semgrep/semgrep

Summary: Semgrep MCP (official) completed an MCP handshake without credentials and exposed 7 tools.

Evidence summary

Handshake

pass

Tools listed

7

Context cost

approx. 1506 tokens, cl100k estimate (7 tools, measured 2026-11-11, version 1.185.0; an estimate) ranking · add up your servers' context cost

API key

No key needed for the tools we called

Tested

2026-11-11

Test results

Local-model readiness

Token cost (estimate): approx. 1506 tokens, cl100k estimate for 7 tools · about 18% of an 8k context. This is an estimate from our testing (counted with cl100k_base).

Small-model friendly (schema heuristic, not a model result): unknown.

What we tested and what we didn't

Methodology: how we test. A high score means it installs and responds, not that giving it access to your data carries no risk.

{
  "name": "semgrep",
  "version": "1.185.0",
  "registry": "pypi",
  "status": "working",
  "tested": "2026-11-11",
  "tools_count": 7,
  "deprecated": false,
  "archived": false,
  "tests": {
    "install": [
      "pass",
      20,
      "`uv pip install semgrep` (Python venv, Linux) succeeded in 1s."
    ],
    "handshake": [
      "pass",
      30,
      "MCP `initialize` + `tools/list` over stdio succeeded with no credentials; 7 tools listed in 3.7s."
    ],
    "maintenance": [
      "pass",
      25,
      "Repo pushed 0 days before test; 17,601 GitHub stars."
    ],
    "docs": [
      "partial",
      10,
      "README over 3,000 chars; install instructions present. Check of the package's own README (PyPI long_description (package README))."
    ],
    "license": [
      "partial",
      3,
      "License not machine-detected as OSI (LGPL-2.1-or-later)."
    ]
  }
}

Install

uvx semgrep mcpCopy

Pin the version we tested

uvx semgrep==1.185.0 mcpCopy

pip install semgrep==1.185.0Copy

tested 2026-11-11. Newer versions may differ and were not tested by us.

{
  "mcpServers": {
    "semgrep-mcp": {
      "command": "uvx",
      "args": [
        "semgrep==1.185.0",
        "mcp"
      ]
    }
  }
}

Tools listed

get_abstract_syntax_tree, get_supported_languages, semgrep_findings, semgrep_rule_schema, semgrep_scan, semgrep_scan_supply_chain, semgrep_scan_with_custom_rule

Tool history: captured Nov 11, 2026. All tool history.

Quick config

{
  "mcpServers": {
    "semgrep-mcp": {
      "command": "uvx",
      "args": [
        "semgrep",
        "mcp"
      ]
    }
  }
}

Add to config Opens the config generator with this server selected.

{
  "mcpServers": {
    "semgrep-mcp": {
      "command": "uvx",
      "args": [
        "semgrep",
        "mcp"
      ]
    }
  }
}

FAQ

Is Semgrep MCP deprecated?

No. semgrep was not deprecated or archived when we last tested it on 2026-11-11.

What replaces Semgrep MCP?

Nothing; Semgrep MCP (official) is not deprecated as of 2026-11-11.

Does Semgrep MCP need an API key?

No. It completed an MCP handshake with no credentials and listed 7 tools.

Embed the badge

Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.

Copy HTML

Copy Markdown Claim this listing · Report an issue