Semgrep

Claude Code

1. Run this in a terminal, in your project folder:

claude mcp add --transport http semgrep https://mcp.semgrep.ai/mcp

1. Start Claude Code, type /mcp, pick semgrep and choose Authenticate. A browser window opens for the Semgrep sign-in.

Add --scope user to make it available in every project, not just this one.

Claude Desktop

1. Open Settings → Connectors and click Add custom connector.
2. Name it Semgrep and paste this URL:

https://mcp.semgrep.ai/mcp

1. Click Add, then Connect, and sign in when Semgrep asks.

Claude Desktop’s JSON config file only starts local servers. Remote servers go through Connectors, and connectors you add on claude.ai show up here too.

claude.ai

1. Open the connector form on claude.ai. This button fills in the name and URL for you:

Add to claude.ai (opens in a new tab)

1. Check that the URL reads https://mcp.semgrep.ai/mcp and click Add.
2. Click Connect and sign in when Semgrep asks.

Free plans allow one custom connector. On Team and Enterprise plans an owner adds it under Organization settings → Connectors.

ChatGPT

1. On chatgpt.com, open Settings → Security and login and turn on Developer mode.
2. Go to chatgpt.com/plugins and click + to create an app for a remote MCP server.
3. Paste https://mcp.semgrep.ai/mcp as the server URL and choose OAuth. ChatGPT sends you to Semgrep to sign in.

Developer mode is available on the web for Plus, Pro, Business, Enterprise and Education accounts.

Cursor

Add to Cursor (opens in a new tab)

Or add it by hand to ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (this project):

{
  "mcpServers": {
    "semgrep": {
      "url": "https://mcp.semgrep.ai/mcp"
    }
  }
}

Cursor shows Needs login next to the server. Click it to sign in.

VS Code

Install in VS Code (opens in a new tab)

Or from a terminal:

code --add-mcp '{"name":"semgrep","type":"http","url":"https://mcp.semgrep.ai/mcp"}'

Or commit it to the repo in .vscode/mcp.json:

{
  "servers": {
    "semgrep": {
      "type": "http",
      "url": "https://mcp.semgrep.ai/mcp"
    }
  }
}

VS Code asks you to sign in the first time the server starts.

Devin Desktop

1. Add it to ~/.config/devin/mcp_config.json (macOS and Linux) or %APPDATA%\devin\mcp_config.json (Windows):

{
  "mcpServers": {
    "semgrep": {
      "serverUrl": "https://mcp.semgrep.ai/mcp"
    }
  }
}

1. Refresh the MCP server list in Cascade and sign in when asked.

Devin Desktop is the new name for Windsurf. It reads serverUrl (or url) for remote servers.

Codex

codex mcp add semgrep --url https://mcp.semgrep.ai/mcp
codex mcp login semgrep

Or edit ~/.codex/config.toml directly:

[mcp_servers.semgrep]
url = "https://mcp.semgrep.ai/mcp"

Gemini CLI

gemini mcp add --transport http semgrep https://mcp.semgrep.ai/mcp

Then, inside Gemini CLI, run /mcp auth semgrep to sign in.

This adds it to the current project. Add -s user to use it everywhere.

Any client

Most clients accept this shape. Some name the URL field differently: serverUrl in Devin Desktop, httpUrl in Gemini CLI’s settings file.

{
  "mcpServers": {
    "semgrep": {
      "type": "http",
      "url": "https://mcp.semgrep.ai/mcp"
    }
  }
}

Zed puts servers under context_servers in its settings. Cline needs "type": "streamableHttp", or it assumes SSE.

Client only starts local servers? Bridge it with npx -y mcp-remote https://mcp.semgrep.ai/mcp.

README badge

[![Semgrep on mcp.tc](https://mcp.tc/i/semgrep/badge.svg)](https://mcp.tc/i/semgrep)

<a href="https://mcp.tc/i/semgrep"><img src="https://mcp.tc/i/semgrep/badge.svg" alt="Semgrep on mcp.tc" height="20"></a>

It follows the reader’s light or dark mode. Add ?theme=light or ?theme=dark to fix it, or ?style=compact to show the mark without the word.

Website card

<script src="https://mcp.tc/w/semgrep.js" async></script>

The card appears where the tag is. Add data-theme="dark" or data-size="compact" to the tag to change it. The file holds everything it needs, so it makes no other requests and sets no cookies.

iframe

<iframe src="https://mcp.tc/embed/semgrep" title="Semgrep on mcp.tc" width="420" height="200" loading="lazy" allow="clipboard-write" style="border:0;border-radius:8px;max-width:100%"></iframe>

Use it on pages that don’t allow scripts. Add ?theme=light or ?theme=dark to the address to fix the colors.

JSON

The listing as data for your own pages and tools: name, tagline, the server’s own URL, tools and the “Add to” links. Any site can read it (CORS is open).

https://mcp.tc/i/semgrep.json

What each field means