Language:JapaneseEnglish

semgrep Claude Code Plugin

Category
Security
Topics
Security, Auth & Compliance · Claude Code Customization & Workflow · Code Quality, Review & Testing
First cataloged
2026-07-09 (UTC)
Explanation last updated
2026-09-02 (UTC)
Source (GitHub) last updated
2026-09-03 (UTC) (2 days ago)

The explanation below is AI-generated. Please verify it against the sources.

This plugin, called Semgrep Guardian, is a Claude Code plugin that scans code an AI agent generates and flags security vulnerabilities, malicious packages, and hardcoded secrets before that code is committed or pushed. According to the README, it bundles a Semgrep MCP server together with hooks so that every file Claude writes is checked using Semgrep's Code, Supply Chain, and Secrets analysis. When a scan finds an issue, Claude is instructed to rewrite the code until the scan comes back clean or the finding is manually dismissed. Using it requires signing in to a Semgrep account, since the MCP server pulls scan results and project data from the Semgrep service. The README also notes that teams can roll the plugin out broadly through MDM or their coding agent's enterprise controls.

About the service

Semgrep is a cloud-based application security platform offering static application security testing (SAST), software composition analysis (SCA) for open-source dependencies, and secrets detection. Per the homepage, it combines rule-based static analysis with AI reasoning to detect, prioritize, and help remediate vulnerabilities, and it integrates with CI/CD systems, IDEs, and pull-request workflows such as GitHub, GitLab, and Bitbucket. The Guardian plugin connects to this platform through a Semgrep MCP server, requiring account login to retrieve findings and project information.

What you can do with semgrep

  • Install the plugin from within Claude Code's plugin discovery interface and reload it to activate
  • Log in to a Semgrep account to enable the MCP server and start onboarding
  • Have every file written by the coding agent automatically scanned for vulnerabilities, malicious dependencies, and hardcoded secrets
  • Get the agent prompted to regenerate flagged code until the scan is clean, or choose to dismiss a finding
  • Query Semgrep project and supply-chain finding details (severity, issue, location) directly through the MCP server without leaving the terminal
  • Roll the plugin out to a whole team using MDM or the coding agent's built-in enterprise security controls

Sources

Back to list