Language:JapaneseEnglish

semgrep Claude Code Plugin

Category
Security
Topics
Security, Auth & Compliance · Claude Code Customization & Workflow · Code Quality, Review & Testing
License
Not stated
Version
2.7.0
First cataloged
2026-07-09 (UTC)
Explanation last updated
2026-10-15 (UTC)
Source (GitHub) last updated
2026-10-22 (UTC) (13 days ago)

The explanation below is AI-generated. Please verify it against the sources.

The semgrep plugin, called Semgrep Guardian, connects Claude Code to Semgrep's security scanning so that vulnerabilities, hardcoded secrets, and malicious open-source packages in agent-written code are caught before they are pushed. According to the README, it bundles an MCP server with lifecycle hooks: the hooks fire on every file write and trigger scans using Semgrep Code, Supply Chain, and Secrets, while the MCP server lets the agent pull existing findings and project data directly. When a scan turns up an issue, the coding agent is prompted to regenerate the code until results come back clean or the finding is dismissed. Setup involves installing the plugin from within Claude Code and logging into a Semgrep account to complete onboarding. The plugin communicates with several Semgrep endpoints for scanning, account/login handling, and telemetry, and the telemetry and auto-update behavior can be turned off through local configuration.

About the service

Semgrep is an application security platform offering static application security testing (SAST), software composition analysis (SCA), and secrets detection. Per the homepage, it also provides a rules registry, an online playground, and a dashboard for reviewing findings, and its use requires a Semgrep account.

What you can do with semgrep

  • Automatically scan newly written or edited files for code vulnerabilities, supply-chain issues, and hardcoded secrets
  • Have Claude Code regenerate flagged code until a scan comes back clean or the finding is dismissed
  • Query Semgrep projects and existing findings directly through MCP tools without leaving the terminal
  • Disable telemetry reporting or background auto-updates through local configuration settings
  • Roll the plugin out across a team using MDM or an agent's enterprise management controls

Sources

Back to list