scan_directoryLABSCO SUMMARY
Semgrep's analysis in conversation, including writing the rule you needed.
create_rule turns a convention that Semgrep ships no rule for — a project's z-index layering, an import you have deprecated — into something you can actually scan against. compare_results then puts two scans side by side, so confirming a fix removed the finding is a call rather than a second read-through of both reports.
What it is
A Node server that drives the Semgrep static-analysis CLI: it scans a directory inside the roots you allow it, then gives you tools to read, narrow, compare and export the findings.
What you get
- A Semgrep scan of any directory inside your allowed workspace roots
- The rules and languages your Semgrep install supports, listed on request
- The findings explained rather than handed over as raw scan output
- Findings narrowed to what you asked for — only the SQL injection results, say
- Custom rules written from a description: arbitrary z-index values, imports from a deprecated library, magic numbers
- Results exported in other formats to hand to a ticket or a review
- Two result sets compared, so a before-and-after check is one call
Requirements
Node.js v18 or newer, plus the semgrep CLI installed separately — pip, Homebrew, npm and apt-get all work, and the install checks for it. Set MCP_SERVER_SEMGREP_ALLOWED_ROOTS to the absolute directories the server may read and write; without it the only allowed root is the process working directory, which is rarely your project when a desktop client launches the server. SEMGREP_APP_TOKEN is optional for a local shell that already ran semgrep login, and the recommended route for desktop, container and CI launches.
Setup effort
Build from source — git clone https://github.com/vetcoders/mcp-server-semgrep.git
USE CASES
01
Checking a service for security issues before it ships
Scan the directory, then narrow the findings to the class you care about instead of reading the whole report.
02
Confirming a fix actually removed the finding
Scan again after the change and compare the two result sets rather than diffing two reports by eye.
03
Enforcing a convention Semgrep has no rule for
Describe the pattern — magic numbers, a deprecated import — and get a rule you can run against the project.
04
Working out what a scan actually found
Get the findings explained, and check which rules and languages your Semgrep install covers.
05
Handing findings to someone not in the conversation
Export the result set in another format to attach to a ticket or a code review.
7 tools
Listed in project docs. Your client may show a different list.
list_rulesanalyze_resultscreate_rulefilter_resultsexport_resultscompare_resultsBEFORE YOU INSTALL
What to know first
Tools you get
7 tools named in the project's documentation.
Requires
- Node.js v18+
- The semgrep CLI, installed separately (pip install semgrep, brew install semgrep, or npm install -g semgrep)
Where it runs
The documented client runs the server on your machine.
INSTALLATION
Connect your client
You clone and build this one yourself.
Server setup
TERMINAL
git clone https://github.com/vetcoders/mcp-server-semgrep.git
cd mcp-server-semgrep
npm install
npm run buildMCP Clients
Claude Desktop
CLAUDE DESKTOP · JSON
{
"mcpServers": {
"semgrep": {
"command": "node",
"args": [
"<YOUR_PATH_TO_MCP_SERVER_SEMGREP>/build/index.js"
],
"env": {
"SEMGREP_APP_TOKEN": "<YOUR_SEMGREP_APP_TOKEN>",
"MCP_SERVER_SEMGREP_ALLOWED_ROOTS": "/Users/<YOUR_USERNAME>/projects"
}
}
}
}<YOUR_PATH_TO_MCP_SERVER_SEMGREP> is the full path to the mcp-server-semgrep folder you cloned. Set MCP_SERVER_SEMGREP_ALLOWED_ROOTS to the absolute directories the server may scan. SEMGREP_APP_TOKEN is optional if your account already ran semgrep login, and recommended for Claude Desktop.
