create_rule turns a convention that Semgrep ships no rule for — a project's z-index layering, an import you have deprecated — into something you can actually scan against. compare_results then puts two scans side by side, so confirming a fix removed the finding is a call rather than a second read-through of both reports.
A Node server that drives the Semgrep static-analysis CLI: it scans a directory inside the roots you allow it, then gives you tools to read, narrow, compare and export the findings.
- A Semgrep scan of any directory inside your allowed workspace roots
- The rules and languages your Semgrep install supports, listed on request
- The findings explained rather than handed over as raw scan output
- Findings narrowed to what you asked for — only the SQL injection results, say
- Custom rules written from a description: arbitrary z-index values, imports from a deprecated library, magic numbers
- Results exported in other formats to hand to a ticket or a review
- Two result sets compared, so a before-and-after check is one call
Node.js v18 or newer, plus the semgrep CLI installed separately — pip, Homebrew, npm and apt-get all work, and the install checks for it. Set MCP_SERVER_SEMGREP_ALLOWED_ROOTS to the absolute directories the server may read and write; without it the only allowed root is the process working directory, which is rarely your project when a desktop client launches the server. SEMGREP_APP_TOKEN is optional for a local shell that already ran semgrep login, and the recommended route for desktop, container and CI launches.
One command plus a key — npm install -g mcp-server-semgrep, then supply credentials