Language:JapaneseEnglish

semgrep Claude Code Plugin

Category
Security
Topics
Security, Auth & Compliance · Claude Code Customization & Workflow · Code Quality, Review & Testing
First cataloged
2026-07-09 (UTC)
Explanation last updated
2026-09-13 (UTC)
Source (GitHub) last updated
2026-10-12 (UTC) (3 days ago)

The explanation below is AI-generated. Please verify it against the sources.

This plugin, called Semgrep Guardian, is a Claude Code extension that automatically scans code an AI agent writes and flags security problems before that code is committed. According to the README, it bundles an MCP server together with hook scripts so that every file written by the agent triggers a scan covering static code analysis, open-source dependency issues, and hardcoded secret detection. When a scan finds a problem, the agent is instructed to rewrite the code until the scan comes back clean or the finding is dismissed. Using it requires signing in to a Semgrep account, since the MCP server retrieves findings and project data from the Semgrep backend. The homepage source describes the broader Semgrep product line, which offers SAST, software composition analysis, and secrets scanning as part of a hosted application security platform, though most of those platform-wide features are outside what this specific plugin document describes in detail.

About the service

Semgrep is a hosted application security platform that performs static code analysis, open-source dependency scanning, and secrets detection; this plugin connects to that platform's backend through Semgrep's MCP server after the user signs in, so scan results and project data are retrieved from the Semgrep service rather than processed entirely offline.

What you can do with semgrep

  • Install the plugin from within Claude Code's plugin manager under the Discover section
  • Sign in to a Semgrep account to activate the bundled MCP server and begin onboarding
  • Have every file the agent writes automatically scanned via hooks for vulnerabilities, malicious dependency packages, and hardcoded secrets
  • Let the agent query Semgrep findings and project information directly through MCP tools instead of leaving the terminal
  • Prompt the agent to regenerate flagged code until the scan is clean, or dismiss a finding manually
  • Follow the project's documented rollout process to standardize Guardian across a team via MDM or enterprise agent controls

Sources

Back to list