semgrep Claude Code Plugin
Claude Code PluginClaude CodeSecuritySecurity, Auth & ComplianceClaude Code Customization & WorkflowThe explanation below is AI-generated. Please verify it against the sources.
This plugin, called Semgrep Guardian, adds real-time security scanning to Claude Code so that vulnerabilities, malicious packages, and hardcoded secrets are caught before generated code is committed. According to the README, it bundles a Semgrep MCP server together with hook scripts that trigger on every file write, running checks through Semgrep's Code, Supply Chain, and Secrets analysis. When an issue is found, the agent is instructed to keep revising the code until the scan comes back clean or the finding is manually dismissed. Setup is done through a short sequence of Claude Code commands, including adding the marketplace, installing the plugin, reloading, and logging into a Semgrep account. The broader Semgrep product, described on its homepage, is a cloud-based application security platform combining static analysis, dependency scanning, and secrets detection with AI-assisted triage and remediation.
About the service
Semgrep is a hosted application security platform (SAST, software composition analysis, and secrets detection) that Claude Code connects to via login in order to send scan requests and retrieve findings through the bundled MCP server.
What you can do with semgrep
- Install the Semgrep Guardian plugin into Claude Code via marketplace commands
- Automatically scan every file an agent writes for vulnerabilities, malicious dependencies, and hardcoded secrets
- Have the agent regenerate flagged code until the scan passes, or manually dismiss a finding
- Query Semgrep findings and project data directly from the agent through the bundled MCP server
- Log into a Semgrep account to enable scanning and pull deployment-level data
- Follow documented rollout guidance to standardize Guardian across a development team