Overview

The Semgrep MCP (Model Context Protocol) server is a long-running analysis backend used by Semgrep to run fast, pattern-based static analysis across many programming languages. Instead of spawning a fresh parser and matcher for each file, the MCP server keeps language frontends and rule sets initialized in memory and accepts requests from clients (CLIs, editors, CI runners). This reduces startup overhead and enables low-latency, repeated analysis of large codebases or interactive workflows.

MCP is designed for pattern-oriented matching: rules look like the source code you write, and the server returns structured findings that include locations, matched snippets, and metadata. Because the server is language-aware it supports the same multilanguage capabilities as Semgrep (C, Java, JavaScript/TypeScript, Python, Go, Ruby, R, and many others), while making integrations—editor extensions, CI services, and custom automation—more efficient and scalable.

Features

Persistent, low-latency analysis: keep parsers and matchers warm to speed repeated queries.
Multilanguage support: reuse Semgrep’s language frontends for dozens of languages.
Pattern-based matching: rules use source-like patterns (no heavy DSL to learn).
Structured JSON output: findings are returned in machine-friendly formats for downstream tooling.
Extensible integration points: common in editor plugins, CI/CD, and CI cache strategies.
Lightweight deployment: runs as a local process or service; can be containerized.

Installation / Configuration

Install Semgrep (required runtime)

# Recommended: Python pip
python3 -m pip install --upgrade semgrep

# Or with Homebrew on macOS
brew install semgrep

# Or use the official Docker image
docker pull ghcr.io/semgrep/semgrep:develop

Run the MCP server (example) The MCP server is exposed from the Semgrep package. Example commands below show common invocation patterns; check the version you installed and the repository README for exact flags.

Run as a local process (TCP listener example):

# Example: run MCP server listening on localhost:5000 (adjust per your build)
python3 -m semgrep.mcp.server --listen tcp://127.0.0.1:5000

Run with a Unix domain socket:

python3 -m semgrep.mcp.server --listen unix:/tmp/semgrep-mcp.sock

Run in Docker (example using the Semgrep image):

docker run --rm -p 5000:5000 ghcr.io/semgrep/semgrep:develop \
  python3 -m semgrep.mcp.server --listen tcp://0.0.0.0:5000

Point a client to the MCP

Semgrep MCP Server: Pattern-Based Multilanguage Static Analysis