Which AI clients can use the Semgrep MCP server?

27 AI clients, including Cursor, VS Code, and Claude. Each connects to Semgrep as a remote MCP server through Runlayer, which adds identity, policy, scanning, and audit to every call.

Which Semgrep tools are available?

Semgrep reports its tools when your organization connects it. Admins then choose which ones each group can call.

How does Semgrep authenticate?

An admin adds Semgrep credentials to Runlayer once. They never sit in the client’s configuration.

Integrations / MCP servers

Semgrep

Scan code for security vulnerabilities with Semgrep's hosted rules.

Book a demo View documentation

Tools

Tools discovered when you connect

Search the tool definitions captured from the MCP server. The live list can vary with version, deployment, and credentials.

Tools load when your organization connects this server

Semgrep can expose tools based on its deployed version and credentials. Runlayer discovers the available list when your organization connects the server.

Compatibility

Connect Semgrep to the clients your teams already use

27 AI clients can connect to Semgrep through Runlayer. Pick one for its setup steps and controls.

Why Runlayer

Why connect Semgrep through Runlayer?

One approved path

Approve Semgrep once and everyone gets it in the AI clients they already use. Runlayer holds the credentials, so nothing sits in client configuration.

Fine-grained policy

Control who can use each server, tool, and resource, and under which runtime conditions.

Runtime security

Scan tool inputs and outputs for prompt injection, credential exposure, PII, and data exfiltration, then alert, mask, or block.

Audit and observability

Trace every request across users, clients, tools, policies, scanner decisions, and downstream systems.