Enterprise DNAEnterprise DNA

MCP Servers

semgrep/semgrep

Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.

Visit site ↗

Our verdict

Not reviewed yet

We have not reviewed semgrep/semgrep yet

No one at Enterprise DNA has checked this listing against its sources. The description comes from public listings gathered automatically. Any fact below shows where it came from and when it was last checked.

How we review records

From the listing

About semgrep/semgrep

Lightweight static analysis for many languages. Finds bug variants by matching patterns that look like source code.

Best for

Developers who want fast, pattern-based static analysis across multiple languages.

Use cases

  • Scan code for security vulnerabilities
  • Find bug variants across a codebase
  • Enforce custom coding patterns

Notes

16,778 stars on GitHub. Last updated 2026-09-25. Licensed LGPL-2.1.

Pros

  • Lightweight and fast
  • Supports many languages
  • Patterns are readable as source code

Cons

  • Requires writing custom rules for specific bugs
  • Pattern matching may miss context-dependent issues
  • Not a substitute for deep semantic analysis

Key facts

What we have checked

Days since the last commit
0
Checked GitHub
GitHub forks
1,151
Checked GitHub
GitHub stars
17,515
Checked GitHub
Days to a first reply on issues
3.5
Checked GitHub
Open issues
906
Checked GitHub
Releases in the last 90 days
12
Checked GitHub

Each value shows when we last confirmed it and where it came from. Values we have not confirmed are left out, never guessed.

How to use

How to set it up

As the listing publishes it. We have not run this install.

Install

pipx install semgrep

Clients the listing names (not checked here)

Claude Desktop, Claude Code, Cursor, Windsurf, VS Code

Install

Add semgrep/semgrep to your client

Not verified yet

No install recipe yet. We write one for Claude Code, Claude Desktop, Cursor, VS Code, Codex and ChatGPT when the server is in the official MCP registry with a package or remote address we can use.

Until then, follow the project's own README, or the setup the listing publishes under How to set it up.

Works with

What semgrep/semgrep connects to

No confirmed connections yet. A product appears here when the server's registry name, repo, homepage or name ties it to that product, and a client appears when we have an install recipe for it.

Stars and usage

How semgrep/semgrep is growing

GitHub stars

17,379 to 17,515

stars. 31 Oct 2026 to 6 Nov 2026, 2 readings.

Source: GitHub. Checked .

Health and security

Is semgrep/semgrep looked after, and what do its setup files show

Health score

80 out of 100

Does someone look after this repository? It does not say the code is good or safe. Worked out from GitHub signals checked . How it is worked out

PartPointsWhat we saw
Recent activity30 of 30Last push 0 days ago
Releases15 of 1512 releases in 90 days
Issue replies19.7 of 20First reply in 3.5 days (median)
Maintainer15 of 15Owned by an organisation
Official source0 of 20Community server

Security check static checks

100 out of 100

Reads what is published about the server: package advisories, licence, secrets in the documented setup and tool permissions. Nothing is installed or run, so this is not a security assessment. Checked by edna-static-v1. What it checks

Licence: LGPL-2.1

  • Note No published npm or PyPI package of this repository was found, so package advisories were not checked.
  • Note The lab has not recorded this server's tool list yet, so tool permissions were not checked.

Alternatives

Alternatives to semgrep/semgrep

RecordTypeHow we knowChecked
82ch/MCP-DandanAlternative to thisMCP serverMatched from the listing text
Agent Permissions IndexAlternative to thisMCP serverMatched from the listing text
ajitpratap0/GoSQLXAlternative to thisMCP serverNamed in the listingNot dated
alexar76/wardenAlternative to thisMCP serverNamed in the listingNot dated
cqfn/aibolit-mcp-serverAlternative to thisMCP serverNamed in the listingNot dated
Disentinel/grafemaAlternative to thisMCP serverNamed in the listingNot dated
duriantaco/skylosAlternative to thisMCP serverNamed in the listingNot dated
gaoharimran29-glitch/Cybersecurity-MCP-ServerAlternative to thisMCP serverNamed in the listingNot dated

Compare

Compare semgrep/semgrep side by side

Sources

Where this comes from

  • GitHubRegistry

    Checked · Days since the last commit, GitHub forks, GitHub stars, Days to a first reply on issues, Open issues, Releases in the last 90 days

A source shows what was published when we checked it. It does not certify security, performance or a working installation. Read our method.

Changelog

What changed

No changes recorded yet. Releases, price changes and deprecations appear here, with their dates, once we track them for this record.

Open-source & AI alternatives

Swap-in tools that solve the same job. Weigh the trade-offs before you commit.

Alternatives8 entries
MMCPlowCatalogue

82ch/MCP-Dandan

Various

MCP Security Solution for Agentic AI — real-time proxying, behavior analysis, and malicious tool detection

★ 63
MMCPCatalogue

Agent Permissions Index

agent-permissions-index

Free public remote MCP server: grade your agent config, get index stats and the agent safety leaderboard from Claude Code, Cursor or Codex.

MMCPlowCatalogue

ajitpratap0/GoSQLX

Various

High-performance SQL parser, formatter, linter & security scanner for Go - 1.5M+ ops/sec, multi-dialect, zero-copy, race-free

★ 97
MMCPlowCatalogue

alexar76/warden

Various

WARDEN — MCP security firewall: vets an MCP server's tool definitions against static-scan rules, a signed threat feed, origin and tool-def pinning before any tool reaches the model

★ 0
MMCPlowCatalogue

cqfn/aibolit-mcp-server

Various

MCP Server for Aibolit Java Static Analyzer: Helping Your AI Agent Identify Hotspots for Refactoring

★ 26
MMCPlowCatalogue

Disentinel/grafema

Various

Graph-based static analysis tool

★ 35
MMCPlowCatalogue

duriantaco/skylos

Various

Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantac

★ 446
MMCPlowCatalogue

gaoharimran29-glitch/Cybersecurity-MCP-Server

Various

An Open Sourced Model Context Protocol (MCP) Local server that gives Claude real-time cybersecurity reconnaissance capabilities

★ 5

Pairs with

Other entries in the index that connect to this one. Click through to see the chain.

Pairs with12 entries
MMCPlowCatalogue

26zl/cybersec-toolkit

Various

One command installs 670+ security tools on Linux & Termux. Its authorization-gated MCP server works with Claude Code, OpenCode, Codex, Gemini CLI, Ollama-backed agents and other M

★ 56
MMCPlowCatalogue

82ch/MCP-Dandan

Various

MCP Security Solution for Agentic AI — real-time proxying, behavior analysis, and malicious tool detection

★ 63
MMCPlowCatalogue

AIops-tools/Compliance-AIops

Various

Governed compliance evidence from AIops audit trails: HIPAA/PCI-DSS/SOC2/GDPR, hash-chain-sealed, 15 MCP tools (preview)

★ 0
MMCPlowCatalogue

airblackbox/air-blackbox-mcp

Various

MCP server for AIR Blackbox. Expose audit, replay, scan, and compliance tools to any MCP-compatible agent or IDE.

★ 1
MMCPlowCatalogue

akramIOT/MCP_AI_SOC_Sher

Various

AI SOC Security Threat analysis using MCP Server

★ 9
MMCPlowCatalogue

alberthild/shieldapi-mcp

Various

MCP server for ShieldAPI — URL scanning, breach detection, domain/IP reputation as AI agent tools. Pay-per-request via x402.

★ 0
MMCPlowCatalogue

andypgray/resharper-cli-mcp

Various

MCP server wrapping JetBrains' ReSharper CLI for headless C# inspection and code cleanup for coding agents. Unofficial, not affiliated with JetBrains.

★ 0
MMCPlowCatalogue

appcreationsca/bumpguard-mcp

Various

Guard your dependency bumps: an MCP server that tells your AI agent which parts of YOUR code break when you upgrade a dependency, and verifies AI-written code against the installed

★ 0
MMCPlowCatalogue

ark-forge/mcp-eu-ai-act

Various

MCP EU AI Act Compliance Scanner - Open source tool to detect EU AI Act violations in codebases

★ 8
MMCPlowCatalogue

astafford8488/agentaegis-mcp

Various

MCP server for cybersecurity operations — compliance, vuln scans, code security, threat intel. Pay-per-use via x402.

★ 0
MMCPlowCatalogue

azer/react-analyzer-mcp

Various

MCP server for analyzing & generating docs for React code locally

★ 57
MMCPlowCatalogue

boy-offi9-inc/hexforge-gateway

Various

Self-hosted reverse-engineering workspace API — orchestrates jadx/apktool/adb/frida/APKiD via a job & workflow engine, exposed as native MCP tools for Claude. No cloud required.

★ 3
Free 27-page guide

Get the free Developer’s Field Guide

A 27-page field guide to the AI coding workflow with Claude. Claude Code, MCP servers, the prompt patterns that work, and what to delegate. Free.

Enter your work email. We send it straight over, plus a few short notes worth knowing. Unsubscribe any time.

No spam. Unsubscribe any time.

← Back to MCP ServersSubmit your own entry →