semgrep/semgrep
by Various
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
MCP
semgrep/semgrep
Added 27 Sept 2026
Overview
Lightweight static analysis for many languages. Finds bug variants by matching patterns that look like source code.
Best for
Best for
Developers who want fast, pattern-based static analysis across multiple languages.
Use cases
- Scan code for security vulnerabilities
- Find bug variants across a codebase
- Enforce custom coding patterns
How to use
Tested with
Claude Desktop, Claude Code, Cursor, Windsurf, VS Code
Notes
Lightweight static analysis for many languages. Finds bug variants by matching patterns that look like source code.
16,778 stars on GitHub. Last updated 2026-09-25. Licensed LGPL-2.1.
Use cases
- Scan code for security vulnerabilities
- Find bug variants across a codebase
- Enforce custom coding patterns
Pros
- Lightweight and fast
- Supports many languages
- Patterns are readable as source code
Cons
- Requires writing custom rules for specific bugs
- Pattern matching may miss context-dependent issues
- Not a substitute for deep semantic analysis
Indexed from awesome-mcp-servers-punkpeye and enriched against its public facts.
Pros
- Lightweight and fast
- Supports many languages
- Patterns are readable as source code
Cons
- Requires writing custom rules for specific bugs
- Pattern matching may miss context-dependent issues
- Not a substitute for deep semantic analysis
Open-source & AI alternatives
Swap-in tools that solve the same job. Weigh the trade-offs before you commit.
Pairs with
Other entries in the index that connect to this one. Click through to see the chain.
idosal/git-mcp
Various
Put an end to code hallucinations! GitMCP is a free, open-source, remote MCP server for any GitHub project
kucherenko/jscpd
Various
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
repowise-dev/repowise
Various
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
mariocandela/beelzebub
Various
A secure low code deception runtime framework, leveraging AI for System Virtualization.
safedep/vet
Various
Protect against malicious open source packages 🤖
toan203/osv-ui
Various
A beautiful, zero-config visual CVE dashboard for npm & Python. One command: npx osv-ui. 100% Local & Secure.
timescale/rsigma
Various
A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:
nh4ttruong/secobserve-mcp
Various
MCP server for SecObserve: triage vulnerability findings, manage products and rules, import scan reports and SBOMs, generate VEX documents
Get the free Developer’s Field Guide
A 27-page field guide to the AI coding workflow with Claude. Claude Code, MCP servers, the prompt patterns that work, and what to delegate. Free.
Enter your work email. We send it straight over, plus a few short notes worth knowing. Unsubscribe any time.