semgrep/semgrep
by Various
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
MCP
semgrep/semgrep
Added 27 Sept 2026
Overview
Lightweight static analysis for many languages. Finds bug variants by matching patterns that look like source code.
Best for
Best for
Developers who want fast, pattern-based static analysis across multiple languages.
Use cases
- Scan code for security vulnerabilities
- Find bug variants across a codebase
- Enforce custom coding patterns
How to use
Clients listed in this record (not verified here)
Claude Desktop, Claude Code, Cursor, Windsurf, VS Code
Notes
16,778 stars on GitHub. Last updated 2026-09-25. Licensed LGPL-2.1.
Pros
- Lightweight and fast
- Supports many languages
- Patterns are readable as source code
Cons
- Requires writing custom rules for specific bugs
- Pattern matching may miss context-dependent issues
- Not a substitute for deep semantic analysis
Open-source & AI alternatives
Swap-in tools that solve the same job. Weigh the trade-offs before you commit.
ajitpratap0/GoSQLX
Various
High-performance SQL parser, formatter, linter & security scanner for Go - 1.5M+ ops/sec, multi-dialect, zero-copy, race-free
cqfn/aibolit-mcp-server
Various
MCP Server for Aibolit Java Static Analyzer: Helping Your AI Agent Identify Hotspots for Refactoring
Disentinel/grafema
Various
Graph-based static analysis tool
duriantaco/skylos
Various
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantac
gaoharimran29-glitch/Cybersecurity-MCP-Server
Various
An Open Sourced Model Context Protocol (MCP) Local server that gives Claude real-time cybersecurity reconnaissance capabilities
Pairs with
Other entries in the index that connect to this one. Click through to see the chain.
idosal/git-mcp
Various
Put an end to code hallucinations! GitMCP is a free, open-source, remote MCP server for any GitHub project
kucherenko/jscpd
Various
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
repowise-dev/repowise
Various
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
26zl/cybersec-toolkit
Various
One command installs 670+ security tools on Linux & Termux. Its authorization-gated MCP server works with Claude Code, OpenCode, Codex, Gemini CLI, Ollama-backed agents and other M
82ch/MCP-Dandan
Various
MCP Security Solution for Agentic AI — real-time proxying, behavior analysis, and malicious tool detection
AIops-tools/Compliance-AIops
Various
Governed compliance evidence from AIops audit trails: HIPAA/PCI-DSS/SOC2/GDPR, hash-chain-sealed, 15 MCP tools (preview)
airblackbox/air-blackbox-mcp
Various
MCP server for AIR Blackbox. Expose audit, replay, scan, and compliance tools to any MCP-compatible agent or IDE.
akramIOT/MCP_AI_SOC_Sher
Various
AI SOC Security Threat analysis using MCP Server
alberthild/shieldapi-mcp
Various
MCP server for ShieldAPI — URL scanning, breach detection, domain/IP reputation as AI agent tools. Pay-per-request via x402.
appcreationsca/bumpguard-mcp
Various
Guard your dependency bumps: an MCP server that tells your AI agent which parts of YOUR code break when you upgrade a dependency, and verifies AI-written code against the installed
ark-forge/mcp-eu-ai-act
Various
MCP EU AI Act Compliance Scanner - Open source tool to detect EU AI Act violations in codebases
astafford8488/agentaegis-mcp
Various
MCP server for cybersecurity operations — compliance, vuln scans, code security, threat intel. Pay-per-use via x402.
azer/react-analyzer-mcp
Various
MCP server for analyzing & generating docs for React code locally
BurtTheCoder/mcp-dnstwist
Various
MCP server for dnstwist, a powerful DNS fuzzing tool that helps detect typosquatting, phishing, and corporate espionage.
BurtTheCoder/mcp-shodan
Various
MCP server for Shodan — search internet-connected devices, IP reconnaissance, DNS lookups, and CVE/CPE vulnerability intelligence. Works with Claude Code, Codex, Gemini CLI, and Cl
Get the free Developer’s Field Guide
A 27-page field guide to the AI coding workflow with Claude. Claude Code, MCP servers, the prompt patterns that work, and what to delegate. Free.
Enter your work email. We send it straight over, plus a few short notes worth knowing. Unsubscribe any time.