semgrep/semgrep
by Various
Lightweight static analysis for many languages. Find bug variants with patterns that look like source code.
MCP
semgrep/semgrep
Added 27 Sept 2026
Overview
Lightweight static analysis for many languages. Finds bug variants by matching patterns that look like source code.
Best for
Best for
Developers who want fast, pattern-based static analysis across multiple languages.
Use cases
- Scan code for security vulnerabilities
- Find bug variants across a codebase
- Enforce custom coding patterns
How to use
Tested with
Claude Desktop, Claude Code, Cursor, Windsurf, VS Code
Notes
Lightweight static analysis for many languages. Finds bug variants by matching patterns that look like source code.
16,778 stars on GitHub. Last updated 2026-09-25. Licensed LGPL-2.1.
Use cases
- Scan code for security vulnerabilities
- Find bug variants across a codebase
- Enforce custom coding patterns
Pros
- Lightweight and fast
- Supports many languages
- Patterns are readable as source code
Cons
- Requires writing custom rules for specific bugs
- Pattern matching may miss context-dependent issues
- Not a substitute for deep semantic analysis
Indexed from awesome-mcp-servers-punkpeye and enriched against its public facts.
Pros
- Lightweight and fast
- Supports many languages
- Patterns are readable as source code
Cons
- Requires writing custom rules for specific bugs
- Pattern matching may miss context-dependent issues
- Not a substitute for deep semantic analysis
Open-source & AI alternatives
Swap-in tools that solve the same job. Weigh the trade-offs before you commit.
ajitpratap0/GoSQLX
Various
High-performance SQL parser, formatter, linter & security scanner for Go - 1.5M+ ops/sec, multi-dialect, zero-copy, race-free
cqfn/aibolit-mcp-server
Various
MCP Server for Aibolit Java Static Analyzer: Helping Your AI Agent Identify Hotspots for Refactoring
Disentinel/grafema
Various
Graph-based static analysis tool
duriantaco/skylos
Various
Open source local-first PR scanner that finds dead code, security bugs, secrets, quality regressions, and AI-code mistakes before merge. For first timers refer to https://duriantac
gaoharimran29-glitch/Cybersecurity-MCP-Server
Various
An Open Sourced Model Context Protocol (MCP) Local server that gives Claude real-time cybersecurity reconnaissance capabilities
Pairs with
Other entries in the index that connect to this one. Click through to see the chain.
idosal/git-mcp
Various
Put an end to code hallucinations! GitMCP is a free, open-source, remote MCP server for any GitHub project
kucherenko/jscpd
Various
Copy/paste detector for source code. 220+ languages, Rust engine, SARIF/HTML/badge reporters, GitHub Action, MCP server for AI agents.
repowise-dev/repowise
Various
Codebase intelligence for AI and humans: code health scores, auto-generated docs, git analytics, dead code detection, and architectural decisions via MCP.
airblackbox/air-blackbox-mcp
Various
MCP server for AIR Blackbox. Expose audit, replay, scan, and compliance tools to any MCP-compatible agent or IDE.
akramIOT/MCP_AI_SOC_Sher
Various
AI SOC Security Threat analysis using MCP Server
appcreationsca/bumpguard-mcp
Various
Guard your dependency bumps: an MCP server that tells your AI agent which parts of YOUR code break when you upgrade a dependency, and verifies AI-written code against the installed
ark-forge/mcp-eu-ai-act
Various
MCP EU AI Act Compliance Scanner - Open source tool to detect EU AI Act violations in codebases
astafford8488/agentaegis-mcp
Various
MCP server for cybersecurity operations — compliance, vuln scans, code security, threat intel. Pay-per-use via x402.
azer/react-analyzer-mcp
Various
MCP server for analyzing & generating docs for React code locally
BurtTheCoder/mcp-dnstwist
Various
MCP server for dnstwist, a powerful DNS fuzzing tool that helps detect typosquatting, phishing, and corporate espionage.
BurtTheCoder/mcp-shodan
Various
MCP server for Shodan — search internet-connected devices, IP reconnaissance, DNS lookups, and CVE/CPE vulnerability intelligence. Works with Claude Code, Codex, Gemini CLI, and Cl
DeusData/codebase-memory-mcp
Various
High-performance code intelligence MCP server. Indexes codebases into a persistent knowledge graph — average repo in milliseconds. 158 languages, sub-ms queries, 99% fewer tokens.
mariocandela/beelzebub
Various
A secure low code deception runtime framework, leveraging AI for System Virtualization.
safedep/vet
Various
Protect against malicious open source packages 🤖
toan203/osv-ui
Various
A beautiful, zero-config visual CVE dashboard for npm & Python. One command: npx osv-ui. 100% Local & Secure.
timescale/rsigma
Various
A complete Sigma detection engineering toolkit: parser, linter, evaluator, correlation engine, conversion framework, streaming daemon, MCP and LSP servers :crab:
nh4ttruong/secobserve-mcp
Various
MCP server for SecObserve: triage vulnerability findings, manage products and rules, import scan reports and SBOMs, generate VEX documents
Get the free Developer’s Field Guide
A 27-page field guide to the AI coding workflow with Claude. Claude Code, MCP servers, the prompt patterns that work, and what to delegate. Free.
Enter your work email. We send it straight over, plus a few short notes worth knowing. Unsubscribe any time.