mcp-server-semgrep

概述

MCP Server Semgrep 是一个 Model Context Protocol 兼容的服务器，将强大的 Semgrep 静态分析工具与 Claude 等 AI 助手连接起来。它使开发人员能够通过对话界面执行高级代码分析、检测安全漏洞并改进代码质量。该服务器提供全面的工具，包括目录扫描、规则列表、结果分析和自定义规则创建，使其成为关注安全和代码质量的开发团队的必备工具。

试试问 AI

装完之后，这里有 4 个你可以让 AI 做的事：

• scan_directory

  Scanning source code for potential issues

  试试:Scan my source code in the /projects/my-application directory for potential security issues试试:Check the entire project for code quality issues
• list_rules

  Displaying available rules and languages supported by Semgrep

  试试:Show me all available Semgrep rules试试:List all supported languages for Semgrep analysis
• analyze_results

  Detailed analysis of scan results

  试试:Analyze the Semgrep scan results in detail试试:Explain the critical vulnerabilities found in the scan
• create_rule

  Creating custom Semgrep rules

  试试:Create a Semgrep rule that detects improper use of input sanitization functions试试:Make a rule to detect deprecated imports in our codebase
• filter_results

  Filtering results by various criteria

  试试:Show me only scan results related to SQL injection vulnerabilities试试:Filter results to show only high severity issues
• export_results

  Exporting results in various formats

  试试:Export the scan results as a JSON file试试:Generate an HTML report of the analysis findings
• compare_results

  Comparing two sets of scan results

  试试:Compare scan results before and after the code changes试试:Show me the differences between the current scan and the last one

可对比工具

安装

npm install -g mcp-server-semgrep

{
  "mcpServers": {
    "semgrep": {
      "command": "node",
      "args": [
        "/your_path/mcp-server-semgrep/build/index.js"
      ],
      "env": {
        "SEMGREP_APP_TOKEN": "your_semgrep_app_token",
        "MCP_SERVER_SEMGREP_ALLOWED_ROOTS": "/Users/you/projects"
      }
    }
  }
}

mcp-server-semgrep 对比