Skip to main content
All Semgrep integration capabilities

​
About

This is an MCP connector that gives the Sazabi agent tools from Semgrep’s hosted MCP server, on its read-only URL (semgrep.dev/api/mcp/read-only). Semgrep authenticates over OAuth with dynamic client registration, and the server acts as the Semgrep user who connects it, with that user’s role in the organization they pick while signing in. The read-only URL serves only the tools that read data, and Sazabi blocks any tool not marked read-only. The agent can search findings during an investigation but cannot triage, ignore, fix, or rescan them, or change rules and policies. Only Semgrep’s multi-tenant deployment (semgrep.dev) is supported. Single-tenant deployments (<tenant>.semgrep.dev) are not supported yet. What the agent can do:
  • Search and count open Code, Supply Chain, and Secrets findings by project, severity, or rule
  • Check whether a dependency advisory affects one of your repositories
  • Read failed scans and scan logs while tracing a CI failure
  • Read a finding’s code snippet and history to judge whether it relates to an incident

​
Prerequisites

  • A Semgrep organization on a Teams or Enterprise plan
  • A Semgrep account in that organization with a role that can view the findings the agent needs

​
Set up in the dashboard

Configure connectors in the dashboard under Settings > MCP connectors.
1

​
Open the connector

Find Semgrep in Settings > MCP connectors.
2

​
Authorize

Start the connection. Sazabi redirects you to Semgrep, where you sign in, pick your Semgrep organization, and approve access, then back.

​
Set up with the CLI

You can also connect Semgrep with the Sazabi CLI (installed and authenticated — see sazabi mcp-connectors reference). Semgrep authenticates over OAuth, so the CLI opens a browser to complete authorization:
Add --project-id <project> to target a specific project, or --no-wait to print the authorization link and exit without waiting. With --json the command prints the authorization URL and returns without waiting. Confirm the result with sazabi mcp-connectors list.

​
Verify

Open the connector’s connection page under Settings > MCP connectors and confirm Sazabi lists the tools it discovered. Then, in a thread, ask the agent to list your Semgrep projects and confirm it returns them.

​
Troubleshooting

Only an account tool is discovered — The organization is on Semgrep’s Free plan, or the connection is not tied to an organization. The hosted MCP server needs a Teams or Enterprise plan. Reconnect and pick an organization on one of those plans. A tool returns “404: The requested URL was not found” — Semgrep reports missing permissions as 404. The user who connected cannot see that data; reconnect with a user whose role can. Connection shows needs attention — The authorization may have expired or been revoked; reconnect from Settings > MCP connectors.

​
Further reading

Agent tools

How the agent uses connector tools.

MCP connectors

Browse the connector catalog.