Semgrep Guardian

Semgrep Guardian is Semgrep's own Claude Code plugin. It scans every file your agent writes or edits with Semgrep Code, Supply Chain and Secrets while it works, and hands any findings back so the agent can rewrite the code before it reaches a pull request. It bundles Semgrep's Guardian MCP server, hooks that run on every file write, and skills. What it does - Scans each file the agent writes or edits for code vulnerabilities, vulnerable dependencies and hardcoded secrets - Returns the findings to the agent, which can regenerate the code until the scan comes back clean, or you can dismiss them - Lets the agent look things up in your Semgrep account through the MCP server, such as your projects and supply chain findings - Helps you write a custom Semgrep rule, add it for yourself or for the whole repository, and prove that it fires, where your Semgrep deployment allows custom rules - Checks its own connection and signs you in again when a sign-in has expired How it connects Install it from Anthropic's plugin marketplace as semgrep@claude-plugins-official. Your first session asks you to sign in to Semgrep in your browser; it's a one-time sign-in, and tokens refresh automatically. It scans with Semgrep's hosted scanner, so you don't need the Semgrep CLI. Semgrep offers the same plugin for Codex, and other setups for agents such as Cursor, GitHub Copilot and Kiro. Good to know - You need a Semgrep account. - The plugin scans with Semgrep's fixed guardian-default ruleset rather than your organization's Policies, so keep running Semgrep in CI. - Its hooks send the files the agent writes, plus lockfiles and manifests, to Semgrep's scanner. Telemetry never includes file contents, and you can turn it off. - It updates itself in the background unless you turn that off. - It also includes a skill that installs Semgrep's Malware Firewall (mfw) CLI.