# Semgrep MCP connector The Semgrep connector brings your Semgrep findings, issues, deployments and ignore rules into Claude, ChatGPT, Cursor and any MCP client, so each person can search, triage and update them under their own Semgrep access with every action logged. Source: https://elaichi.ai/connectors/semgrep/ ## Facts | | | | --- | --- | | Application | Semgrep | | Category | Security | | AI tools | 208 | | Authentication | Connects with an API key | | Needs your own OAuth app | No | | MCP endpoint | https://api.elaichi.ai/mcp | | Works with | Claude, ChatGPT, Cursor, any MCP client, and the Elaichi Agent | | Tools advertised by name | No. 208 tools is past the 30-tool threshold, so clients use `search_tools` and `execute_tool` | ## What you can ask once Semgrep is connected - List open Semgrep findings for the platform deployment. - Which notification rules are set on our Semgrep deployment? - Summarize Semgrep findings created in the last 14 days. ## Connect Semgrep in Elaichi This happens once for the organization, before any client is involved. 1. Open Connections, choose Add connection, and pick Semgrep. 2. Optionally set Share with, then press Connect. 3. Paste a Semgrep API key. One person generates a token in Semgrep and pastes it once. Everyone else works through Share with, and never sees it. Credentials are vaulted and nobody, including the AI, reads them back. The connection becomes a toolbox immediately, so you can curate which Semgrep tools are exposed, rename them, or freeze arguments before anyone points a client at it. ## Connect Semgrep to Claude Endpoint: https://api.elaichi.ai/mcp 1. Open Customize, then Connectors. 2. Press Add. 3. Name it, paste the MCP server URL, then Continue. 4. Sign in and approve. On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves. ## Connect Semgrep to ChatGPT Endpoint: https://api.elaichi.ai/mcp 1. Open Plugins, then press the + button. 2. Name it and paste the endpoint into Server URL. 3. Leave Authentication on OAuth, then tick the risk acknowledgement. 4. Press Create, then sign in and approve. Works on the web today. The plugin directory lives at chatgpt.com/plugins. ## Connect Semgrep to Cursor Endpoint: https://api.elaichi.ai/mcp 1. Open `~/.cursor/mcp.json`. 2. Add the endpoint under `mcpServers`. 3. Reload Cursor, then sign in and approve. Set up per machine, so repeat it on each computer you work from. ## Connect Semgrep to any MCP client Endpoint: https://api.elaichi.ai/mcp 1. Add the endpoint as a remote MCP server. 2. Sign in and approve. The Elaichi Agent already has these tools, with nothing to set up. ## What the consent screen decides Only Read is granted by default, which is not enough to call a Semgrep tool. Over MCP there is no trusted place to confirm a write in the moment, so the consent screen is the standing approval rather than a formality. Grant Read and Run tools. Think hard before granting Delete, which reaches into connected apps and cannot be undone. ## What teams do with Semgrep through Elaichi ### Triage new findings before standup Security. Ask for the Semgrep findings that appeared overnight, grouped by severity and repository, and mark the ones that are already handled as resolved in one pass. ### Understand an issue before fixing it Engineering. Pull up a single Semgrep issue by its ID, read the rule that flagged it and the line it points at, and get a plain explanation of why it matters before opening the file. ### Clear false positives in bulk Security. When a rule keeps flagging test fixtures, search for every matching finding and update them together instead of clicking through each one in the Semgrep dashboard. ### Keep ignore rules tidy Platform. List the ignores set on a Semgrep deployment, spot the ones that are stale or too broad, and update or remove them together so real problems stop being hidden. ### Report open issues by severity Compliance. Search Semgrep issues across a deployment and summarize how many are open, how old they are and which repositories carry the most, ready to paste into an audit response. ### Check which repositories are covered Engineering management. Review each Semgrep deployment, its tags, its notification rules and whether the GitHub app is connected, so you know which teams are actually being scanned. ## Frequently asked questions ### How do I connect Semgrep to Claude? Connecting Semgrep to Claude takes two steps. First, connect Semgrep in Elaichi by pasting an API key from your Semgrep account settings, there is no OAuth application to register and no client ID or secret to generate. Then in Claude go to Customize, then Connectors, then Add, and paste the endpoint https://api.elaichi.ai/mcp. Claude signs in through Elaichi and your Semgrep findings, issues and deployments are available. ### Does Semgrep work with ChatGPT and Cursor as well as Claude? Yes. Once Semgrep is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any other MCP client and the Elaichi Agent. You connect Semgrep once and every client you use picks it up. ### What can an AI agent actually do with my Semgrep data? With Semgrep connected, an agent can search your findings and issues, open a single issue to explain what the rule caught, and update a batch of findings after you have triaged them. It can also list your Semgrep deployments, their tags and notification rules, check whether the GitHub app is connected, and create, update or remove ignore rules and deployment actions. Because Semgrep exposes a long list of actions, short concrete asks such as "open critical findings in the payments repo" work better than long paragraphs. ### Does connecting Semgrep give the AI every deployment and every finding? No. When someone connects Semgrep, the agent works within that person's own Semgrep access, so it sees the deployments and findings they can already see in Semgrep and nothing more. Elaichi can narrow that further, for example to read-only or to a single deployment, but it can never widen it beyond what Semgrep itself grants. ### Can my team share one Semgrep connection? Yes. One person connects Semgrep in Elaichi and shares the connection with a team, and nobody else ever handles the Semgrep API key. Each teammate still signs in to Elaichi as themselves, so every finding update or ignore rule change in the audit log carries the name of the person who made it, not a shared account. ### Can I stop an agent from deleting ignore rules or changing findings in Semgrep? Yes. Restrictions in Elaichi work per action, so you can allow searching Semgrep findings and issues while blocking updates to findings, deletion of ignore rules or changes to deployment actions. A blocked action is never shown to Claude, ChatGPT or any other client at all, so no prompt, however worded, can reach it. ### What happens to a Semgrep connection when someone leaves? When a person is offboarded in Elaichi, their access to Semgrep through every connected client ends at once. If they had shared a Semgrep connection with a team, it keeps working for everyone else on that team. Disconnecting Semgrep once in Elaichi removes it from Claude, ChatGPT, Cursor and every other client in the same step. ## All 208 Semgrep tools Every tool below is callable through https://api.elaichi.ai/mcp once Semgrep is connected, subject to the toolbox it is in and the restrictions on the caller. - **List all Semgrep agent deployments** (List). List all Semgrep agent deployments associated with the current authentication token. Returns: id. - **Create a Semgrep agent deployment** (Create). Create a new Semgrep agent deployment. Returns: id. - **Get single Semgrep agent deployment by ID** (Get). Get a single Semgrep agent deployment by id. Returns: id, name. Required: id. - **Update a Semgrep agent deployment by ID** (Update). Update a Semgrep agent deployment by id. Returns the updated deployment including its id, name, and slug. Required: id. - **Semgrep agent deployments list tags** (List). List deployment tags for a Semgrep deployment by deployment id. Returns: tags. Required: deployment_id. - **Semgrep agent deployments list notification rules** (List). List notification rules for a Semgrep deployment. Returns a collection of notification rule objects, each including its id. Required: deployment_id. - **Create a Semgrep deployment action** (Create). Create a notification rule for a Semgrep deployment. Returns the notification rule object with schema-defined fields. Required: deployment_id. - **Update a Semgrep deployment action by ID** (Update). Replace a notification rule for a Semgrep deployment. Returns the notification rule object with schema-defined fields. Required: deployment_id, id. - **Delete a Semgrep deployment action by ID** (Delete). Delete a notification rule from a Semgrep deployment. Returns a DeleteNotificationRuleResponse confirming the deletion. Required: deployment_id, id. - **Create a Semgrep action test** (Create). Test a notification rule in Semgrep by triggering a test action for the specified deployment and notification rule. Returns the test notification rule response from Semgrep. Required: deployment_id, notification_rule_id. - **List all Semgrep deployment authorized actions** (List). List authorized actions for a Semgrep deployment. Returns: actions (the list of action identifiers the user is authorized to take on the deployment). Required: deployment_id. - **List all Semgrep deployment default user roles** (List). Get the default user role for a Semgrep deployment. Returns the default user role configuration assigned to new users in the deployment. Required: deployment_id. - **List all Semgrep deployment findings** (List). List code, supply chain, or AI-powered scan findings for a Semgrep deployment, ordered by relevant_since descending. Returns: id, assistant, categories, click_to_fix_failures, click_to_fix_prs, confidence, created_at, external_ticket, first_seen_scan_id, line_of_code_url, location, match_based_id, ref, relevant_since, repository, review_comments, rule, rule_message, rule_name, severity,…. Required: deployment_slug. - **Semgrep deployment findings bulk update** (Update). Bulk triage Semgrep issues that match specified filters within a deployment, applying triage updates to matching findings in a single operation. Returns the bulk update findings response. Required: deployment_id. - **List all Semgrep deployment github app status** (List). Check if the Semgrep GitHub app is installed for a deployment in Semgrep. Returns: installed. Required: deployment_id. - **Create a Semgrep deployment has deepsemgrep** (Create). Update the DeepSemgrep setting for a Semgrep deployment by deployment id. Returns a JSON response object confirming the update. Required: deployment_id. - **Create a Semgrep deployment has dependency query** (Create). Update the has_dependency_query setting for a Semgrep deployment. Returns an OK response confirming the updated deployment has_dependency_query state. Required: deployment_id. - **Create a Semgrep deployment has triage via comment** (Create). Update the "has triage via comment" setting for a specific Semgrep deployment. Returns the update response confirming the deployment's triage-via-comment configuration. Required: deployment_id. - **List all Semgrep deployment ignores** (List). List deployment product ignores for a Semgrep deployment. Returns the deployment product ignore configuration via the attributes field, with the exact field structure defined by the upstream protobuf schema. Required: deployment_id. - **Create a Semgrep deployment ignore** (Create). Create deployment product ignores for a Semgrep deployment by submitting a JSON request body. Returns the created configuration via the attributes field, with the exact field structure defined by the upstream protobuf schema. Required: deployment_id. - **Semgrep deployment ignores bulk update** (Update). Update deployment product ignores for a Semgrep deployment by submitting a JSON request body. Returns the updated configuration via the attributes field, with the exact field structure defined by the upstream protobuf schema. Required: deployment_id. - **Semgrep deployment ignores bulk delete** (Delete). Delete deployment product ignores for a Semgrep deployment, optionally filtered by product type. Returns the deletion result via the attributes field, with the exact field structure defined by the upstream protobuf schema. Required: deployment_id. - **Semgrep deployment issues search** (Search). Search and group Semgrep deployment issues by rule with filtering and pagination. Returns: issue_groups. Required: deployment_id. - **Get single Semgrep deployment issue by ID** (Get). Get a single Semgrep deployment issue by id with full details. Returns: id, state, status, severity, confidence, rule_name, rule_message, rule, repository, location, line_of_code_url, categories, created_at, relevant_since, state_updated_at, triaged_at, triage_state, triage_reason, triage_comment, syntactic_id, match_based_id, ref, first_seen_scan_id, is_archived, sourcing_policy,… - **Create a Semgrep issues export** (Create). Asynchronously export Semgrep issues matching filters to a file for a deployment. Accepts a ListIssuesRequest filter body and returns a 202 Accepted acknowledgment confirming the export job has been queued. Required: deployment_id. The export runs asynchronously; poll for completion separately. - **List all Semgrep issue code snippets** (List). List code snippets for a Semgrep issue within a deployment. Returns: code_snippets. Required: deployment_id, issue_id. - **Create a Semgrep issue fix job** (Create). Create an automated SAST fix job for a given issue in Semgrep, triggering an AI-powered workflow that analyzes the vulnerability, generates a fix, and opens a pull request in the repository. Returns the created fix job response. Required: deployment_id, issue_id. This feature is currently in Public Beta. - **List all Semgrep deployment managed scan settings** (List). List managed scan settings for a Semgrep deployment. Returns the managed scan settings response object including id and attributes containing deployment-specific scan configuration fields. Required: deployment_id. - **Create a Semgrep deployment managed scan setting** (Create). Create managed scan settings for a Semgrep deployment. Returns the created managed scan settings object including its managed_scan_settings_id. Required: deployment_id. - **Update a Semgrep deployment managed scan setting by ID** (Update). Update a Semgrep managed scan settings record for a specific deployment. Returns: id. Required: deployment_id, id. A JSON request body is required but its fields are defined in the upstream proto schema (UpdateManagedScanSettingsRequest) and are not enumerable from the discovered documentation. - **Delete a Semgrep deployment managed scan setting by ID** (Delete). Delete a Semgrep managed scan settings record from a specific deployment. Returns: id. Required: deployment_id, id. - **List all Semgrep deployment packagemanagerauthconfigs** (List). List all package manager authentication configurations for a Semgrep deployment. Returns: id. Required: deployment_id. - **Create a Semgrep deployment packagemanagerauthconfig** (Create). Create a new package manager authentication configuration for a Semgrep deployment. Returns: id. Required: deployment_id. - **Update a Semgrep deployment packagemanagerauthconfig by ID** (Update). Update an existing package manager authentication configuration in Semgrep. Returns: id. Required: deployment_id, id. - **Delete a Semgrep deployment packagemanagerauthconfig by ID** (Delete). Delete a package manager authentication configuration from a Semgrep deployment. Returns: id. Required: deployment_id, id. - **List all Semgrep deployment products** (List). Get the product configuration for a Semgrep deployment. Returns the deployment product config object including id and attributes. Required: deployment_id. - **Semgrep deployment products bulk update** (Update). Create or update the product configuration for a Semgrep deployment. Returns the updated deployment product config object including id and attributes. Required: deployment_id. - **List all Semgrep products admins** (List). Get the admin product configuration for a Semgrep deployment. Returns the admin product configuration object with schema-specific fields. Required: deployment_id. - **Create a Semgrep products feedback** (Create). Send deployment product toggle feedback to Semgrep for a specific deployment. Returns a SendDeploymentToggleFeedbackResponse acknowledgement object. Required: deployment_id. - **List all Semgrep project resolution configs** (List). List custom SCA dependency resolution configurations for a Semgrep deployment and project. Returns the resolution configs response object with content-type-specific fields. Required: deployment_id, project_id. - **Update a Semgrep deployment repo by ID** (Update). Bulk edit multiple Semgrep projects (repos) within a deployment, applying changes to all specified projects at once. Returns the bulk edit response confirming the applied changes. Required: deployment_id, id. - **Semgrep deployment repos bulk update** (Update). Bulk edit multiple projects (repos) in a Semgrep deployment by applying changes to all specified projects at once. Returns the bulk edit response confirming the applied changes. Required: deployment_id. - **Create a Semgrep repos provision** (Create). Provision Semgrep CI GitHub Actions across repos in a Semgrep deployment by adding a "semgrep-ci" GitHub Action to GitHub Repositories associated with Semgrep Projects matching the filters provided in the request body. Returns a BulkProvisionReposResponse object with the results of the bulk provisioning operation. Required: deployment_id. - **Create a Semgrep repos refresh async** (Create). Schedule an async job in Semgrep to sync all projects in a deployment to their source control manager. Returns a 202 Accepted response confirming the refresh job has been queued. Required: deployment_id. - **Create a Semgrep repos secret** (Create). Add Semgrep CI secrets to GitHub repositories in a deployment. Generates and adds a secret for the "semgrep-ci" GitHub Action to the GitHub repositories associated with any Semgrep Projects that match the given filters in the request body. Returns a BulkAddRepoSecretResponse object with the result of the bulk secret-addition operation. Required: deployment_id. - **List all Semgrep repos by tags** (List). List all project IDs grouped by tag for a Semgrep deployment. Returns: repos_by_tag, a mapping from tag ID to related project IDs. Required: deployment_id. - **Semgrep repos filtereds bulk update** (Update). Bulk apply a project update to many Semgrep projects in a deployment that match the given filters. Returns the bulk apply repo update response (protos.projects.v1.BulkApplyRepoUpdateResponse). Required: deployment_id. - **Create a Semgrep repo sync** (Create). Schedule a job to sync a Semgrep project repository with its source control manager. Returns a 202 Accepted response confirming the sync has been scheduled. Required: deployment_id, repo_id. - **List all Semgrep deployment ruleboards** (List). List ruleboards for a Semgrep deployment, optionally filtered by type. Returns: type. Required: deployment_id. - **Create a Semgrep deployment ruleboard** (Create). Create a new ruleboard for a Semgrep deployment. Returns: type. Required: deployment_id. - **Update a Semgrep deployment ruleboard by ID** (Update). Update a Semgrep ruleboard within a deployment. Returns the updated ruleboard object including its slug and type. Required: deployment_id, id. - **Delete a Semgrep deployment ruleboard by ID** (Delete). Delete a Semgrep ruleboard for a deployment by id. Returns an empty 204 response on success. Required: deployment_id, id. - **Get single Semgrep deployment ruleboard by ID** (Get). Get a single Semgrep ruleboard for a deployment by id. Returns: slug, type. Required: deployment_id, id. - **List all Semgrep ruleboard finding counts** (List). Get Semgrep ruleboard finding counts for a specific deployment and ruleboard. Returns finding count data for the specified ruleboard, optionally filtered by time range. Required: deployment_id, ruleboard_slug. - **List all Semgrep ruleboard overviews** (List). Get the overview of a Semgrep ruleboard within a deployment. Returns the ruleboard overview object with fields defined in the upstream Semgrep API schema. Required: deployment_id, ruleboard_slug. - **Semgrep ruleboard overviews bulk update** (Update). Update the overview of a Semgrep ruleboard within a deployment. Returns the updated ruleboard overview object with fields defined in the upstream Semgrep API schema. Required: deployment_id, ruleboard_slug. - **List all Semgrep slack channel mappings** (List). List Slack channel mappings for a Semgrep deployment. Returns the response object with fields defined by the upstream GetSlackChannelMappingsResponse protobuf schema. Required: deployment_id. - **List all Semgrep slack channels** (List). List Slack notification mappings for a Semgrep deployment. Returns notification mapping records including id and attributes with channel and notification mapping details. Required: deployment_id. - **List all Semgrep slack installs** (List). Get the Slack app installation OAuth URL for a Semgrep deployment, generating the URL that initiates the Slack app installation flow. Returns: attributes (the InstallSlackAppResponse containing the installation OAuth URL). Required: deployment_id. - **List all Semgrep slack installations** (List). Get Slack app installation details for a Semgrep deployment. Returns the Slack installation response object whose shape is defined by the upstream GetSlackInstallationResponse schema. Required: deployment_id. - **Semgrep slack installations bulk delete** (Delete). Delete the Slack app installation for a Semgrep deployment and revoke its access token. Returns the deletion response object whose shape is defined by the upstream DeleteSlackInstallationResponse schema. Required: deployment_id. - **Create a Semgrep oauth callback** (Create). Handle a Slack OAuth callback for a Semgrep agent deployment, processing the callback to exchange the authorization code for an access token and store the Slack installation data. Returns the callback processing response. Required: deployment_id. - **Create a Semgrep tags find** (Create). Find deployment tags with their associated project counts in Semgrep. Returns the matching tags along with project count information. Required: deployment_id. - **Update a Semgrep deployment tag by ID** (Update). Create or update a deployment tag in Semgrep. Returns the updated deployment tag object. Required: deployment_id, id (repository tag). - **Delete a Semgrep deployment tag by ID** (Delete). Delete a deployment tag in Semgrep by deployment id and tag identifier. Returns an empty 204 response on success. Required: deployment_id, id. - **Get single Semgrep deployment tag by ID** (Get). Get a single deployment tag in Semgrep by deployment and repository tag identifier. Returns the deployment tag object including its id and attributes. Required: deployment_id, id. - **List all Semgrep deployment users** (List). List users for a Semgrep deployment, optionally filtering by GitHub pruning or active status. Returns: id. Required: deployment_id. - **Create a Semgrep deployment user** (Create). Add a user to a Semgrep deployment by providing user details in the request body. Returns: id. Required: deployment_id. - **Delete a Semgrep deployment user by ID** (Delete). Remove a user from a Semgrep deployment. Returns: id. Required: deployment_id, id. - **Semgrep user roles bulk update** (Update). Update the roles assigned to a specific user within a Semgrep deployment. Returns the patched deployment user response. Required: deployment_id, user_id. - **List all Semgrep agent features** (List). List all available feature rollouts in Semgrep. Returns: available_feature_rollouts. No required parameters. - **List all Semgrep agent identities** (List). Get the agent's bearer identity in Semgrep. Returns: identity. No request parameters required. - **List all Semgrep agent ips** (List). Get the current IP address in Semgrep. Returns: ip_address. - **List all Semgrep agent pings** (List). Ping the Semgrep agent server to assert liveness. Returns: pong. No required parameters. - **List all Semgrep agent tenants** (List). Get the current tenant name for the Semgrep server (e.g. "default"). Returns: tenant_name. - **List all Semgrep version project infos** (List). Get Semgrep version information for recent scans for a specific deployment and product in Semgrep. Returns: data (version info object whose exact fields depend on the upstream GetProjectVersionInfoResponse proto schema). Required: deployment_id, product. - **Create a Semgrep deployment autotriage feedback** (Create). Post autotriage feedback for a Semgrep AI deployment. Returns a PostAutotriageFeedbackResponse object; the upstream schema fields are not documented in the available source. Required: deployment_id and a JSON request body. - **Create a Semgrep deployment memory** (Create). Create a new AI memory in a Semgrep deployment. Returns the created memory object. Required: deployment_id. - **Update a Semgrep deployment memory by ID** (Update). Update an existing AI memory in a Semgrep deployment by replacement. Returns the updated memory object. Required: deployment_id, id. - **Delete a Semgrep deployment memory by ID** (Delete). Delete a Semgrep AI deployment memory by its ID. Returns an empty 204 response on success. Required: deployment_id, id. - **List all Semgrep memories stats** (List). Get statistics about a Semgrep deployment's memories performance. Returns a memory performance statistics object whose fields are defined by the upstream GetMemoriesStatsResponse schema. Required: deployment_id. - **List all Semgrep memories suggesteds** (List). List all suggested memories for a Semgrep AI deployment. Returns: id, created_at, updated_at. Required: deployment_id. - **Create a Semgrep memories triage** (Create). Create a new Semgrep AI memory from a triage event for a deployment. Returns the created memory object as a CreateMemoryFromTriageResponse. Required: deployment_id, and a JSON request body describing the triage event. - **Create a Semgrep deployment relevant issue** (Create). Find relevant issues for a given rule and repository in a Semgrep deployment. Returns the matching relevant issues response object defined by the upstream FindRelevantIssuesResponse schema. Required: deployment_id. A JSON request body is also required. - **Create a Semgrep AI pattern fix** (Create). Create an AI pattern fix task in Semgrep for a given pattern and language, used in the editor's structure mode. Returns a task token for polling completion via the Tasks Service. Required: pattern, language. - **Create a Semgrep combined task** (Create). Create a combined task for a deployment in Semgrep. Returns the created combined task object with schema-specific fields defined in the upstream protobuf definition. Required: deployment_id. - **List all Semgrep info** (List). Get task info for a Semgrep deployment. Returns the task info response object for the specified deployment. Required: deployment_id. - **List all Semgrep auth authorized resources** (List). List all organizations and deployments available to the authenticated user in Semgrep. Returns authorized resource records, each with an id and an attributes object containing organization/deployment-specific fields from the upstream protobuf schema. - **List all Semgrep deployment providers** (List). List all SSO providers configured for a Semgrep deployment. Returns: sso_providers (array of SSO provider objects, each with an id). Required: deployment_id. - **List all Semgrep auth users** (List). Get the current Semgrep user's basic information including role, email, and auth details. Returns: id, email, role. If userId is supplied it must equal the requester's own ID. - **List all Semgrep users deployments** (List). List all Semgrep organizations/deployments that the current user is a member of. Returns: id, name, slug, findings. As of June 2025, the userId query parameter must equal the requester's ID. - **List all Semgrep deployments joinables** (List). List all Semgrep organizations/deployments that the current user can join. Returns: id, name, slug, findings. If provided, userId must equal the requester's ID. - **List all Semgrep users settings** (List). Get basic settings and onboarding info for the current Semgrep user. Returns the user settings object with schema-specific fields including contact preferences and product tour state. - **Semgrep users settings bulk update** (Update). Update user settings and preferences for the current Semgrep user. Returns the updated user settings object; exact fields are defined by the upstream PatchUserSettingsResponse schema. - **List all Semgrep deployment scm comment product contents** (List). List all review comment product contents for a Semgrep deployment. Returns: id. Required: deployment_id. - **Create a Semgrep deployment scm comment product content** (Create). Create a new review comment product content in a Semgrep deployment. Returns: id. Required: deployment_id. - **Update a Semgrep deployment scm comment product content by ID** (Update). Update an existing review comment product content in a Semgrep deployment. Returns: id. Required: deployment_id, id. - **Delete a Semgrep deployment scm comment product content by ID** (Delete). Delete a review comment product content by its ID in a Semgrep deployment. Returns: id. Required: deployment_id, id. - **List all Semgrep health checks** (List). Check if the Semgrep container is healthy. Returns: status. No required parameters. - **List all Semgrep infra config bootstrap sms vpcs** (List). Get the Semgrep Managed Scans (SMS) VPC Bootstrap CloudFormation template in JSON format for cross-account infrastructure setup. Returns the CloudFormation template object with content-type-specific fields following the AWS CloudFormation template format. The template creates IAM roles and policies for SMS VPC automation, including the semgrep-sms-vpc-automation role and EC2 Image Builder… - **List all Semgrep notification webhooks deployments** (List). List all notification webhooks for a Semgrep deployment. Returns: webhooks (array of webhook objects). Required: deployment_id. - **Create a Semgrep webhook test** (Create). Send a test payload to a Semgrep notification webhook endpoint to verify it is configured and delivering correctly. Returns the test webhook delivery result. Required: deployment_id, webhook_id. - **List all Semgrep deployment automations** (List). List all automations for a Semgrep deployment. Returns: id. Required: deployment_id. - **Create a Semgrep deployment automation** (Create). Create a new automation for a Semgrep deployment. Returns: id. Required: deployment_id. - **Update a Semgrep deployment automation by ID** (Update). Update an existing automation in a Semgrep deployment. Returns: id. Required: deployment_id, id. - **Delete a Semgrep deployment automation by ID** (Delete). Delete an automation from a Semgrep deployment by id. Returns: id. Required: deployment_id, id. - **Semgrep deployment automations list v 1** (List). List all automations for a Semgrep deployment via the v1 notifications endpoint. Returns: id, attributes. Required: deployment_id. - **List all Semgrep deployment ticketings** (List). List external ticketing instances (e.g. Jira) linked to a Semgrep deployment. Returns ticketing instance records with their id. Required: deployment_id. - **Create a Semgrep tickets link** (Create). Link an existing external ticket to Semgrep findings by providing the ticket URL and finding IDs. If a finding is already linked, the existing link is replaced. Returns: id, url. Required: deployment_id, ticketing_instance_id, ticket_url, finding_ids. - **Semgrep tickets links create v 1** (Create). Link an existing external ticket (e.g. Jira) to one or more Semgrep findings. Does not create a ticket — it only records the association in Semgrep, replacing any prior link on a finding. Returns the linked ticket object including id, url, and linked_issue_ids. Required: deployment_id, issue_ids, ticket_url. - **Create a Semgrep tickets unlink** (Create). Unlink a ticket from one or more Semgrep findings within a deployment and ticketing instance by providing a list of finding IDs. This only removes the association in Semgrep, not the ticket in your issue tracker. Returns: attributes. Required: deployment_id, ticketing_instance_id, finding_ids. - **Semgrep tickets unlinks create v 1** (Create). Unlink a ticket from one or more Semgrep findings within a deployment by providing a list of finding IDs (v1 API). This only removes the association in Semgrep, not the ticket in your issue tracker. Returns: unlinked_issue_ids. Required: deployment_id, issue_ids. - **Delete a Semgrep ticket by ID** (Delete). Delete an external ticket in Semgrep and unlink it from associated Semgrep findings. Returns: id. Required: deployment_id, ticketing_instance_id, id. - **List all Semgrep deployment wizes** (List). List Wiz notification credentials configured for a Semgrep deployment. Returns: id. Required: deployment_id. - **Create a Semgrep deployment wize** (Create). Create a Wiz notification credential for a Semgrep deployment. Returns: id. Required: deployment_id. - **Get single Semgrep deployment wize by ID** (Get). Get a single Wiz notification credential in Semgrep by id. Returns: id. Required: deployment_id, id. - **Update a Semgrep deployment wize by ID** (Update). Update a Wiz notification credential in Semgrep by id. Returns: id. Required: deployment_id, id. - **Delete a Semgrep deployment wize by ID** (Delete). Delete a Wiz notification credential in Semgrep by id. Returns: id. Required: deployment_id, id. - **Create a Semgrep wiz validate** (Create). Validate a Wiz integration credential for a Semgrep deployment. Returns a ValidateWizCredentialResponse object with schema-specific fields defined in the upstream protobuf. Required: deployment_id. - **Get single Semgrep in app deployment by ID** (Get). List unread in-app notifications for a Semgrep deployment by id. Returns a paginated list of notification objects, each including its id. Required: id (deploymentId). - **Semgrep deployment mark as seens bulk update** (Update). Mark a list of in-app notifications as seen for a Semgrep deployment in Semgrep. Accepts a MarkNotificationsAsSeenRequest JSON body identifying the notifications to mark, and returns a MarkNotificationsAsSeenResponse confirmation object. Required: deployment_id. - **List all Semgrep deployment checklists** (List). Get the onboarding checklist status for a Semgrep deployment. Returns the checklist status response object whose fields are defined in the upstream Semgrep onboarding protobuf schema. Required: deployment_id. - **Semgrep deployment checklists bulk update** (Update). Update the onboarding checklist for a Semgrep deployment by submitting a patch request body. Returns the updated checklist response object whose fields are defined in the upstream Semgrep onboarding protobuf schema. Required: deployment_id. - **Create a Semgrep deployment invite member** (Create). Invite members to a Semgrep deployment during onboarding by sending an InviteMembersRequest body. Returns an InviteMembersResponse object confirming the invitations. Required: deployment_id. - **List all Semgrep deployment status** (List). Check whether a Semgrep deployment has Role-Based Access Control (RBAC) enabled. Returns: rbac_enabled. Required: deployment_id. - **Create a Semgrep deployment team** (Create). Create a new Role-Based Access Control team for a Semgrep deployment. Returns the created team including its id and name. Required: deployment_id, name. - **Update a Semgrep deployment team by ID** (Update). Update a Semgrep deployment RBAC team's name, users, and repositories. Returns the updated team including its id and name. Required: deployment_id, id. - **Delete a Semgrep deployment team by ID** (Delete). Delete a Semgrep deployment's Role-Based Access Control team. Returns the deleted team including its id and name. Required: deployment_id, id. - **Semgrep deployment teams list members** (List). List the users assigned to a Semgrep Role-Based Access Control team. Returns each user record with id and additional attributes defined by the upstream schema. Required: deployment_id, team_id. - **Get single Semgrep deployment team by ID** (Get). Get a single Semgrep deployment RBAC team by id. Returns the team record with id and additional attributes defined by the upstream schema. Required: deployment_id, id. - **List all Semgrep team repos** (List). List the repositories assigned to a Semgrep Role-Based Access Control team. Returns: repos. Required: deployment_id, team_id. - **List all Semgrep teams** (List). List the child teams assigned to a Role-Based Access Control team in Semgrep. Returns: id, name. Required: deployment_id, team_id. - **Get single Semgrep policies deployment by ID** (Get). List all policies for a given Semgrep deployment. Returns: a policies array where each policy includes id, name, and slug. Required: id (the numerical deployment identifier). - **List all Semgrep rules** (List). List the rules for a given Semgrep policy. Returns: rule_path, attributes. Required: deployment_id, policy_id. Default page size is 500; maximum is 2000. - **Update a Semgrep rule by ID** (Update). Update a specific rule within a Semgrep policy. Returns: rule_path, attributes. Required: deployment_id, policy_id, id. - **List all Semgrep deployment detection policies** (List). Get the detection policy summary for a Semgrep deployment. Returns: state_version, bundle. Required: deployment_id. - **Get single Semgrep deployment detection policy by ID** (Get). Get a Semgrep detection policy for one product in a deployment. Returns the detection policy bundle including its exceptions, plus the state_version required to apply changes. Required: deployment_id, product. - **Semgrep deployment detection policies dry run** (Run). Preview a Semgrep detection policy apply by validating a candidate bundle and returning the diff a strict apply would produce, without changing anything. Returns: state_version, diff. Required: deployment_id, product, bundle. - **Semgrep deployment detection policies bulk update** (Update). Apply a detection policy bundle for one product in a Semgrep deployment. The submitted bundle replaces the current state and exceptions absent from it are deleted. Returns: state_version, bundle. Required: deployment_id, product. Requires the current state_version via the If-Match header; returns 428 if missing or 409 if stale. - **List all Semgrep deployment remediation policies** (List). Get remediation policies for a Semgrep deployment. Returns the remediation policies bundle and the state_version required to apply changes; system-managed policies are excluded. Required: deployment_id. - **Semgrep deployment remediation policies dry run** (Run). Preview a remediation policies apply for a Semgrep deployment without changing anything. Validates a candidate bundle and returns the diff a strict apply would produce, plus the state_version to send as If-Match on the follow-up PUT. Returns: state_version, diff. Required: deployment_id. - **Semgrep deployment remediation policies bulk update** (Update). Apply remediation policies for a Semgrep deployment. The submitted list strictly replaces the current state; policies absent from it are deleted. Requires the current state_version via the If-Match header. Returns: remediation_policies, state_version. Required: deployment_id. - **List all Semgrep deployment vocabs** (List). Get the Semgrep policy vocabulary for a deployment, returning condition_types, action_types, value_enums, and detection_bundle_constraints for client-side policy bundle validation. Required: deployment_id. - **List all Semgrep readiness checks** (List). Check whether the Semgrep container started up correctly using the readiness probe endpoint. Returns: attributes. - **Create a Semgrep run** (Create). Execute a Semgrep pattern against target code and return the match results in Semgrep. Returns the pattern match results as defined by the RunPatternResponse schema. Requires a JSON request body conforming to the RunPatternRequest schema with the pattern and target code to scan. - **List all Semgrep deployment dependencies** (List). List all SCA dependencies for a Semgrep deployment with optional filtering by name, version, ecosystem, transitivity, license, lockfile path, and repository. Returns paginated dependency records including name, version, ecosystem, and transitivity. Required: deployment_id. - **Create a Semgrep deployment dependency** (Create). List all or filtered dependencies for a Semgrep SCA deployment using a POST request body with pagination. Returns a paginated list of dependencies for the deployment. Required: deployment_id. - **Create a Semgrep deployment sbom async** (Create). Start an asynchronous job to generate a Software Bill of Materials (SBOM) for a Semgrep deployment. Returns: task_token_jwt. Required: deployment_id. The endpoint does not return the SBOM itself; use the task JWT with the Tasks Service to poll for job status and results. - **Create a Semgrep scm ado app** (Create). Create an Azure DevOps SCM App in Semgrep using Entra ID Service Principal credentials. Returns the created app response with proto-schema-specific fields including a generated public certificate for upload to the customer's Entra app registration. CompleteAdoScmAppInstall must be called separately to finish the install. A request body with Service Principal credentials is required. - **Semgrep scm ado app installs bulk update** (Update). Complete an Azure DevOps SCM App install in Semgrep. After the certificate is uploaded, verifies the Service Principal can authenticate to ADO, creates webhook subscriptions required for the integration, and marks the install as ready. Returns the completion response object. - **Create a Semgrep scm app request** (Create). Create a new SCM app request in Semgrep. Returns the created SCM app request response object. A JSON request body is required; the upstream schema is defined by protos.scm.v1.CreateScmAppRequestRequest. - **Semgrep scm app request completes bulk update** (Update). Complete an SCM app request in Semgrep by submitting the completion details. Returns a completion response object. Requires a JSON request body. The request and response schemas are referenced in the Semgrep v2 OpenAPI spec as protos.scm.v1.CompleteScmAppRequestRequest and protos.scm.v1.CompleteScmAppRequestResponse but their field-level structure is not documented in the available source. - **List all Semgrep deployment configs** (List). List all SCM configs for a Semgrep deployment. Returns: id, name. Required: deployment_id. - **Create a Semgrep deployment config** (Create). Create a new SCM config in a Semgrep deployment. Returns: id, name. Required: deployment_id. - **Semgrep deployment configs search** (Search). Search for SCM configs in a Semgrep deployment. Returns: id, name. Required: deployment_id. - **Update a Semgrep deployment config by ID** (Update). Update an existing SCM config in a Semgrep deployment. Returns: id, name. Required: deployment_id, id. - **Delete a Semgrep deployment config by ID** (Delete). Delete an SCM config by its ID in a Semgrep deployment. Returns an empty 204 response on success. Required: deployment_id, id. - **Create a Semgrep config sync** (Create). Sync an SCM config in Semgrep by deployment and config id. Returns the SyncScmConfigResponse object with schema-specific fields defined in the Semgrep protobuf API. Required: deployment_id, config_id. - **List all Semgrep config checks** (List). Check the status of an SCM config in Semgrep. Returns the check status response with fields defined by the protobuf schema protos.scm.v1.CheckScmConfigResponse. Required: deployment_id, config_id. - **List all Semgrep deployment scm apps** (List). List all SCM apps for a Semgrep deployment. Returns SCM app records with id and provider-specific attributes. Required: deployment_id. - **Delete a Semgrep deployment scm app by ID** (Delete). Delete an SCM app by its ID in Semgrep. Returns a 200 OK confirmation response. Required: deployment_id, id. - **Get single Semgrep deployment scm app by ID** (Get). Get a single SCM app in Semgrep by id. Returns: id, attributes.scm.v1.ScmApp definition in the upstream OpenAPI specification). Required: deployment_id, id. - **List all Semgrep scm apps public ghas** (List). Get the status of a public GitHub App for a Semgrep deployment. Returns the GitHub App status response object. Required: deployment_id. - **Create a Semgrep scm app add ado project** (Create). Add a new Azure DevOps project to an existing Entra App install in Semgrep. The service principal must already have permissions on the ADO project. Returns an AddAdoScmProjectResponse object confirming the addition. Required: deployment_id, scm_app_id. - **Create a Semgrep scm app rotate webhook secret** (Create). Rotate the webhook secret for an SCM app in Semgrep — generates a new secret, updates it on the SCM provider, and persists it. Returns the response object with proto-schema-specific fields. Required: deployment_id, scm_app_id. - **List all Semgrep deployment subscriptions** (List). List all SCM webhook subscriptions for a Semgrep deployment. Returns: subscriptions (array of webhook subscription objects). Required: deployment_id, config_id. - **Update a Semgrep deployment subscription by ID** (Update). Subscribe to SCM webhook events in Semgrep for a specific deployment and SCM configuration. Returns the subscription confirmation response. Required: deployment_id, id. - **Delete a Semgrep deployment subscription by ID** (Delete). Delete an SCM webhook subscription for a Semgrep deployment, unsubscribing it from webhook events. Returns an opaque 200 OK response whose fields are not enumerated in the available source. Required: deployment_id, id. - **Create a Semgrep subscription rotate secret** (Create). Rotate the webhook secret for an SCM webhook subscription in Semgrep. Generates a new secret, updates it on the SCM provider, and persists it. Returns: webhook_secret. Required: deployment_id, config_id. - **List all Semgrep project settings** (List). Get a project's managed scan settings in Semgrep. Returns the settings object including id and attributes, or an empty result if the project does not have managed scanning set up. Required: deployment_id, project_id. - **Create a Semgrep support case** (Create). Create a new support case in Semgrep by submitting a support case request. Returns the created support case response object. Requires a JSON request body with support case details. - **List all Semgrep support cases** (List). List support cases for a Semgrep organization. Returns the support cases response object for the specified organization. Required: orgid. - **List all Semgrep survey names** (List). Get a company survey response in Semgrep by survey name. Returns the survey response object with content-type-specific fields defined upstream in the GetSurveyResponseResponse proto schema. Required: survey_name. - **Create a Semgrep survey submit** (Create). Submit a company survey response in Semgrep by providing a JSON request body with the survey answers. Returns a confirmation object from the survey service whose fields are defined by the upstream CreateSurveyResponseResponse proto schema. Required: a JSON request body. - **List all Semgrep tasks** (List). Get the status and result of a Semgrep async task or task group by its task token JWT. Returns: status, result (present when the task is completed). Required: task_token_jwt. - **Semgrep deployment tokens bulk delete** (Delete). Delete all tokens matching the given filters in a Semgrep deployment. Only CLI and API tokens can be bulk-deleted. Returns an empty 204 response on success. Required: deployment_id, purpose. role_filter is required when purpose is TOKEN_PURPOSE_API and must not be set for TOKEN_PURPOSE_CLI. - **Create a Semgrep issue autofix** (Create). Trigger an Autofix workflow for a Semgrep issue. The workflow runs asynchronously — it analyzes the issue, generates a fix, and opens a pull request in the underlying repository. Supports SAST, AI SAST, and SCA issue types resolved server-side. Returns: success. Required: deployment_id, issue_id. This feature is currently in Public Beta. - **List all Semgrep deployments** (List). List Semgrep deployments your auth token can access. Returns: id, name, slug, findings. Auth scope currently covers only the single deployment your token can access. - **List all Semgrep deployment projects** (List). List all projects scanned or onboarded to Managed Scans in a Semgrep deployment. Does not return archived repositories. Returns: created_at, default_branch, id, latest_scan_at, name, primary_branch, tags, url. Returns 100 projects per page by default. Required: deployment_slug. - **Delete a Semgrep deployment project by ID** (Delete). Delete a Semgrep project by id. Permanently deletes the project and all of its findings; this action cannot be reversed. Returns: id, name. Required: deployment_id, id. - **Semgrep deployment projects update tags** (Update). Add tags to a Semgrep project within a deployment. Tags that do not already exist for the deployment are created automatically and associated with the project. Returns the API response object. Required: deployment_slug, project_name. - **Semgrep deployment projects delete tags** (Delete). Remove tags from a Semgrep project within a deployment. Tags are only removed from the specified project; other projects associated with the same tag remain unaffected. Returns the API response object. Required: deployment_slug, project_name. - **Get single Semgrep deployment project by ID** (Get). Get a specific Semgrep deployment project by its ID. Returns the project object including its id. Required: deployment_id, id. - **Semgrep deployment projects get by name** (Get). Get project details. Returns: project. Required: deployment_slug, project_name. - **Semgrep deployment projects delete by name** (Delete). Delete a Semgrep deployment project by deployment slug and project name. This also deletes all associated findings. Returns an empty 204 response on success. Required: deployment_slug, project_name. - **Semgrep deployment projects bulk update** (Update). Update attributes for a Semgrep project using the request body. Returns the API response object. Required: deployment_slug, project_name. - **Get single Semgrep project branch by ID** (Get). Get a single project branch in Semgrep by its ID. Returns the branch object including its id and branch-specific attributes. Required: deployment_id, project_id, id. The v2 API is under active development; expect potential breaking changes. - **Create a Semgrep scans retry** (Create). Retry one or more failed Semgrep Managed Scans (SMS) in a deployment. Only scans that are SMS and have failed or never finished can be retried. Returns: tasks (one per successful retry) and errors (one per failed retry). Required: deployment_id. - **List all Semgrep deployment scans** (List). Get details of a specific Semgrep scan by ID. Returns the scan details including associated deployment, repository, and commit information. Required: deployment_id, scan_id. - **Semgrep deployment scans search** (Search). List scans (beta). Returns: cursor, scans. Required: deployment_id. - **Get single Semgrep deployment scan by ID** (Get). Get a Semgrep scan by its ID within a deployment. Returns: id, attributes. Required: deployment_id, id. - **List all Semgrep bootstrap sms vpcs** (List). Get the Semgrep Managed Scans (SMS) VPC Bootstrap CloudFormation template. Returns the cross-account infrastructure template in JSON format with AWSTemplateFormatVersion, Description, and Resources including IAM roles, policies, and EC2 Image Builder distribution roles for SMS VPC automation. This is a beta feature. - **List all Semgrep deployment policies** (List). List policies for a Semgrep deployment. Returns each policy with id, name, and slug. Required: deployment_id. - **Update a Semgrep deployment policy by ID** (Update). Update a specific policy in a Semgrep deployment. Returns the updated policy with id, name, and slug. Required: id, deployment_id. - **Get single Semgrep deployment policy by ID** (Get). Get the rules of a specific Semgrep deployment policy by policy id. Returns: cursor, policy, rules. Required: id, deployment_id. - **Create a Semgrep sbom export** (Create). Create a new SBOM export job in Semgrep for a deployment. Returns a JSON response from the SBOM export service that can be used to track the export job status via the sibling status endpoint. Required: deployment_id. - **Get single Semgrep sbom export by ID** (Get). Get the status of a Semgrep SBOM export job by deployment and task token. Returns the SBOM export job status response. Required: id, deployment_id. - **List all Semgrep deployment secrets** (List). List secret findings for a Semgrep deployment, filterable by severity, status, validation state, repository, and detection time. Returns: cursor, findings, previous. Required: deployment_id. - **Delete a Semgrep ticketing ticket by ID** (Delete). Unlink a Jira ticket from a Semgrep deployment by its external ticket ID. Returns an empty 204 response on success. Required: id, deployment_id. - **Semgrep project managed scans bulk update** (Update). Toggle Managed Scans for a project. Returns: project. Required: deployment_slug, project_name. - **Create a Semgrep deployment ticket** (Create). Create Jira tickets for Semgrep findings by passing issue_ids or filter parameters to dynamically select findings. Returns the response with a failed array listing issues that were not ticketed. Synchronous; defaults to 20 tickets per request; groups findings by repo and rule into a single ticket (up to 50 issues per ticket). Required: deployment_slug, issue_type. - **Create a Semgrep deployment triage** (Create). Bulk triage findings in a Semgrep deployment, selecting targets by finding IDs (issue_ids) or filter query parameters. Returns a BulkTriageResponse with the results of the triage operation. If specifying new_triage_reason, new_triage_state must be set to ignored. Required: deployment_slug, issue_type. - **List all Semgrep pings** (List). Ping the Semgrep server to assert liveness. Returns a PingResponse confirming the server is reachable. No required parameters. - **Create a Semgrep notification webhook** (Create). Create a new notification webhook endpoint for a Semgrep deployment. Returns the created webhook object including its id. Required: deployment_id. A JSON request body is required but its field definitions are defined by the upstream CreateNotificationWebhookRequest schema. - **Get single Semgrep notification webhook by ID** (Get). Get a specific notification webhook by id within a Semgrep deployment. Returns the webhook object including its id. Required: deployment_id, id. - **Update a Semgrep notification webhook by ID** (Update). Update a notification webhook in Semgrep by replacement. Returns the updated webhook object including its id. Required: deployment_id, id. - **Delete a Semgrep notification webhook by ID** (Delete). Delete a notification webhook in Semgrep by its id. Returns an empty 204 response on success. Required: deployment_id, id. - **List all Semgrep users lists** (List). Retrieves a paginated list of users associated with a specific deployment, accepting pagination details in the request body. Experimental endpoint requiring deployment_id.