Security
Semgrep MCP connector
The Semgrep connector brings your Semgrep findings, issues, deployments and ignore rules into Claude, ChatGPT, Cursor and any MCP client, so each person can search, triage and update them under their own Semgrep access with every action logged.
-
How it connects. Connects with an API key. The credential goes into a vault nobody reads back.
-
One address. https://api.elaichi.ai/mcp, the same for every user.
-
Their own access. An agent never gets more than the person it acts for.
208 tools
How to connect
How to connect Semgrep to Claude, ChatGPT or Cursor
Two steps, about a minute.
In Elaichi
Connect Semgrep once
-
Open Connections, choose Add connection, and pick Semgrep.
-
Optionally set Share with to give a team access, then press Connect.
-
Paste a Semgrep API key. One person generates a token in Semgrep and pastes it once. Everyone else works through Share with, and never sees it.
The credential is vaulted. Nobody reads it back, not even the AI.
Add connection
Choose a connector.
In your AI client
Point it at one endpoint
Everyone in the organization uses the same address, and each person only ever reaches what their own account allows.
Connect Semgrep to Claude
-
1
Open Customize, then Connectors.
-
2
Press Add.
-
3
Name it, paste the MCP server URL, then Continue.
https://api.elaichi.ai/mcp -
4
Sign in and approve.
On Team and Enterprise, an Owner adds it once. Everyone else turns it on for themselves.
Connect Semgrep to ChatGPT
-
1
Open Plugins, then press the + button.
-
2
Name it and paste the endpoint into Server URL.
https://api.elaichi.ai/mcp -
3
Leave Authentication on OAuth, then tick the risk acknowledgement.
-
4
Press Create, then sign in and approve.
Works on the web today. The plugin directory lives at chatgpt.com/plugins.
Connect Semgrep to Cursor
-
1
Open
~/.cursor/mcp.json. -
2
Add the endpoint under
mcpServers.https://api.elaichi.ai/mcp -
3
Reload Cursor, then sign in and approve.
~/.cursor/mcp.json
{
"mcpServers": {
"elaichi": {
"url": "https://api.elaichi.ai/mcp"
}
}
}
Set up per machine, so repeat it on each computer you work from.
Connect Semgrep to any MCP client
-
1
Add the endpoint as a remote MCP server.
https://api.elaichi.ai/mcp -
2
Sign in and approve.
{
"mcpServers": {
"elaichi": {
"url": "https://api.elaichi.ai/mcp"
}
}
}
The Elaichi Agent already has these tools, with nothing to set up.
Use cases
What teams do with Semgrep through Elaichi
Every one of these runs inside the access the person already has, and lands in the same audit log.
-
Security
Triage new findings before standup
Ask for the Semgrep findings that appeared overnight, grouped by severity and repository, and mark the ones that are already handled as resolved in one pass.
-
Engineering
Understand an issue before fixing it
Pull up a single Semgrep issue by its ID, read the rule that flagged it and the line it points at, and get a plain explanation of why it matters before opening the file.
-
Security
Clear false positives in bulk
When a rule keeps flagging test fixtures, search for every matching finding and update them together instead of clicking through each one in the Semgrep dashboard.
-
Platform
Keep ignore rules tidy
List the ignores set on a Semgrep deployment, spot the ones that are stale or too broad, and update or remove them together so real problems stop being hidden.
-
Compliance
Report open issues by severity
Search Semgrep issues across a deployment and summarize how many are open, how old they are and which repositories carry the most, ready to paste into an audit response.
-
Engineering management
Check which repositories are covered
Review each Semgrep deployment, its tags, its notification rules and whether the GitHub app is connected, so you know which teams are actually being scanned.
Try asking
- “List open Semgrep findings for the platform deployment.”
- “Which notification rules are set on our Semgrep deployment?”
- “Summarize Semgrep findings created in the last 14 days.”
AI tools
Semgrep tools for your AI agents
208 tools are ready to call through Elaichi's MCP endpoint the moment you connect Semgrep, governed by the same roles, restrictions, and audit log as everything else in Elaichi.
No tools match your search.
See it in Elaichi
What connecting Semgrep gets you
6 screens from the product, each doing one job for your Semgrep account.
The agent
Ask about Semgrep findings in plain language.
Starter prompts return answers from live Semgrep findings, deployments and notification rules.
- findings
- deployments
- actions
- notification rules
Ask Elaichi to work across your apps.
List open Semgrep findings for the platform deployment.
Which notification rules are set on our Semgrep deployment?
Summarize Semgrep findings created in the last 14 days.
Also runs in Claude, ChatGPT or Cursor
MCP clients
Claude, ChatGPT and Cursor reach Semgrep here.
One org MCP endpoint over OAuth, no SDK and no shared API key.
ElaichiMCP clientsClaude
ChatGPT
Cursor
Copy the endpoint
Tool catalog
208 Semgrep tools are ready to call.
Deployments, findings, actions, tags and user roles, with no custom code written.
- List all Semgrep agent deployments
- Create a Semgrep agent deployment
- Get single Semgrep agent deployment by ID
- Update a Semgrep agent deployment by ID
ElaichiToolsToolboxes
Each team gets its own Semgrep toolbox.
Curate one toolbox for AppSec findings and another for platform deployments.
- AppSec
- Platform Engineering
- Backend
- Compliance
ElaichiToolboxesShared connections
Teammates use Semgrep without seeing a token.
Connections show who connected each Semgrep account and which teams and members share it.
- AppSec
- Platform
- Backend
- Compliance
ElaichiConnectionsAudit log
Every Semgrep call is written down.
When, who, what happened, type and resource for each finding update and deployment change.
- When
- Who
- What happened
- Type
ElaichiAudit logLaunching soon
From answering questions to doing the work
A person no longer has to ask. A trigger starts the work, inside the same permissions and the same audit log as everything else. Automations and live dashboards are launching soon, on the Black plan.
Automations
A schedule turns Semgrep findings into a digest.
Six steps fetch findings, group them, draft a digest, get approval, post back.
Semgrep digest
Run 418 · started 2 minutes ago · on behalf of Emma Laurent
-
✓
Schedule
Every weekday at 08:00
0.2s -
✓
Fetch findings
Semgrep
1.4s -
✓
Group by owner
Transform
0.1s -
✓
Draft the digest
Agent step
Ran with 4 tools, returned a structured summary
6.2s -
Approve the digest
Needs approval
Assigned to Michael Brennan
Approve Deny -
Post the digest
Semgrep
Queued
Collections and dashboards
Semgrep findings counted, not asked about.
Four metrics, 14 days of findings created and a team breakdown, refreshed on schedule.
Semgrep health
Refreshed 4 minutes ago · every 15 minutes · from the findings collection
Findings
1,284 ↓ 12%
Deployments
96 ↓ 8%
Needs attention
3 ↑ 2
Updated this week
412 ↑ 9%
Findings created
Last 14 days
By team
Share of activity
AppSec 34%
Platform 27%
Backend 21%
Compliance 18%
Related connectors
More from the catalog
FAQ
Frequently asked questions
How do I connect Semgrep to Claude?
Connecting Semgrep to Claude takes two steps. First, connect Semgrep in Elaichi by pasting an API key from your Semgrep account settings, there is no OAuth application to register and no client ID or secret to generate. Then in Claude go to Customize, then Connectors, then Add, and paste the endpoint https://api.elaichi.ai/mcp. Claude signs in through Elaichi and your Semgrep findings, issues and deployments are available.
Does Semgrep work with ChatGPT and Cursor as well as Claude?
Yes. Once Semgrep is connected in Elaichi, the same endpoint, https://api.elaichi.ai/mcp, works in Claude, ChatGPT, Cursor, any other MCP client and the Elaichi Agent. You connect Semgrep once and every client you use picks it up.
What can an AI agent actually do with my Semgrep data?
With Semgrep connected, an agent can search your findings and issues, open a single issue to explain what the rule caught, and update a batch of findings after you have triaged them. It can also list your Semgrep deployments, their tags and notification rules, check whether the GitHub app is connected, and create, update or remove ignore rules and deployment actions. Because Semgrep exposes a long list of actions, short concrete asks such as "open critical findings in the payments repo" work better than long paragraphs.
Does connecting Semgrep give the AI every deployment and every finding?
No. When someone connects Semgrep, the agent works within that person's own Semgrep access, so it sees the deployments and findings they can already see in Semgrep and nothing more. Elaichi can narrow that further, for example to read-only or to a single deployment, but it can never widen it beyond what Semgrep itself grants.
Can I stop an agent from deleting ignore rules or changing findings in Semgrep?
Yes. Restrictions in Elaichi work per action, so you can allow searching Semgrep findings and issues while blocking updates to findings, deletion of ignore rules or changes to deployment actions. A blocked action is never shown to Claude, ChatGPT or any other client at all, so no prompt, however worded, can reach it.
What happens to a Semgrep connection when someone leaves?
When a person is offboarded in Elaichi, their access to Semgrep through every connected client ends at once. If they had shared a Semgrep connection with a team, it keeps working for everyone else on that team. Disconnecting Semgrep once in Elaichi removes it from Claude, ChatGPT, Cursor and every other client in the same step.
Put Semgrep in front of your team
Fourteen days on Gold, no credit card. Connect it once and pick what each team can call.