Semgrep Guardian enterprise deployment

To deploy Semgrep Guardian organization-wide, configure each developer’s coding agent to install the plugin automatically. This eliminates the need for developers to install the plugin manually. For individual developer setup, see the Quickstart.

Before you deploy

Each developer still signs in to Semgrep individually once Guardian is installed. Read Authentication first. It covers the OAuth and CLI sign-in models, where credentials are stored, and why shared tokens and service accounts are discouraged for fleet deployments. When developers cannot sign in individually, deploy Guardian with a read-only token. This requires Semgrep Enterprise. For more information, see Deploy with a read-only token.

Prerequisites

You have a Semgrep account and organization.
You are an admin for your coding agent’s enterprise controls and your MDM platform, if applicable.
Claude Code is the recommended setup for organization-wide deployment.

Option 1: Use your agent’s built-in enterprise controls

Many coding agents let you pin an approved marketplace or plugin for your whole team. This is the simplest way to enable Guardian across your organization or make it required.

Claude Code
Cursor

Enable the plugin in your managed settings

Modify your Claude marketplace settings to include Semgrep in your enabled plugins list:

{
  "enabledPlugins": {
    "semgrep@claude-plugins-official" : true
  }
}

Confirm the plugin is connected

Run claude mcp get plugin:semgrep:guardian and confirm it reports as connected.

Guardian is published to the Claude official marketplace (claude-plugins-official), so the payload only needs to enable the plugin. There’s no separate marketplace to declare. See Require marketplaces for your team for more information.

Add a team marketplace

Go to Dashboard > Plugins. Under Team Marketplaces, click Add Marketplace, then create a marketplace from scratch or use Import from Repo to import from GitHub. For Guardian, import semgrep/cursor-plugin, then add the Semgrep plugin with Add to Marketplace.

Scope who gets it

Under Marketplace Settings > Marketplace Access, restrict the marketplace to the Organization Groups that should receive Guardian, then save. Only members of the marketplace’s team who belong to a selected group get access.

Set the installation mode

Set the Semgrep plugin’s installation mode:

Default Off: developers can find the plugin and choose whether to install it.
Default On: the plugin is installed by default, but developers can opt out.
Required: the plugin is always installed and cannot be uninstalled.

For an enforced deployment, choose Required.

Confirm the plugin is connected

Open Customize in the Cursor sidebar and confirm that the Semgrep plugin appears under the team scope and that its MCP server is toggled on.

Installation modes apply only to plugins available in a team marketplace, not to plugins that developers install themselves from the public Cursor Marketplace. Team marketplaces are available on Teams and Enterprise plans. Only admins can add plugins to a team marketplace. For more information, see Team marketplaces.

Option 2: Deploy through a mobile device management (MDM) platform

Deploy through your MDM platform to scope the deployment by device group. These templates configure Claude Code only. To deploy Guardian to Cursor, use Option 1.

These are community-maintained templates and may be unsupported or incorrect. You are responsible for verifying the configuration before deploying it to a fleet.

Jamf
Iru (Kandji)

Deploy a Custom Settings payload with preference domain com.anthropic.claudecode through a Configuration Profile.

Create the property list

Save the following as com.anthropic.claudecode.plist.

com.anthropic.claudecode.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>enabledPlugins</key>
	<dict>
		<key>semgrep@claude-plugins-official</key>
		<true/>
	</dict>
</dict>
</plist>

Upload it as a Custom Settings payload

Follow Jamf’s guide, Deploying Custom Computer Configuration Profiles Using the Application and Custom Settings Payload, using the preference domain com.anthropic.claudecode and the property list above as the uploaded file.

Scope the profile

Scope the Configuration Profile to your target device group.

Deploy a Custom Profile by uploading a configuration profile.

Create the configuration profile

Save the following as semgrep-guardian.mobileconfig, then replace the placeholder values: set PayloadIdentifier and PayloadOrganization to match your organization, and generate a fresh PayloadUUID for both the profile and the payload it contains.

semgrep-guardian.mobileconfig

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadDisplayName</key>
	<string>Claude Code – Semgrep Guardian Plugin Settings</string>
	<key>PayloadDescription</key>
	<string>Enforces the Semgrep Guardian plugin enable/disable policy.</string>
	<key>PayloadIdentifier</key>
	<string>com.yourorg.com</string>
	<key>PayloadOrganization</key>
	<string>yourorg</string>
	<key>PayloadScope</key>
	<string>System</string>
	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadUUID</key>
	<string>DA9306A3-D913-47D0-95D9-0594D39CFE76</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadDisplayName</key>
			<string>Claude Code Marketplace Settings</string>
			<key>PayloadIdentifier</key>
			<string>B85904F9-D6ED-4D4C-BD27-A49B9CCF0E6F</string>
			<key>PayloadType</key>
			<string>com.apple.ManagedClient.preferences</string>
			<key>PayloadUUID</key>
			<string>B85904F9-D6ED-4D4C-BD27-A49B9CCF0E6F</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>PayloadContent</key>
			<dict>
				<key>com.anthropic.claudecode</key>
				<dict>
					<key>Forced</key>
					<array>
						<dict>
							<key>mcx_preference_settings</key>
							<dict>
								<!-- Plugin enable/disable policy -->
								<key>enabledPlugins</key>
								<dict>
									<key>semgrep@claude-plugins-official</key>
									<true/>
								</dict>
							</dict>
						</dict>
					</array>
				</dict>
			</dict>
		</dict>
	</array>
</dict>
</plist>

Upload it as a Custom Profile

Go to Library > Add Library Item > Custom Profile and upload the file.

Name the profile

Name the profile Semgrep Guardian - Managed Settings.

Assign and save

Assign the profile to your blueprint as needed, then save.

These templates enable the plugin only. To deploy a read-only token, add SEMGREP_APP_TOKEN and SEMGREP_GUARDIAN_EMAIL to the same managed settings payload. For the values, see Deploy with a read-only token. For the env key, see Claude Code settings.

Deployment recommendations

Test the deployment on a single machine before pushing to the whole fleet.
After deploying, confirm that Guardian loaded by running claude mcp get plugin:semgrep:guardian and confirming it reports as connected.
Each developer signs in to Semgrep once Guardian is installed, unless you deploy a read-only token. See Authentication for how sign-in works, and the Quickstart for setup steps.

Deploy with a read-only token (Semgrep Enterprise only)

Use a read-only API token when developers cannot complete a browser sign-in, such as on a managed fleet where you provision credentials through your MDM platform.

Create a read-only token

Sign in to Semgrep and go to Settings > Tokens, then set the token scope to read-only. For more information, see Access tokens.

Confirm that the token is read-only

On a machine with the Semgrep CLI installed, run the following command and confirm that it fails:

SEMGREP_APP_TOKEN=READ_ONLY_TOKEN semgrep ci

semgrep ci runs on your machine and sends findings to Semgrep AppSec Platform. A read-only token cannot send findings, so the command fails. If the command succeeds, return to the previous step and create a token with the read-only scope.

Set the environment variables on each developer machine

Set these environment variables:

Variable	Value
`SEMGREP_APP_TOKEN`	The read-only token.
`SEMGREP_GUARDIAN_EMAIL`	The email address of the developer who uses the machine.

You deploy the same token to every machine. Set SEMGREP_GUARDIAN_EMAIL on each machine.Many MDM platforms provide a payload variable for the assigned user’s email address, so you can deploy one profile to the fleet. See your MDM provider’s documentation for the variable name.

Contact Semgrep if you have questions about which approach fits your organization.

Get help with a custom deployment

Contact Semgrep or send a message to the #mcp channel on Slack if you would like help building something custom for your MDM or agent fleet.