Skip to main content
Semgrep Guardian integrates natively with AI coding agents to catch security issues before they ship. It bundles the Semgrep MCP server, Hooks, and Skills into a single install, and scans every file an agent generates using Semgrep Code, Supply Chain, and Secrets. When findings are detected, the agent is prompted to regenerate code until Semgrep returns clean results or you choose to dismiss them.

​
How Guardian works

Guardian runs at authoring time, on the developer’s machine, rather than in CI:
  1. Your coding agent writes or edits a file.
  2. A hook (or an MCP tool call, depending on the integration) triggers a Semgrep scan of what the agent just generated.
  3. If Semgrep returns findings, the agent receives them and is prompted to regenerate the code.
  4. The loop repeats until the scan is clean or you dismiss the findings.
Because the scan happens before the code is committed, Guardian complements rather than replaces your CI and platform scans. For scanning repositories in CI, see Set up and deploy scans.

​
Two setup paths

Guardian has two materially different integration paths. Which one you use changes how you authenticate, whether you need a local Semgrep CLI, and which rules Guardian scans with:
  • Claude Code with the remote plugin (recommended). Uses Semgrep’s hosted remote server and authenticates through OAuth. No local Semgrep CLI required.
  • All other agents, and the local Claude Code plugin. Runs Semgrep through a locally installed CLI.
See Choose your setup for a full comparison, or go straight to the Quickstart if you use Claude Code. These paths do not scan with the same rules. The recommended remote plugin runs a fixed ruleset and does not apply your organization’s Policies; the local CLI integrations do. See Rules and configuration.

​
Next steps

Quickstart

Set up Guardian with Claude Code in a few minutes.

Choose your setup

Compare the remote and local CLI paths before you install.

Rules and configuration

Which rules Guardian scans with, and when that differs.

Deploy across your organization

Roll Guardian out to a fleet with marketplace controls or MDM.

​
Additional resources