MCP Server Semgrep

🚀 MCP Server Semgrep Static Code Analysis Tool

This tool is designed to perform static code analysis on MCP servers, helping to detect potential security issues and ensure code quality.

🚀 Quick Start

First, install the Semgrep tool and configure environment variables as described below. Then, you can start scanning your project using the provided usage examples.

✨ Features

• Support multiple installation methods.
• Provide various usage examples, including project scanning, style consistency analysis, custom rule creation, result filtering, and problem pattern identification.
• Allow users to create custom rules for specific code issues.
• Clearly show the project structure.
• Offer detailed documentation and examples.

📦 Installation

Install the Semgrep Tool

You can install Semgrep in multiple ways:

• Node.js:

  npm install -g semgrep
  

• Python:

  pip install semgrep
  

• Homebrew (macOS):

  brew install semgrep
  

• Linux:

  sudo apt-get install semgrep
  # Or
  curl -sSL https://install.semgrep.dev | sh
  

• Windows:

  pip install semgrep
  

Configure Environment Variables

After installation, add the path of the Semgrep tool to your system environment variables for subsequent use.

💻 Usage Examples

Basic Usage

Project Scanning

Could you scan my source code in the /projects/my-application directory for potential security issues?

Style Consistency Analysis

Analyze the z-index values in the project's CSS files and identify inconsistencies and potential layer conflicts.

Create Custom Rules

Create a Semgrep rule that detects improper use of input sanitization functions.

Filter Results

Show me only scan results related to SQL injection vulnerabilities.

Identify Problem Patterns

Find all "magic numbers" in the code and suggest replacing them with named constants.

Advanced Usage

Example of Creating Custom Rules

Rule for Detecting Inconsistent z-index

rules:
  - id: inconsistent-z-index
    pattern: z-index: $Z
    message: "Z-index $Z may be incompatible with the project's layering system"
    languages: [css, scss]
    severity: WARNING

Rule for Detecting Deprecated Imports

rules:
  - id: deprecated-import
    pattern: import $X from 'old-library'
    message: "You are using a deprecated library. It is recommended to use 'new-library'"
    languages: [javascript, typescript]
    severity: WARNING

📚 Documentation

Project Structure

├── src/
│   ├── config.ts         # Server configuration file
│   └── index.ts          # Program entry and implementation of all handlers
├── scripts/
│   └── check-semgrep.js  # Semgrep detection and installation helper tool
├── build/                # Compiled JavaScript files (generated after build)
└── tests/                # Unit test files

Further Documentation

For detailed usage instructions, please refer to:

• USAGE.md - Detailed usage guide
• README_PL.md - Chinese documentation
• examples/ - Example rules and "Hall of Code Horrors" cases

📄 License

This project is licensed under the MIT License. For details, please see the LICENSE file.

👥 Developers

• Maciej Gad - Project lead
• Petr Vavřička - Contributor

🤝 Contributing

We welcome developers from the community to actively participate in the development and maintenance of this project. If you have any questions or suggestions, please contact us via the following methods:

• Email: contact@divanov.top
• GitHub repository: MCP-Server-Semgrep

Thank you for your support and cooperation!