Semgrep: MCP server, CLI and agent surfaces

Sign-in required, tools not seen, not counted. The MCP endpoint listed for Semgrep at mcp.semgrep.ai answered 401 with OAuth metadata on 4 November 2026. Its tools can be listed only after a person authorizes a client, and this directory never signs in.

Fact sheet

Company	Semgrep
Domain	semgrep.dev
Category	Developer Tools (Ora leaderboard category)
MCP server	Sign-in required (OAuth with client registration)
Ora score	60, grade C; Ora scanned the domain on 5 October 2026 and the cached score was read on 5 November 2026 from Ora's leaderboard (Ora's score page for semgrep.dev, a vendor-published score)
Company found through	the awesome-remote-mcp-servers list; Ora's public leaderboard
Last verified	4 November 2026

MCP server

Endpoint	`https://mcp.semgrep.ai/mcp`
How it was found	listed in the awesome-remote-mcp-servers list; Ora's public leaderboard
Transport	streamable-http
HTTP status	401
Connected	4 November 2026, 20:04 UTC
Handshake time	1,575 ms over 1 attempt

The endpoint answered the handshake with a sign-in challenge, so the tool list is not visible to this directory. It is not counted as an MCP server: a sign-in challenge is its own state, and the connector listed no tools.

Connector log

3 connections on 4 November 2026, read-only methods only

19:59:24Z https://mcp.semgrep.ai/sse sent initialize result no-answer (HTTP 404) 1236 ms
20:04:26Z https://mcp.semgrep.ai/sse sent initialize result no-answer (HTTP 404) 1246 ms
20:04:28Z https://mcp.semgrep.ai/mcp sent initialize result auth-required (HTTP 401) 1575 ms

Authentication

Auth type	OAuth with client registration
What the challenge said	`Bearer error="invalid_token", error_description="Authentication required", resource_metadata="https://mcp.semgrep.ai/.well-known/oauth-protected-resource"`
Protected resource metadata	mcp.semgrep.ai
Authorization server metadata	login.semgrep.dev
Registration endpoint	`https://login.semgrep.dev/oauth2/register`
Client ID metadata documents	supported
Auth as listed by a registry	Open (a claim, not checked by connecting)

The sign-in route, step by step

Request https://mcp.semgrep.ai/mcp without a token. It answers 401 and a WWW-Authenticate header.
Read the protected resource metadata at https://mcp.semgrep.ai/.well-known/oauth-protected-resource to find the authorization server.
Register a client at the registration endpoint https://login.semgrep.dev/oauth2/register (dynamic client registration), so no human has to create an app first.
Send a person through the authorization page, then retry the endpoint with the bearer token. The connector stops after step 2 and never authorizes.

See OAuth for MCP: client ID metadata documents and dynamic registration for how each route works.

CLI

No CLI is on record for Semgrep. The directory checks a package only where a source names one, so this is a floor: a company can ship a command line that no source read for this edition mentions. See shipping a CLI agents can use.

Other agent surfaces

Agent surfaces other than MCP and CLI
Surface	Result
OpenAPI file	No OpenAPI file at the root paths checked.
WebMCP in the initial HTML	Not detected on the home page by the shared crawl.
MCP discovery file	Not found (the crawl got a non-200 answer).
A2A agent card	Not found (the crawl got a non-200 answer).
A2A agent card (older path)	Not found (the crawl got a non-200 answer).
agents.json	Not found (the crawl got a non-200 answer).
OAuth authorization server metadata	Found: semgrep.dev/.well-known/oauth-authorization-server answered with a valid document in the shared crawl.
NLWeb endpoint	Not checked in this edition.

Registry listings

Registry listings
Registry	Listed
Official MCP Registry	No
GitHub MCP Registry	No
awesome-remote-mcp-servers	Yes
Smithery	Not checked: Smithery's listing pages and search API were unavailable on 4 November 2026.
Glama	Not checked: Glama's API needs a key and attribution terms.