MCP Server
The agent asks Semgrep and Semgrep answers. The MCP server exposes Semgrep scanning as tools the agent can call directly.
Learn more about the MCP →For security teams enforcing policy
Automatically secure the code your agents ship
Guardian runs your Semgrep policies the moment an agent writes a file, blocks what violates them, and returns the finding context in the session.
95% of Guardian scans complete in under 5 seconds across more than 3 million scans each week.
Claude Code › writes payments/api.py
+ query = f"SELECT * FROM users WHERE id = {user_id}"
Guardian hook › runs your Semgrep policy
acme-prod · SQL injection BLOCKED
User input reaches a database query without parameterization.
Claude Code › updates the query using the finding context
- f"… WHERE id = {user_id}"
+ cur.execute("… WHERE id = %s", (user_id,))
Guardian › policy check passed on the updated file
Policy at generation time
Fast and deterministic scans
Guardian combines deterministic Semgrep checks with the context of the active Claude Code session. Every engineer gets the same enforcement on every file.
95%of Guardian scans complete in under 5 seconds
3M+Guardian scans run across customers every week
Stays in your engineers' loop
One install, the same enforcement on every file
An MCP server and hooks ship together in one plugin, so policy runs where engineers already work.
Hooks
Hooks fire whenever Claude Code writes a file, ensuring a scan regardless of what the agent does or forgets.
Learn more about Hooks →What it enforces
Four policy areas teams can bring into Claude Code
Supply Chain
Block what shouldn't install
Malicious and compromised packages from the Semgrep database- Typosquats and slopsquats in agent-suggested dependencies
- Risky packages blocked before they install
Code security
OWASP guardrails at generation time
- OWASP Top 10 guardrails on generated code
- SQL injection, XSS, and IDOR blocked as they are written
- AI-specific risks such as prompt injection and unsafe tool use
Secrets
Keep credentials out of code
- Keys, tokens, and passwords caught before version control
- Credentials required to come from a vault or environment variable
- Cloud provider credentials caught before they leak
Custom rules
Bring your own code standards
- The Semgrep rules your team already maintains
- Custom rules for your frameworks and internal APIs
- The same finding context your reviewers use
Custom rules
You decide where rules run
Run your own Semgrep rules at generation time, in CI, or both. Put fast, deterministic checks in the agent session and leave heavier analysis to the pipeline.
ruleset: acme-secure-defaults
at generation › internal-api-auth-required
in CI › cross-file taint rules
ruleset: acme-secrets
at generation › no-hardcoded-credentials
in CI › historical secret scanning
See it centrally
Every finding, every repo, in the Semgrep AppSec Platform
Guardian reports what it catches to the Semgrep AppSec Platform, so security teams see findings and activity across projects in one place.
- What agents introduce, by repo and by policy
- The same platform your team already uses to triage and track
Guardian activity
Developer adoption
Findings
Policy checks
Malicious dependencies blocked
Roll it out safely
Deploy Guardian across engineering, on your terms
Roll out through the agent console or your MDM in a few hours.
- Read-only tokens scoped to scanning and reporting
- The same policies across every Claude Code session in your organization
- Plugin rollout through existing enterprise controls, with one-click CI/CD deploy and SSO
- Zero-click sign-in for developers when you deploy through MDM
Pricing
Guardian plans for every way you build
Choose the plan that fits how you or your organization builds with AI.
Guardian
$10/month
per seat after a 30-day free trial
Guardian-only for individual developers and teams of any size.
- Guardian runs in Claude Code
- SAST, SCA, and Secrets checks
- In-editor findings and guided remediation
Guardian + Semgrep Code
$40/month
per seat for the bundle
Bundles Guardian with Semgrep Code. Teams can still choose Guardian-only for $10 per seat.
- Cross-file analysis with Pro rules
- AI-powered detection, triage, and remediation
- 20 AI credits per developer each month
- One-click CI/CD deploy, SSO, and award-winning support
Enterprise
Custom
For larger organizations planning a tailored rollout.
- Guardian for larger organizations
- Tailored rollout
- Custom pricing through Semgrep Sales
Ship secure code today
Bring Guardian into Claude Code so malicious packages, hardcoded secrets, and vulnerable patterns are caught before they reach a pull request.