Semgrep Sast

Semgrep SAST Scanning

When to Use This Skill

• Running static analysis security testing (SAST) on source code
• Scanning for vulnerabilities, anti-patterns, and code quality issues
• Enforcing coding standards via custom Semgrep rules
• Supply chain security scanning for dependency vulnerabilities
• Pre-commit/pre-merge quality gates
• Integrating SAST into CI/CD pipelines

Target Agents

• cyber-sentinel - Primary user for security vulnerability scanning
• code-reviewer - SAST pass during code reviews
• qa-engineer - Quality gate enforcement with automated scanning
• automated-test-scripter - Integrating SAST into test pipelines
• devops-engineer - CI/CD pipeline SAST integration

Prerequisites

• Semgrep installed: pip install semgrep or pipx install semgrep
• Semgrep token configured: semgrep login (saves to ~/.semgrep/settings.yml)
• Semgrep MCP plugin enabled in Claude Code

Semgrep MCP Plugin Tools

The Semgrep plugin provides these MCP tools for automated scanning:

Scanning Workflows

1. Quick Security Scan

Run a default Semgrep scan on the current project:

# Via CLI
semgrep scan --config auto .

# Via MCP plugin (preferred in Claude Code)
# Use the semgrep_scan tool

2. Supply Chain / Dependency Scan

Check for known vulnerabilities in dependencies:

# Via CLI
semgrep ci --supply-chain

# Via MCP plugin
# Use the semgrep_scan_supply_chain tool

3. Custom Rule Scan

Write and apply custom rules for project-specific patterns:

# Example: Detect hardcoded API keys
rules:
  - id: hardcoded-api-key
    patterns:
      - pattern: $KEY = "..."
      - metavariable-regex:
          metavariable: $KEY
          regex: (api_key|apikey|api_secret|secret_key|auth_token)
    message: "Hardcoded API key detected in $KEY"
    languages: [python, javascript, typescript]
    severity: ERROR

4. Language-Specific Scans

# Python security
semgrep scan --config p/python .

# JavaScript/TypeScript security
semgrep scan --config p/javascript .

# OWASP Top 10
semgrep scan --config p/owasp-top-ten .

# Secrets detection
semgrep scan --config p/secrets .

Severity Interpretation

Integration with Quality Gates

Pre-Merge Quality Gate

# Step 1: Lint (language-specific)
ruff check . || eslint . || rubocop

# Step 2: Semgrep SAST scan
semgrep scan --config auto --error .

# Step 3: Semgrep supply chain
semgrep ci --supply-chain

# Step 4: Tests
pytest || npm test || go test ./...

# Step 5: Dependency audit
pip-audit || npm audit || bundle audit

CI/CD Integration (GitHub Actions)

- name: Semgrep SAST Scan
  uses: semgrep/semgrep-action@v1
  with:
    config: >-
      p/default
      p/owasp-top-ten
      p/secrets
  env:
    SEMGREP_APP_TOKEN: ${{ secrets.SEMGREP_APP_TOKEN }}

Writing Custom Rules

Use the semgrep_rule_schema MCP tool to get the full schema, then write rules:

rules:
  - id: rule-id
    pattern: <semgrep-pattern>
    message: "Description of issue"
    languages: [python]
    severity: WARNING
    metadata:
      category: security
      owasp: "A03:2021 - Injection"

Common Pattern Operators

Scan Output Interpretation

When reviewing Semgrep findings:

1. Triage by severity - ERROR findings first
2. Check for false positives - Review context around the finding
3. Group related findings - Same rule across multiple files indicates systemic issue
4. Map to OWASP - Use metadata.owasp field for compliance tracking
5. Track over time - Compare scan results across commits

Project-Level Configuration

Create .semgrep.yml in project root for persistent configuration:

# .semgrep.yml
rules:
  - p/default
  - p/owasp-top-ten
  - p/secrets

exclude:
  - tests/
  - node_modules/
  - vendor/
  - "*.min.js"

severity:
  - ERROR
  - WARNING

Additional Resources

• Semgrep Registry - Browse community rules
• Semgrep Playground - Test rules online
• Custom Rule Tutorial - Write your own rules