Can AI agents automate Semgrep?

Semgrep is automatable today through the official Semgrep CLI. This record is Semgrep SAST and secret scanning, including Semgrep Code and the first-party MCP entry point bundled as `semgrep mcp`. It is not Snyk. The CLI installs with pipx, uv, Homebrew, or the `semgrep/semgrep` Docker image and runs on macOS, Linux, and Windows (beta). `semgrep scan` works without an account. `semgrep ci` uses a Semgrep account, `semgrep login`, or `SEMGREP_APP_TOKEN` to pull organization policies and optionally upload findings. Structured output includes text, JSON, and SARIF. Product flags include `--code`, `--supply-chain`, and `--secrets`. The same CLI hosts first-party MCP over stdio or streamable-http. Official client configs use `command: semgrep` / `args: [mcp]` and may set `SEMGREP_APP_TOKEN`. Semgrep Guardian documents the same local MCP command and a hosted remote plugin for Claude Code. The opened MCP README names one sample tool, `semgrep_scan_remote`; a full tool catalog was not published on the opened pages. Community `mcp-server-semgrep` is listed as inspiration, not the official server. The AppSec Platform REST API is OpenAPI-documented at `https://semgrep.dev` and authenticates with an API token that has the Web API permission in an Authorization: Bearer header. Documented resources include findings, deployments, projects, scans, and secrets. That API manages platform records; it does not replace local `semgrep scan` / `semgrep ci`. Outbound JSON webhooks post scan and finding objects. iPaaS connector catalogs were not opened. Computer-use viability is unassessed. The CLI scores 8 and is the best path because it scans locally, authenticates in CI, and is the process that serves MCP.

Best path today: cli · Overall automatability: 8/10