Kiwi
Kiwi

Kiwi for Semgrep

Have the agent on a Kiwi step scan the code it changed for security issues with Semgrep through the Semgrep CLI's MCP server.

  • Your agent works in Semgrep through its own connection. Kiwi does not call Semgrep and never holds its credentials.
  • A workflow skill can list Semgrep among the tools it requires. When you supply your agent's available tools to a skill check and Semgrep is not among them, the check reports SK15-UNSUPPORTED-TOOL.
  • A project Admin can add links to Semgrep, with notes, under Connections and bind them to the steps that use them. The agent reads them with list_connections.
  • The agent can report the tools and plugins it ran with, including its Semgrep connection, with report_configuration.
  • The agent submits links to its work in Semgrep as the step's outputs. People review them, and sign-off stays with the people your workflow names.

What your agent can do in Semgrep

  • Run a security check on code the agent wrote.
  • Scan files with Semgrep rules or with a custom rule the agent writes.
  • Print a file's abstract syntax tree to help write a rule.
  • Read the existing Semgrep findings for a project.
  • List the supported languages and read the rule schema.

Set up

  1. Connect your agent to Kiwi

    Add Kiwi's hosted MCP server, https://kiwiflow.io/mcp, to your coding agent.

    Coding agentsQuickstart

  2. Connect your agent to Semgrep

    Run the Semgrep MCP server where your agent runs. The credentials stay with your agent.

    semgrep mcp

    Semgrep documentation

  3. Example skill

    Publish instructions like these as a workflow skill that lists Semgrep among its required tools.

    Start from the changed files listed in the assignment.
Run a Semgrep security check on those files and fix the findings.
Run the check one more time after the fixes, and no more.
Submit the remaining findings, or none, as the step's outputs.
If a finding needs a judgment call, report a blocker to the step owner;
the assigned reviewer decides on any rule exceptions.
Get startedRead the setup guide