sheurich/semgrep-scan

Semgrep Scan

Security and correctness gate on changed files.

When to Use

• Before committing implementation work
• As part of verification-before-completion
• After refactoring security-sensitive code

When NOT to Use

• Writing or testing custom Semgrep rules (use the semgrep_scan_with_custom_rule MCP tool)
• Full-repo baseline scans (uvx semgrep scan --config auto . directly)
• Dependency / supply chain scanning (use the semgrep_scan_supply_chain MCP tool)

Process

1. Identify targets

git diff --name-only HEAD --diff-filter=ACMR

Initial commit (no HEAD): git diff --cached --name-only --diff-filter=ACMR

Stop if no changed files.

2. Scan

uvx semgrep scan --config auto --json --quiet <files...>

If .semgrep/rules/ or .semgrep.yml exists at the repo root, add --config .semgrep/ to include project-specific rules.

3. Interpret findings

Parse results[] from the JSON output.

| Field | Location | |-------|----------| | Rule ID | results[].check_id | | Severity | results[].extra.severity | | Message | results[].extra.message | | File + line | results[].path, results[].start.line | | Fix suggestion | results[].extra.fix (when present) | | CWE | results[].extra.metadata.cwe |

4. Act on findings

| Severity | Action | |----------|--------| | ERROR | Fix before committing — these are real vulnerabilities | | WARNING | Review and fix, or suppress with # nosemgrep: <rule-id> if false positive | | INFO | Note for awareness — do not block commit |

5. Confirm

Re-scan after fixes until clean. Report finding count or "Semgrep scan clean — no findings on N files."