Semgrep MCP — agentic threat model

Not certain from the listing — The underlying foundation model is not specified, but it is highly vulnerable to indirect prompt injection if malicious code snippets containing adversarial instructions are scanned and returned in the findings.

The agent ingests code repositories and custom/registry rulesets. There is a risk of data exfiltration if the agent is manipulated into sending scanned code contents to unauthorized external endpoints, or if malicious rulesets are loaded.

The agent framework exposes Semgrep SAST tools via MCP. The primary threat is tool misuse or exploitation of the Semgrep CLI/library itself via crafted inputs (e.g., command injection through rule parameters or path traversal).

Not certain from the listing — The hosting environment is unspecified, but running static analysis on arbitrary code requires strict containerization and sandboxing to prevent local file system access or host compromise by malicious code or rules.

Not certain from the listing — There is no mention of built-in guardrails, logging, or evaluation mechanisms to detect when the agent's output has been hijacked by prompt injections embedded in scanned code.

Not certain from the listing — Access controls, authentication, and authorization policies for determining who can run scans or load custom rulesets are not defined in the public directory listing.

As an MCP tool, this agent is designed to be called by other orchestrator agents. A compromised orchestrator could abuse this agent to scan proprietary codebases, or this agent could return injected payloads that compromise the calling agent.