yellow-semgrep

v4.2.2

Semgrep security finding remediation — fetch, fix, and verify 'to fix' findings from the Semgrep AppSec Platform

Claude Code1 Skill1 MCP serverstdio

By KingInYellowsLicense: MIT0 GitHub starsUpdated 1 hour ago

Directory evidence

Runtimes: Claude Code
Parsed components: 2 skill or MCP entries
Source updated: Sep 27, 2026
Manifest status: Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install yellow-semgrep for Claude Code

Installs for the current user

claude plugin marketplace add IchenDEV/agent-plugin-mkt
claude plugin marketplace update agent-plugin-marketplace
claude plugin install yellow-semgrep@agent-plugin-marketplace

Paste and run these commands in a terminal with Claude Code. They add and refresh the PluginsMP catalog, then install this plugin.

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually

$ git clone https://github.com/KingInYellows/yellow-plugins

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The plugin root is plugins/yellow-semgrep/.

Plugin files

plugins/yellow-semgrep/

├── .claude-plugin/plugin.json
├── skills/semgrep-conventions/SKILL.md
└── .mcp.json

Included Skills1

semgrep-conventionsskills/semgrep-conventions/SKILL.md

Shared conventions for Semgrep integration — triage state mappings, API patterns, fix strategy decision tree, rate limits, and security rules. Use when commands or agents need Semgrep-specific validation, error handling, or API reference.

MCP servers1

semgrepstdio

command: ${CLAUDE_PLUGIN_ROOT}/bin/start-semgrep.sh
env.SEMGREP_APP_TOKEN_USERCONFIG: ${user_config.semgrep_app_token}
env.SEMGREP_APP_TOKEN: ${SEMGREP_APP_TOKEN:-}

Plugin manifests1

plugins/yellow-semgrep/.claude-plugin/plugin.json

{
  "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
  "name": "yellow-semgrep",
  "version": "4.2.2",
  "description": "Semgrep security finding remediation — fetch, fix, and verify 'to fix' findings from the Semgrep AppSec Platform",
  "author": {
    "name": "KingInYellows",
    "url": "https://github.com/KingInYellows"
  },
  "homepage": "https://github.com/KingInYellows/yellow-plugins#yellow-semgrep",
  "repository": "https://github.com/KingInYellows/yellow-plugins",
  "license": "MIT",
  "keywords": [
    "semgrep",
    "security",
    "sast",
    "remediation",
    "mcp"
  ],
  "userConfig": {
    "semgrep_app_token": {
      "type": "string",
      "title": "Semgrep app token",
      "description": "Semgrep API token (sgp_ prefix). Must have Web API scope. Create at Semgrep Organization Settings > API Tokens. Stored in system keychain.",
      "sensitive": true
    }
  },
  "mcpServers": {
    "semgrep": {
      "command": "${CLAUDE_PLUGIN_ROOT}/bin/start-semgrep.sh",
      "args": [],
      "env": {
        "SEMGREP_APP_TOKEN_USERCONFIG": "${user_config.semgrep_app_token}",
        "SEMGREP_APP_TOKEN": "${SEMGREP_APP_TOKEN:-}"
      }
    }
  },
  "hooks": {
    "SessionStart": [
      {
        "matcher": "*",
        "hooks": [
          {
            "type": "command",
            "command": "bash \"${CLAUDE_PLUGIN_ROOT}/hooks/write-credential-status.sh\"",
            "timeout": 3
          }
        ]
      }
    ]
  },
  "dependencies": [
    {
      "name": "yellow-core",
      "version": ">=1.17.1",
      "optional": false,
      "reason": "hooks/write-credential-status.sh sources yellow-core/lib/credential-status.sh for credential_hook_scaffold — first available in yellow-core 1.17.1"
    }
  ]
}

For maintainers

If you maintain this plugin, link to this source-backed listing from your README so users can review its manifest and indexed components.

[yellow-semgrep on Agent Plugins Marketplace](https://pluginsmp.com/plugins/yellow-semgrep)