Plugin that scans each file the agent writes with Semgrep Code, Supply Chain and Secrets, and sends findings back to fix.

How it works

Foe: Breach Spider, a security hole an attacker could use.

Foes

  • Breach Spider

Party · Context

  • RogueYour agent100/100
  1. Breach Spider

    The Breach Spider blocks the way.

    What really happensIt stands for a security hole an attacker could use.

    Rogue: Context 100/100.

  2. Exploit

    The spider strikes through a gap nobody guarded. Its bite lingers.

    What really happensAn attacker gets in through a hole nobody checked, and the harm spreads until it is patched.

    Rogue takes 11. Rogue: Context 89/100. Rogue: Poison.

  3. Semgrep Guardian

    The hero signs the Semgrep pact once, through the browser.

    What really happensInstall the plugin, start a new session, and sign in to Semgrep. The plugin path needs no local Semgrep CLI.

    Breach Spider takes 19.

  4. Semgrep Guardian

    Each new stone laid in the wall is checked for cracks.

    What really happensA hook fires on every file write and scans it with Semgrep Code, Supply Chain and Secrets on Semgrep's hosted scanner.

    Breach Spider takes 10. Rogue: Ward.

  5. Exploit

    The ward takes the blow.

    What really happensA test or check catches the problem before it lands.

    Rogue blocks the hit.

  6. Semgrep Guardian

    A crack is found, and the hero rebuilds that stretch.

    What really happensFindings go back to the agent, which is prompted to regenerate the code. The new code is scanned again.

    Breach Spider takes 39.

  7. Semgrep Guardian

    The spider finds no gap in the fresh stonework.

    What really happensThe MCP server also lists your Semgrep projects and existing findings, so the agent can fix them from the terminal.

    Breach Spider takes 32. Breach Spider falls.

  8. Victory

    The Breach Spider falls.

Learn this spell

Claude Code

claude plugin install semgrep@claude-plugins-official

Codex

codex plugin marketplace add https://github.com/semgrep/guardian --sparse .claude-plugin --sparse plugin
codex plugin add semgrep@semgrep-marketplace

Notes

Version 2.9.0. Needs a Semgrep account; you sign in through the browser once. Codex install: add the semgrep/guardian marketplace, then codex plugin add semgrep@semgrep-marketplace. Hooks fire on every file write in every project and send those files to scanner.semgrep.ai. The plugin path uses a fixed ruleset, not your org's Policies. Sends telemetry unless you turn it off. The repo has no license file. Windows needs WSL.

This spell has no recorded sessions in the curator's logs. Tried it? Send a spell report.