Plugin that scans each file the agent writes with Semgrep Code, Supply Chain and Secrets, and sends findings back to fix.
How it works Foe: Breach Spider, a security hole an attacker could use.
Haze Poison Ward Insight Barrier Flicker Pinned Enraged Haze Poison Ward Insight Barrier Flicker Pinned Enraged
Breach Spider Foes
Breach Spider Haze Poison Ward Insight Barrier Flicker Pinned Enraged Party · Context
RogueYour agent 100/100 Haze Poison Ward Insight Barrier Flicker Pinned Enraged Breach Spider
The Breach Spider blocks the way.
What really happens It stands for a security hole an attacker could use.
Rogue: Context 100/100.
Exploit
The spider strikes through a gap nobody guarded. Its bite lingers.
What really happens An attacker gets in through a hole nobody checked, and the harm spreads until it is patched.
Rogue takes 11. Rogue: Context 89/100. Rogue: Poison.
Semgrep Guardian
The hero signs the Semgrep pact once, through the browser.
What really happens Install the plugin, start a new session, and sign in to Semgrep. The plugin path needs no local Semgrep CLI.
Breach Spider takes 19.
Semgrep Guardian
Each new stone laid in the wall is checked for cracks.
What really happens A hook fires on every file write and scans it with Semgrep Code, Supply Chain and Secrets on Semgrep's hosted scanner.
Breach Spider takes 10. Rogue: Ward.
Exploit
The ward takes the blow.
What really happens A test or check catches the problem before it lands.
Rogue blocks the hit.
Semgrep Guardian
A crack is found, and the hero rebuilds that stretch.
What really happens Findings go back to the agent, which is prompted to regenerate the code. The new code is scanned again.
Breach Spider takes 39.
Semgrep Guardian
The spider finds no gap in the fresh stonework.
What really happens The MCP server also lists your Semgrep projects and existing findings, so the agent can fix them from the terminal.
Breach Spider takes 32. Breach Spider falls.
Victory
The Breach Spider falls.
Back Auto Next 1× 2× 4×
Sound Skip to end Show all steps 1 / 8
Learn this spell Claude Code
claude plugin install semgrep@claude-plugins-officialCopy
Codex
codex plugin marketplace add https://github.com/semgrep/guardian --sparse .claude-plugin --sparse plugin
codex plugin add semgrep@semgrep-marketplaceCopy
Notes Version 2.9.0. Needs a Semgrep account; you sign in through the browser once. Codex install: add the semgrep/guardian marketplace, then codex plugin add semgrep@semgrep-marketplace. Hooks fire on every file write in every project and send those files to scanner.semgrep.ai. The plugin path uses a fixed ruleset, not your org's Policies. Sends telemetry unless you turn it off. The repo has no license file. Windows needs WSL.
This spell has no recorded sessions in the curator's logs. Tried it? Send a spell report .