Semgrep Guardian enterprise deployment

To roll out Semgrep Guardian organization-wide, standardize the installation process so that the plugin is automatically installed by the developer’s agent, rather than relying on each developer to install it manually. For individual developer setup, see the Guardian quick start.

Option 1: Use your agent’s built-in enterprise controls

Many coding agents let you pin an approved marketplace or plugin for your whole team. This is the simplest way to enable Guardian across your organization or make it required.

Claude Code
Cursor

Enable the plugin in your managed settings

Modify your Claude marketplace settings to include Semgrep in your enabled plugins list:

{
  "enabledPlugins": {
    "semgrep@claude-plugins-official" : true
  }
}

Confirm the plugin is connected

Run claude mcp get plugin:semgrep:guardian and confirm it reports as connected.

Guardian is published to the Claude official marketplace (claude-plugins-official), so the payload only needs to enable the plugin. There’s no separate marketplace to declare. See Require marketplaces for your team for more information.

Add a team marketplace

Go to Dashboard > Plugins. Under Team Marketplaces, click Add Marketplace, then create a marketplace from scratch or use Import from Repo to import from GitHub. For Guardian, import semgrep/cursor-plugin, then add the Semgrep plugin with Add to Marketplace.

Scope who gets it

Under Marketplace Settings > Marketplace Access, restrict the marketplace to the Organization Groups that should receive Guardian, then save. Only members of the marketplace’s team who belong to a selected group get access.

Set the installation mode

Set the Semgrep plugin’s installation mode:

Default Off: developers can find the plugin and choose whether to install it.
Default On: the plugin is installed by default, but developers can opt out.
Required: the plugin is always installed and cannot be uninstalled.

For an enforced rollout, choose Required.

Confirm the plugin is connected

Open Customize in the Cursor sidebar and confirm that the Semgrep plugin appears under the team scope and that its MCP server is toggled on.

Installation modes apply to plugins in a team marketplace, not to plugins developers install themselves from the public Cursor Marketplace. Team marketplaces are available on Teams and Enterprise plans, and on Enterprise plans only admins can add them. See Team marketplaces for more information.

Option 2: Deploy through a mobile device management (MDM) platform

Deploy via your MDM platform to scope rollout by a device group. These templates configure Claude Code only. To roll out Guardian to Cursor, use Option 1.

These are community-maintained templates and may be unsupported or incorrect. You are responsible for verifying the configuration before deploying it to a fleet.

Jamf
Iru (Kandji)

Deploy a Custom Settings payload with preference domain com.anthropic.claudecode through a Configuration Profile.

Create the property list

Save the following as com.anthropic.claudecode.plist.

com.anthropic.claudecode.plist

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>enabledPlugins</key>
	<dict>
		<key>semgrep@claude-plugins-official</key>
		<true/>
	</dict>
</dict>
</plist>

Upload it as a Custom Settings payload

Follow Jamf’s guide, Deploying Custom Computer Configuration Profiles Using the Application and Custom Settings Payload, using the preference domain com.anthropic.claudecode and the property list above as the uploaded file.

Scope the profile

Scope the Configuration Profile to your target device group.

Deploy a Custom Profile by uploading a configuration profile.

Create the configuration profile

Save the following as semgrep-guardian.mobileconfig, then replace the placeholder values: set PayloadIdentifier and PayloadOrganization to match your organization, and generate a fresh PayloadUUID for both the profile and the payload it contains.

semgrep-guardian.mobileconfig

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
	<key>PayloadDisplayName</key>
	<string>Claude Code – Semgrep Guardian Plugin Settings</string>
	<key>PayloadDescription</key>
	<string>Enforces the Semgrep Guardian plugin enable/disable policy.</string>
	<key>PayloadIdentifier</key>
	<string>com.yourorg.com</string>
	<key>PayloadOrganization</key>
	<string>yourorg</string>
	<key>PayloadScope</key>
	<string>System</string>
	<key>PayloadType</key>
	<string>Configuration</string>
	<key>PayloadUUID</key>
	<string>DA9306A3-D913-47D0-95D9-0594D39CFE76</string>
	<key>PayloadVersion</key>
	<integer>1</integer>
	<key>PayloadContent</key>
	<array>
		<dict>
			<key>PayloadDisplayName</key>
			<string>Claude Code Marketplace Settings</string>
			<key>PayloadIdentifier</key>
			<string>B85904F9-D6ED-4D4C-BD27-A49B9CCF0E6F</string>
			<key>PayloadType</key>
			<string>com.apple.ManagedClient.preferences</string>
			<key>PayloadUUID</key>
			<string>B85904F9-D6ED-4D4C-BD27-A49B9CCF0E6F</string>
			<key>PayloadVersion</key>
			<integer>1</integer>
			<key>PayloadContent</key>
			<dict>
				<key>com.anthropic.claudecode</key>
				<dict>
					<key>Forced</key>
					<array>
						<dict>
							<key>mcx_preference_settings</key>
							<dict>
								<!-- Plugin enable/disable policy -->
								<key>enabledPlugins</key>
								<dict>
									<key>semgrep@claude-plugins-official</key>
									<true/>
								</dict>
							</dict>
						</dict>
					</array>
				</dict>
			</dict>
		</dict>
	</array>
</dict>
</plist>

Upload it as a Custom Profile

Go to Library > Add Library Item > Custom Profile and upload the file.

Name the profile

Name the profile Semgrep Guardian - Managed Settings.

Assign and save

Assign the profile to your blueprint as needed, then save.

Tips

Test the rollout on a single machine before pushing to the whole fleet.
After deploying, confirm that Guardian loaded by running claude mcp get plugin:semgrep:guardian and confirming it reports as connected.
Users still need to log in to Semgrep once Guardian is installed. See Authentication for how sign-in works, and Connect to your IDE for setup steps.

Authentication

How you sign in depends on which IDE you use. Claude Code is the recommended setup.

Claude Code
Other IDEs

Each developer completes a one-time browser login when they first use the plugin. Semgrep refreshes access tokens automatically, so developers rarely need to sign in again. Claude Code uses Semgrep’s hosted remote server and authenticates through OAuth, so developers don’t need to install or run the Semgrep CLI.

Credentials in Claude Code

OAuth credentials are written to ~/.semgrep/guardian.yml when you sign in through the remote Claude Code plugin.At startup, Guardian fetches its default authentication method from Semgrep’s remote server. OAuth is currently the default for users who are not yet signed in. This setting is global and not configurable per user.If OAuth credentials are present in guardian.yml, Guardian uses them instead of any API token in ~/.semgrep/settings.yml.If you are switching from a local CLI setup to the remote Claude Code plugin, an existing OAuth session in guardian.yml takes precedence over CLI credentials in settings.yml. If scans run under a different account than you expect, check which file contains active credentials. Use semgrep logout to remove CLI credentials from settings.yml.To sign in with the legacy API-token method in Claude Code, ask the Guardian MCP to log in to Semgrep using the legacy method.

Other IDE integrations run Semgrep through a locally installed CLI. Each developer signs in with semgrep login, which opens a browser-based login flow. See Install the Semgrep CLI only if you need one of these setups.

Credentials in other IDEs

Credentials are written to ~/.semgrep/settings.yml when you sign in through semgrep login or set an API token manually. This is the same file the Semgrep CLI uses. If you are already logged in through semgrep login, Guardian can use those credentials.

Shared read-only tokens (Enterprise only)

Admins can create read-only tokens from within the Semgrep app. Sign in and go to Settings > Tokens, then set the token scope to read-only. See Access tokens for more information. Note that with a shared token, Semgrep cannot attribute activity to an individual developer, so per-user metrics are limited. Contact Semgrep if you have questions about which approach fits your organization.

Get help with a custom rollout

Contact Semgrep or send a message to the #mcp channel on Slack if you would like help building something custom for your MDM or agent fleet.

Get started

Set up and deploy scans

Scan and triage

Semgrep Multimodal

Semgrep Community Edition

References

Semgrep Guardian enterprise deployment

Option 1: Use your agent’s built-in enterprise controls

Option 2: Deploy through a mobile device management (MDM) platform

Authentication

Credentials in Claude Code

Credentials in other IDEs

Shared read-only tokens (Enterprise only)

Get help with a custom rollout

​Option 1: Use your agent’s built-in enterprise controls

​Option 2: Deploy through a mobile device management (MDM) platform

​Authentication

​Credentials in Claude Code

​Credentials in other IDEs

​Shared read-only tokens (Enterprise only)

​Get help with a custom rollout

Option 1: Use your agent’s built-in enterprise controls

Option 2: Deploy through a mobile device management (MDM) platform

Authentication

Credentials in Claude Code

Credentials in other IDEs

Shared read-only tokens (Enterprise only)

Get help with a custom rollout