> ## Documentation Index
> Fetch the complete documentation index at: https://semgrep-ee9d73d8-milan-guardian-enterprise-deployment-restr.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# Semgrep Guardian enterprise deployment

> How to deploy Semgrep Guardian in your enterprise environment.

To roll out Semgrep Guardian organization-wide, standardize the installation process so that the plugin is automatically installed by the developer's agent, rather than relying on each developer to install it manually.

For individual developer setup, see the [Guardian quick start](/semgrep-guardian/overview).

## Option 1: Use your agent's built-in enterprise controls

Many coding agents let you pin an approved marketplace or plugin for your whole team. This is the simplest way to enable Guardian across your organization or make it required.

<Tabs>
  <Tab title="Claude Code">
    <Steps>
      <Step title="Enable the plugin in your managed settings">
        Modify your Claude marketplace settings to include Semgrep in your enabled plugins list:

        ```json theme={null}
        {
          "enabledPlugins": {
            "semgrep@claude-plugins-official" : true
          }
        }
        ```
      </Step>

      <Step title="Confirm the plugin is connected">
        Run `claude mcp get plugin:semgrep:guardian` and confirm it reports as connected.
      </Step>
    </Steps>

    Guardian is published to the Claude official marketplace (`claude-plugins-official`), so the payload only needs to enable the plugin. There's no separate marketplace to declare. See [Require marketplaces for your team](https://code.claude.com/docs/en/plugin-marketplaces#require-marketplaces-for-your-team) for more information.
  </Tab>

  <Tab title="Cursor">
    <Steps>
      <Step title="Add a team marketplace">
        Go to **Dashboard > Plugins**. Under **Team Marketplaces**, click **Add Marketplace**, then create a marketplace from scratch or use **Import from Repo** to import from GitHub. For Guardian, import [`semgrep/cursor-plugin`](https://github.com/semgrep/cursor-plugin), then add the Semgrep plugin with **Add to Marketplace**.
      </Step>

      <Step title="Scope who gets it">
        Under **Marketplace Settings > Marketplace Access**, restrict the marketplace to the [Organization Groups](https://cursor.com/docs/enterprise/organization-groups) that should receive Guardian, then save. Only members of the marketplace's team who belong to a selected group get access.
      </Step>

      <Step title="Set the installation mode">
        Set the Semgrep plugin's installation mode:

        * **Default Off**: developers can find the plugin and choose whether to install it.
        * **Default On**: the plugin is installed by default, but developers can opt out.
        * **Required**: the plugin is always installed and cannot be uninstalled.

        For an enforced rollout, choose **Required**.
      </Step>

      <Step title="Confirm the plugin is connected">
        Open **Customize** in the Cursor sidebar and confirm that the Semgrep plugin appears under the team scope and that its MCP server is toggled on.
      </Step>
    </Steps>

    Installation modes apply to plugins in a team marketplace, not to plugins developers install themselves from the public Cursor Marketplace. Team marketplaces are available on Teams and Enterprise plans, and on Enterprise plans only admins can add them. See [Team marketplaces](https://cursor.com/docs/plugins#team-marketplaces) for more information.
  </Tab>
</Tabs>

## Option 2: Deploy through a mobile device management (MDM) platform

Deploy via your MDM platform to scope rollout by a device group. These templates configure Claude Code only. To roll out Guardian to Cursor, use [Option 1](#option-1-use-your-agents-built-in-enterprise-controls).

<Warning>
  These are community-maintained templates and may be unsupported or incorrect. You are responsible for verifying the configuration before deploying it to a fleet.
</Warning>

<Tabs>
  <Tab title="Jamf">
    Deploy a Custom Settings payload with preference domain `com.anthropic.claudecode` through a Configuration Profile.

    <Steps>
      <Step title="Create the property list">
        Save the following as `com.anthropic.claudecode.plist`.

        <Accordion title="com.anthropic.claudecode.plist">
          ```xml com.anthropic.claudecode.plist theme={null}
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
          	<key>enabledPlugins</key>
          	<dict>
          		<key>semgrep@claude-plugins-official</key>
          		<true/>
          	</dict>
          </dict>
          </plist>
          ```
        </Accordion>
      </Step>

      <Step title="Upload it as a Custom Settings payload">
        Follow Jamf's guide, [Deploying Custom Computer Configuration Profiles Using the Application and Custom Settings Payload](https://learn.jamf.com/r/en-US/technical-articles/Deploying_Custom_Computer_Configuration_Profiles_Using_the_Application_and_Custom_Settings_Payload), using the preference domain `com.anthropic.claudecode` and the property list above as the uploaded file.
      </Step>

      <Step title="Scope the profile">
        Scope the Configuration Profile to your target device group.
      </Step>
    </Steps>
  </Tab>

  <Tab title="Iru (Kandji)">
    Deploy a Custom Profile by uploading a configuration profile.

    <Steps>
      <Step title="Create the configuration profile">
        Save the following as `semgrep-guardian.mobileconfig`, then replace the placeholder values: set `PayloadIdentifier` and `PayloadOrganization` to match your organization, and generate a fresh `PayloadUUID` for both the profile and the payload it contains.

        <Accordion title="semgrep-guardian.mobileconfig">
          ```xml semgrep-guardian.mobileconfig theme={null}
          <?xml version="1.0" encoding="UTF-8"?>
          <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
          <plist version="1.0">
          <dict>
          	<key>PayloadDisplayName</key>
          	<string>Claude Code – Semgrep Guardian Plugin Settings</string>
          	<key>PayloadDescription</key>
          	<string>Enforces the Semgrep Guardian plugin enable/disable policy.</string>
          	<key>PayloadIdentifier</key>
          	<string>com.yourorg.com</string>
          	<key>PayloadOrganization</key>
          	<string>yourorg</string>
          	<key>PayloadScope</key>
          	<string>System</string>
          	<key>PayloadType</key>
          	<string>Configuration</string>
          	<key>PayloadUUID</key>
          	<string>DA9306A3-D913-47D0-95D9-0594D39CFE76</string>
          	<key>PayloadVersion</key>
          	<integer>1</integer>
          	<key>PayloadContent</key>
          	<array>
          		<dict>
          			<key>PayloadDisplayName</key>
          			<string>Claude Code Marketplace Settings</string>
          			<key>PayloadIdentifier</key>
          			<string>B85904F9-D6ED-4D4C-BD27-A49B9CCF0E6F</string>
          			<key>PayloadType</key>
          			<string>com.apple.ManagedClient.preferences</string>
          			<key>PayloadUUID</key>
          			<string>B85904F9-D6ED-4D4C-BD27-A49B9CCF0E6F</string>
          			<key>PayloadVersion</key>
          			<integer>1</integer>
          			<key>PayloadContent</key>
          			<dict>
          				<key>com.anthropic.claudecode</key>
          				<dict>
          					<key>Forced</key>
          					<array>
          						<dict>
          							<key>mcx_preference_settings</key>
          							<dict>
          								<!-- Plugin enable/disable policy -->
          								<key>enabledPlugins</key>
          								<dict>
          									<key>semgrep@claude-plugins-official</key>
          									<true/>
          								</dict>
          							</dict>
          						</dict>
          					</array>
          				</dict>
          			</dict>
          		</dict>
          	</array>
          </dict>
          </plist>
          ```
        </Accordion>
      </Step>

      <Step title="Upload it as a Custom Profile">
        Go to **Library > Add Library Item > Custom Profile** and upload the file.
      </Step>

      <Step title="Name the profile">
        Name the profile `Semgrep Guardian - Managed Settings`.
      </Step>

      <Step title="Assign and save">
        Assign the profile to your blueprint as needed, then save.
      </Step>
    </Steps>
  </Tab>
</Tabs>

**Tips**

* Test the rollout on a single machine before pushing to the whole fleet.
* After deploying, confirm that Guardian loaded by running `claude mcp get plugin:semgrep:guardian` and confirming it reports as connected.
* Users still need to log in to Semgrep once Guardian is installed. See [Authentication](#authentication) for how sign-in works, and [Connect to your IDE](/semgrep-guardian/overview#connect-to-your-ide) for setup steps.

## Authentication

How you sign in depends on which IDE you use. Claude Code is the recommended setup.

<Tabs>
  <Tab title="Claude Code">
    **Each developer completes a one-time browser login when they first use the plugin.** Semgrep refreshes access tokens automatically, so developers rarely need to sign in again. Claude Code uses Semgrep's hosted remote server and authenticates through OAuth, so developers don't need to install or run the Semgrep CLI.

    ### Credentials in Claude Code

    OAuth credentials are written to `~/.semgrep/guardian.yml` when you sign in through the remote Claude Code plugin.

    At startup, Guardian fetches its default authentication method from Semgrep's remote server. OAuth is currently the default for users who are not yet signed in. This setting is global and not configurable per user.

    If OAuth credentials are present in `guardian.yml`, Guardian uses them instead of any API token in `~/.semgrep/settings.yml`.

    If you are switching from a local CLI setup to the remote Claude Code plugin, an existing OAuth session in `guardian.yml` takes precedence over CLI credentials in `settings.yml`. If scans run under a different account than you expect, check which file contains active credentials. Use [`semgrep logout`](/getting-started/cli#log-out) to remove CLI credentials from `settings.yml`.

    To sign in with the legacy API-token method in Claude Code, ask the Guardian MCP to log in to Semgrep using the legacy method.
  </Tab>

  <Tab title="Other IDEs">
    Other IDE integrations run Semgrep through a locally installed CLI. Each developer signs in with `semgrep login`, which opens a browser-based login flow. See [Install the Semgrep CLI](/semgrep-guardian/overview#install-the-semgrep-cli) only if you need one of these setups.

    ### Credentials in other IDEs

    Credentials are written to `~/.semgrep/settings.yml` when you sign in through `semgrep login` or set an API token manually. This is the same file the Semgrep CLI uses. If you are already logged in through `semgrep login`, Guardian can use those credentials.
  </Tab>
</Tabs>

## Shared read-only tokens (Enterprise only)

Admins can create read-only tokens from within the Semgrep app. Sign in and go to [**Settings > Tokens**](https://semgrep.dev/orgs/-/settings/tokens/api), then set the token scope to read-only. See [Access tokens](/deployment/tokens#create-an-api-token) for more information.

Note that with a shared token, Semgrep cannot attribute activity to an individual developer, so per-user metrics are limited.

[Contact Semgrep](/support) if you have questions about which approach fits your organization.

## Get help with a custom rollout

[Contact Semgrep](/support) or send a message to the [#mcp channel on Slack](https://go.semgrep.dev/slack) if you would like help building something custom for your MDM or agent fleet.