Semgrep

Connect Semgrep so agents can scan files for security issues, write and test custom rules, and read your AppSec Platform findings

Connect Semgrep and CloudThinker agents can scan files with a Semgrep rule set, write and test a custom rule, and read the code and supply chain findings your CI scans already reported. The connection uses an API token from the Semgrep AppSec Platform and never changes anything in Semgrep.

Prerequisites

• Admin access to the Semgrep AppSec Platform. Only admins can create API tokens.
• Repositories that Semgrep already scans, if you want agents to read existing findings.
• The Admin role in the CloudThinker workspace, which you need to add connections. See Roles.

Setup

1. Create an API token in Semgrep

   In the Semgrep AppSec Platform, go to Settings → Tokens → API tokens and click Create new token.

2. Set the scope and copy the token

   Under Token scopes, select Web API and name the token cloudthinker. Copy the Secrets value, then click Save. Semgrep shows the value only once.

3. Add the connection in CloudThinker

   In the sidebar, click More → Workspace settings → Connections. On the Builtin Connections tab, search for Semgrep and select it to open the form.

   Paste the token into SEMGREP_APP_TOKEN, then click Connect.

   Success state: the connection shows Connected.

Connected doesn’t prove the token works. Semgrep checks it the first time an agent reads platform findings, so run the verify prompt in a new chat before you rely on it.

Connection details

Field	Description	Example
SEMGREP_APP_TOKEN	The Semgrep API token with Web API scope	<your-api-token>

Required permissions

Token scope	Works with CloudThinker
Web API	Yes. Required to read platform findings.
Agent (CI)	No. It can’t read platform findings.

Create a token only for CloudThinker, separate from the one your CI uses. You can then revoke it without breaking your pipeline scans.

Agent capabilities

Capability	What agents can do
Discovery	Confirm the scanner is available, list the languages it supports, and test whether this token can read platform findings
File scans	Scan selected files with a rule set such as p/python, or with Semgrep’s security checks
Custom rules	Write a rule in YAML, inspect a file’s syntax tree to shape it, and test the rule against files
Platform findings	Read code (SAST) or supply chain (SCA) findings, filtered by repository, severity, and status. Open SAST findings by default.

Two limits shape what a scan finds:

• No cross-function analysis. Agent scans don’t follow data across functions or files, so they miss issues that span them. For cross-file results, ask for platform findings from your CI scans.
• Size caps. By default a scan reads up to 1 MB per file and 2 MB in total. Name the files to scan rather than a whole repository.

Verify the connection

Check Semgrep: list the supported languages and show a few open findings from the platform

A working connection returns a language list and a sample of findings with their rule and file. An error on the findings read means the token is wrong or has the wrong scope.

Example prompts

Scan app.py and server.ts with Semgrep and summarize any security findings
List open high and critical Semgrep findings for the payments repository
Write a Semgrep rule that flags use of eval, then test it against config.py

Troubleshooting

Platform findings fail to load

The token is wrong, revoked, or has the Agent (CI) scope. Create a Web API token in Settings → Tokens → API tokens, then open the Semgrep connection in CloudThinker and replace the saved value.

A scan returns no findings

The rule set may not match the file’s language. Ask the agent to scan with a rule set for that language, such as p/python, or with auto.

A scan stops with a size error

The file is over 1 MB, or the selected files total more than 2 MB. Scan fewer files at once, or read the platform findings for that repository instead.

Platform findings miss an issue a scan found, or the reverse

Agent scans and CI scans run differently. CI scans can use your organization’s policies and cross-file analysis, while agent scans don’t follow data across functions or files. Treat platform findings as the record and agent scans as a quick check.

Security

• Least privilege — grant only the permissions the agents need for your use case; start read-only and widen later.
• Read-only by default — use read-only credentials unless you want agents to make changes through this connection.
• Rotate credentials — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection.
• Revoke on offboarding — remove the credential at the provider when you delete a connection or a teammate leaves.

• Read-only. The connection scans and reads. It can’t triage, ignore, or change findings in Semgrep.
• Revoke when done. Revoke the token under Settings → Tokens in Semgrep when you remove the connection.

Related

GitGuardian Connection

Secrets detection and incident triage

SonarQube Connection

Code quality and security scanning