> ## Documentation Index > Fetch the complete documentation index at: https://docs.cloudthinker.io/llms.txt > Use this file to discover all available pages before exploring further. # Semgrep > Connect Semgrep so agents can scan files for security issues, write and test custom rules, and read your AppSec Platform findings Connect Semgrep and CloudThinker agents can scan files with a Semgrep rule set, write and test a custom rule, and read the code and supply chain findings your CI scans already reported. The connection uses an **API token** from the Semgrep AppSec Platform and never changes anything in Semgrep. ## Prerequisites * **Admin** access to the Semgrep AppSec Platform. Only admins can create API tokens. * Repositories that Semgrep already scans, if you want agents to read existing findings. * The **Admin** role in the CloudThinker workspace, which you need to add connections. See [Roles](https://docs.cloudthinker.io/guide/security/roles.md). ## Setup **1. Create an API token in Semgrep** In the [Semgrep AppSec Platform](https://semgrep.dev/login), go to **Settings → Tokens → API tokens** and click **Create new token**. **2. Set the scope and copy the token** Under **Token scopes**, select **Web API** and name the token `cloudthinker`. Copy the **Secrets value**, then click **Save**. Semgrep shows the value only once. **3. Add the connection in CloudThinker** In the sidebar, click **More → Workspace settings → Connections**. On the **Builtin Connections** tab, search for **Semgrep** and select it to open the form. Paste the token into **SEMGREP\_APP\_TOKEN**, then click **Connect**. **Success state:** the connection shows **Connected**. > [!NOTE] > > **Connected** doesn't prove the token works. Semgrep checks it the first time an agent reads platform findings, so run the [verify prompt](#verify-the-connection) in a new chat before you rely on it. ## Connection details | Field | Description | Example | | - | - | - | | **SEMGREP\_APP\_TOKEN** | The Semgrep API token with **Web API** scope | `` | ## Required permissions | Token scope | Works with CloudThinker | | - | - | | **Web API** | Yes. Required to read platform findings. | | **Agent (CI)** | No. It can't read platform findings. | > [!TIP] > > Create a token only for CloudThinker, separate from the one your CI uses. You can then revoke it without breaking your pipeline scans. ## Agent capabilities | Capability | What agents can do | | - | - | | **Discovery** | Confirm the scanner is available, list the languages it supports, and test whether this token can read platform findings | | **File scans** | Scan selected files with a rule set such as `p/python`, or with Semgrep's security checks | | **Custom rules** | Write a rule in YAML, inspect a file's syntax tree to shape it, and test the rule against files | | **Platform findings** | Read code (SAST) or supply chain (SCA) findings, filtered by repository, severity, and status. Open SAST findings by default. | Two limits shape what a scan finds: * **No cross-function analysis.** Agent scans don't follow data across functions or files, so they miss issues that span them. For cross-file results, ask for platform findings from your CI scans. * **Size caps.** By default a scan reads up to 1 MB per file and 2 MB in total. Name the files to scan rather than a whole repository. ### Verify the connection ```text theme={null} Check Semgrep: list the supported languages and show a few open findings from the platform ``` A working connection returns a language list and a sample of findings with their rule and file. An error on the findings read means the token is wrong or has the wrong scope. ### Example prompts ```text theme={null} Scan app.py and server.ts with Semgrep and summarize any security findings List open high and critical Semgrep findings for the payments repository Write a Semgrep rule that flags use of eval, then test it against config.py ``` ## Troubleshooting > [accordion] Platform findings fail to load > > The token is wrong, revoked, or has the **Agent (CI)** scope. Create a **Web API** token in **Settings → Tokens → API tokens**, then open the Semgrep connection in CloudThinker and replace the saved value. > [accordion] A scan returns no findings > > The rule set may not match the file's language. Ask the agent to scan with a rule set for that language, such as `p/python`, or with `auto`. > [accordion] A scan stops with a size error > > The file is over 1 MB, or the selected files total more than 2 MB. Scan fewer files at once, or read the platform findings for that repository instead. > [accordion] Platform findings miss an issue a scan found, or the reverse > > Agent scans and CI scans run differently. CI scans can use your organization's policies and cross-file analysis, while agent scans don't follow data across functions or files. Treat platform findings as the record and agent scans as a quick check. ## Security * **Least privilege** — grant only the permissions the agents need for your use case; start read-only and widen later. * **Read-only by default** — use read-only credentials unless you want agents to make changes through this connection. * **Rotate credentials** — rotate keys and tokens on your normal schedule; CloudThinker picks up the new value when you update the connection. * **Revoke on offboarding** — remove the credential at the provider when you delete a connection or a teammate leaves. - **Read-only.** The connection scans and reads. It can't triage, ignore, or change findings in Semgrep. - **Revoke when done.** Revoke the token under **Settings → Tokens** in Semgrep when you remove the connection. ## Related > [card] [GitGuardian Connection](https://docs.cloudthinker.io/guide/connections/gitguardian.md) > > Secrets detection and incident triage > [card] [SonarQube Connection](https://docs.cloudthinker.io/guide/connections/sonarqube.md) > > Code quality and security scanning This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.