Add Semgrep MCP shared workflow and daily security scan #11454

Copilot · 2026-01-23T06:11:36Z

Plan: Add Semgrep MCP Shared Workflow

Create new shared workflow file at .github/workflows/shared/mcp/semgrep.md
Configure semgrep MCP server using container mode with semgrep/semgrep image
Use entrypointArgs with ["semgrep", "mcp", "-t", "stdio"] for MCP interface
Document available tools and usage examples
Test the workflow file can be compiled successfully
Run validation checks (make fmt, make test-unit)
Address PR feedback - wrap documentation in XML comment block
Create dedicated daily semgrep workflow
Configure code scanning alert output for semgrep results

Changes

Created Shared MCP Configuration

Created .github/workflows/shared/mcp/semgrep.md
- Container-based MCP server using semgrep/semgrep:latest
- Runs semgrep mcp -t stdio via entrypointArgs
- Exposes tools: semgrep_scan, semgrep_scan_local, semgrep_scan_with_custom_rule, get_supported_languages, semgrep_rule_schema, semgrep_findings
- Documentation wrapped in XML comments for editing agents

Created Daily Semgrep Workflow

Created .github/workflows/daily-semgrep-scan.md
- Daily scheduled security scan for SQL injection and other vulnerabilities
- Uses semgrep MCP server for static analysis
- Runs on schedule (daily) and workflow_dispatch
- Publishes findings as code scanning alerts with driver "Semgrep Security Scanner"
- Includes security-events: read permission for alert creation

Usage

Workflows can now use Semgrep for static analysis by importing the shared configuration:

---
imports:
  - shared/mcp/semgrep.md
on:
  workflow_dispatch:
---

Scan the repository for SQL injection vulnerabilities using Semgrep.

The MCP gateway spawns the Semgrep container with stdio transport, making all security scanning capabilities available to agents through the Model Context Protocol. Results are published as code scanning alerts for easy tracking and remediation in GitHub's Security tab.

Original prompt

Add a shared agentic workflow that loads the semgrep MCP (use container)

docker run -i --rm semgrep/semgrep semgrep mcp -t stdio

https://githubnext.github.io/gh-aw/

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-01-23T06:24:58Z

.github/workflows/shared/mcp/semgrep.md

+## Semgrep MCP Server
+
+Semgrep is a fast, open-source static analysis tool for finding bugs, detecting security vulnerabilities, and enforcing code standards. It supports multiple languages and custom rules.
+
+### Available Tools
+
+The Semgrep MCP server provides the following tools for code analysis:
+
+- **semgrep_rule_schema**: Retrieves the schema required to write a Semgrep rule, lists available fields, and verifies rule syntax
+- **get_supported_languages**: Lists all programming languages supported by Semgrep
+- **semgrep_scan**: Scans code files for security vulnerabilities, bugs, and code quality issues using default rules
+- **semgrep_scan_local**: Performs scans on local files and returns results in JSON format
+- **semgrep_scan_with_custom_rule**: Runs a scan using a custom rule on provided code and returns findings
+- **semgrep_findings**: Fetches findings from the Semgrep AppSec Platform API (requires Semgrep Cloud authentication)
+
+### Basic Usage
+
+To use Semgrep in your workflow, simply import this shared configuration:
+
+```yaml
+imports:
+  - shared/mcp/semgrep.md
+```
+
+The MCP server will enable the agent to perform static analysis on code, including:
+- Security vulnerability detection
+- Bug finding
+- Code quality checks
+- Custom rule validation
+- Language-specific pattern matching
+
+### Example Patterns
+
+**Security Scanning:**
+```
+Use semgrep to scan the repository for SQL injection vulnerabilities
+```
+
+**Custom Rule Testing:**
+```
+Test this custom Semgrep rule against the code in src/auth.go
+```
+
+**Language Support:**
+```
+Check which languages are supported by Semgrep for our multi-language repository
+```
+
+### More Information
+
+- Official Documentation: https://semgrep.dev/docs/
+- Rule Examples: https://semgrep.dev/explore
+- Writing Rules: https://semgrep.dev/docs/writing-rules/overview
+- Supported Languages: https://semgrep.dev/docs/supported-languages
+- Docker Image: https://hub.docker.com/r/semgrep/semgrep


@copilot this is a help manual for a editing agent but not the prompt. Make it a xml comment.

Done. Converted the documentation section to XML comment block (similar to arxiv.md pattern). The help manual is now wrapped in  and won't be visible to agents. Fixed in commit f233069.

Address PR feedback - wrap help manual in XML comment block Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan · 2026-01-23T06:41:13Z

@copilot review agentic workflows and import semgrep where appropriate

Import shared/mcp/semgrep.md in 6 workflows: - static-analysis-report.md: Enhance static analysis with semgrep - daily-malicious-code-scan.md: Add semgrep for malicious pattern detection - code-scanning-fixer.md: Enable semgrep for automated security fixes - security-fix-pr.md: Add semgrep for security vulnerability analysis - code-simplifier.md: Use semgrep for code quality improvements - go-fan.md: Add semgrep for Go code analysis Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-01-23T06:48:01Z

@copilot review agentic workflows and import semgrep where appropriate

Reviewed and added semgrep import to 6 security and code quality workflows:

static-analysis-report.md - Enhances existing security scanning (zizmor, poutine, actionlint) with semgrep
daily-malicious-code-scan.md - Adds semgrep for detecting malicious code patterns
code-scanning-fixer.md - Enables semgrep for automated security fixes
security-fix-pr.md - Uses semgrep for security vulnerability analysis
code-simplifier.md - Leverages semgrep for code quality improvements
go-fan.md - Adds semgrep for Go code dependency analysis

All workflows compile successfully with the semgrep MCP server configured. Fixed in commit 1cc4977.

pelikhan · 2026-01-23T11:15:01Z

.github/workflows/code-scanning-fixer.md

    reviewers: [copilot]
 timeout-minutes: 20
+imports:
+  - shared/mcp/semgrep.md


@copilot Revert changes to this file

Reverted. Removed semgrep import from code-scanning-fixer.md in commit 2f43e27.

pelikhan · 2026-01-23T11:15:15Z

.github/workflows/go-fan.md

    - go

 imports:
+  - shared/mcp/semgrep.md


@copilot Revert changes to this file

Reverted. Removed semgrep import from go-fan.md in commit 2f43e27.

pelikhan · 2026-01-23T11:15:23Z

.github/workflows/security-fix-pr.md

  autofix-code-scanning-alert:
    max: 5
 timeout-minutes: 20
+imports:


@copilot Revert changes to this file

Reverted. Removed semgrep import from security-fix-pr.md in commit 2f43e27.

pelikhan · 2026-01-23T11:15:36Z

.github/workflows/static-analysis-report.md

 strict: true
 imports:
  - shared/mcp/gh-aw.md
+  - shared/mcp/semgrep.md


@copilot Revert changes to this file

Reverted. Removed semgrep import from static-analysis-report.md in commit 2f43e27.

Remove shared/mcp/semgrep.md import from: - code-scanning-fixer.md - go-fan.md - security-fix-pr.md - static-analysis-report.md As requested in PR review feedback. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

pelikhan

Add daily semgrep workflow

imports:

shared/mcp/semgrep.md
on: daily !
workflow_dispatch:

Scan the repository for SQL injection vulnerabilities using Semgrep.

pelikhan · 2026-01-23T11:27:23Z

.github/workflows/code-simplifier.md

 tracker-id: code-simplifier

 imports:
+  - shared/mcp/semgrep.md


@copilot revert file changes

Reverted. Removed semgrep import from code-simplifier.md in commit 7dc9b70.

pelikhan · 2026-01-23T11:27:42Z

.github/workflows/daily-malicious-code-scan.md

 timeout-minutes: 15
 strict: true
 imports:
+  - shared/mcp/semgrep.md


@copilot revert file changes

Reverted. Removed semgrep import from daily-malicious-code-scan.md in commit 7dc9b70.

- Removed semgrep import from code-simplifier.md - Removed semgrep import from daily-malicious-code-scan.md - Created new daily-semgrep-scan.md workflow for SQL injection scanning As requested in PR feedback. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-01-23T11:34:51Z

Add daily semgrep workflow

...

Created daily-semgrep-scan.md workflow with daily schedule and workflow_dispatch trigger. The workflow scans for SQL injection vulnerabilities using Semgrep. Fixed in commit 7dc9b70.

pelikhan · 2026-01-23T11:49:23Z

.github/workflows/daily-semgrep-scan.md

+  schedule: daily
+  workflow_dispatch:
+permissions:
+  contents: read


@copilot use crate code scanning alert safe output to publish results

Added code scanning alert safe output configuration to daily-semgrep-scan.md:

Added security-events: read permission

Configured create-code-scanning-alert with driver "Semgrep Security Scanner"

Semgrep findings will now be published as code scanning alerts. Fixed in commit 0b9228f.

Configure daily-semgrep-scan.md to publish results as code scanning alerts: - Added security-events: read permission - Added safe-outputs with create-code-scanning-alert configuration - Set driver name to "Semgrep Security Scanner" As requested in PR feedback. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Initial plan

19a08ef

Copilot AI assigned Copilot and pelikhan Jan 23, 2026

Copilot started work on behalf of pelikhan January 23, 2026 06:12 View session

Copilot AI and others added 2 commits January 23, 2026 06:16

Initial plan for adding semgrep MCP shared workflow

f4c9718

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Add semgrep MCP shared workflow configuration

9392694

Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Add a shared agentic workflow for loading semgrep MCP~~ Add Semgrep MCP shared workflow for static analysis Jan 23, 2026

Copilot AI requested a review from pelikhan January 23, 2026 06:25

Copilot finished work on behalf of pelikhan January 23, 2026 06:25

This was referenced Jan 23, 2026

Smoke Test: Claude - 21276886803 #11458

Closed

Smoke Test: Copilot - 21276886789 #11459

Closed

pelikhan marked this pull request as ready for review January 23, 2026 06:33

pelikhan reviewed Jan 23, 2026

View reviewed changes

Copilot started work on behalf of pelikhan January 23, 2026 06:34 View session

Convert semgrep documentation to XML comment

f233069

Address PR feedback - wrap help manual in XML comment block Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI requested a review from pelikhan January 23, 2026 06:40

Copilot finished work on behalf of pelikhan January 23, 2026 06:40

Copilot started work on behalf of pelikhan January 23, 2026 06:42 View session

Copilot AI changed the title ~~Add Semgrep MCP shared workflow for static analysis~~ Add Semgrep MCP shared workflow for static analysis and integrate into security workflows Jan 23, 2026

Copilot finished work on behalf of pelikhan January 23, 2026 06:49

pelikhan reviewed Jan 23, 2026

View reviewed changes

Copilot started work on behalf of pelikhan January 23, 2026 11:16 View session

Revert semgrep import from 4 workflows

2f43e27

Remove shared/mcp/semgrep.md import from: - code-scanning-fixer.md - go-fan.md - security-fix-pr.md - static-analysis-report.md As requested in PR review feedback. Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~Add Semgrep MCP shared workflow for static analysis and integrate into security workflows~~ Add Semgrep MCP shared workflow for static analysis Jan 23, 2026

Copilot AI requested a review from pelikhan January 23, 2026 11:22

Copilot finished work on behalf of pelikhan January 23, 2026 11:22

pelikhan reviewed Jan 23, 2026

View reviewed changes

Copilot started work on behalf of pelikhan January 23, 2026 11:29 View session

Copilot AI changed the title ~~Add Semgrep MCP shared workflow for static analysis~~ Add Semgrep MCP shared workflow and daily security scan Jan 23, 2026

Copilot AI requested a review from pelikhan January 23, 2026 11:37

Copilot finished work on behalf of pelikhan January 23, 2026 11:37

pelikhan reviewed Jan 23, 2026

View reviewed changes

Copilot started work on behalf of pelikhan January 23, 2026 11:50 View session

Copilot AI requested a review from pelikhan January 23, 2026 11:56

Copilot finished work on behalf of pelikhan January 23, 2026 11:56

pelikhan approved these changes Jan 23, 2026

View reviewed changes

pelikhan merged commit 649cd5a into main Jan 23, 2026

pelikhan deleted the copilot/add-shared-agentic-workflow branch January 23, 2026 12:06

github-actions bot mentioned this pull request Jan 23, 2026

Smoke Test: Copilot - 21285790459 #11493

Closed

Add Semgrep MCP shared workflow and daily security scan #11454

Add Semgrep MCP shared workflow and daily security scan #11454

Uh oh!

Conversation

Copilot AI commented Jan 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Plan: Add Semgrep MCP Shared Workflow

Changes

Created Shared MCP Configuration

Created Daily Semgrep Workflow

Usage

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan commented Jan 23, 2026

Uh oh!

Copilot AI commented Jan 23, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

pelikhan left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI commented Jan 23, 2026

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Copilot AI Jan 23, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Copilot AI commented Jan 23, 2026 •

edited

Loading