Semgrep Guardian rules and configuration

Which rules Guardian scans with depends on how it runs scans, and this differs by integration. Check which row applies to you before assuming your Policies are in effect.

Setup	Scans run by	Rules used
Claude Code, remote plugin (default, recommended)	Guardian hooks	Fixed `guardian-default` ruleset
Claude Code, local plugin	Guardian hooks, local CLI	Rules enabled in your organization’s Policies
All other coding agents (Cursor, Codex, GitHub Copilot, VS Code, Devin, Kiro, other MCP clients)	`semgrep_scan` through the Semgrep MCP server	Rules enabled in your organization’s Policies

If you use the recommended Claude Code remote plugin, your Policies do not apply.Guardian’s hooks run a fixed ruleset rather than reading your Policies configuration. If you have tuned your Policies and expect those rules to run in Claude Code, they will not, and Guardian may appear to miss findings that a CI or platform scan reports.If you require custom rules, see Semgrep’s #mcp Slack community for assistance.

Coverage in the guardian-default ruleset

The guardian-default ruleset is based on p/default. Semgrep includes a rule only when the agent can apply a fix or a sanitizer. Rules that lack a reliable fix can cause the agent to rewrite code incorrectly, so Semgrep omits them.

What Guardian scans for

Guardian scans generated files using Semgrep Code, Supply Chain, and Secrets, so findings can cover:

Code vulnerabilities detected by Semgrep Code
Vulnerable dependencies detected by Semgrep Supply Chain
Committed credentials detected by Semgrep Secrets

Guardian does not replace CI scans

Guardian runs as your agent writes code; your CI and platform scans run on push, pull request, or a schedule and always enforce your Policies. Continue running Semgrep in CI. See Set up and deploy scans.