To deploy Semgrep Guardian organization-wide, configure each developer’s coding agent to install the plugin automatically. This eliminates the need for developers to install the plugin manually.
For individual developer setup, see the Quickstart.
Before you roll out
Each developer still signs in to Semgrep individually once Guardian is installed. Read Authentication first. It covers the OAuth and CLI sign-in models, where credentials are stored, and why shared tokens and service accounts are discouraged for fleet rollouts.
Prerequisites
- You have a Semgrep account and organization.
- You are an admin for your coding agent’s enterprise controls and your MDM platform, if applicable.
- Claude Code is the recommended setup for organization-wide rollout.
Option 1: Use your agent’s built-in enterprise controls
Many coding agents let you pin an approved marketplace or plugin for your whole team. This is the simplest way to enable Guardian across your organization or make it required.
Enable the plugin in your managed settings
Modify your Claude marketplace settings to include Semgrep in your enabled plugins list: Confirm the plugin is connected
Run claude mcp get plugin:semgrep:guardian and confirm it reports as connected.
claude-plugins-official), so the payload only needs to enable the plugin. There’s no separate marketplace to declare. See Require marketplaces for your team for more information.Add a team marketplace
Go to Dashboard > Plugins. Under Team Marketplaces, click Add Marketplace, then create a marketplace from scratch or use Import from Repo to import from GitHub. For Guardian, import semgrep/cursor-plugin, then add the Semgrep plugin with Add to Marketplace. Scope who gets it
Under Marketplace Settings > Marketplace Access, restrict the marketplace to the Organization Groups that should receive Guardian, then save. Only members of the marketplace’s team who belong to a selected group get access. Set the installation mode
Set the Semgrep plugin’s installation mode:
- Default Off: developers can find the plugin and choose whether to install it.
- Default On: the plugin is installed by default, but developers can opt out.
- Required: the plugin is always installed and cannot be uninstalled.
For an enforced rollout, choose Required. Confirm the plugin is connected
Open Customize in the Cursor sidebar and confirm that the Semgrep plugin appears under the team scope and that its MCP server is toggled on.
These are community-maintained templates and may be unsupported or incorrect. You are responsible for verifying the configuration before deploying it to a fleet.
Deploy a Custom Settings payload with preference domain com.anthropic.claudecode through a Configuration Profile.Create the property list
Save the following as com.anthropic.claudecode.plist.com.anthropic.claudecode.plist
Upload it as a Custom Settings payload
Scope the profile
Scope the Configuration Profile to your target device group.
Deploy a Custom Profile by uploading a configuration profile.Create the configuration profile
Save the following as semgrep-guardian.mobileconfig, then replace the placeholder values: set PayloadIdentifier and PayloadOrganization to match your organization, and generate a fresh PayloadUUID for both the profile and the payload it contains.semgrep-guardian.mobileconfig
semgrep-guardian.mobileconfig
Upload it as a Custom Profile
Go to Library > Add Library Item > Custom Profile and upload the file.
Name the profile
Name the profile Semgrep Guardian - Managed Settings.
Assign and save
Assign the profile to your blueprint as needed, then save.
Deployment recommendations
- Test the rollout on a single machine before pushing to the whole fleet.
- After deploying, confirm that Guardian loaded by running
claude mcp get plugin:semgrep:guardian and confirming it reports as connected.
- Users still need to log in to Semgrep once Guardian is installed. See Authentication for how sign-in works, and the Quickstart for setup steps.
Shared read-only tokens (Enterprise only)
Admins can create read-only tokens from within the Semgrep app. Sign in and go to Settings > Tokens, then set the token scope to read-only. See Access tokens for more information.
Note that with a shared token, Semgrep cannot attribute activity to an individual developer, so per-user metrics are limited.
Contact Semgrep if you have questions about which approach fits your organization.
Get help with a custom rollout
Contact Semgrep or send a message to the #mcp channel on Slack if you would like help building something custom for your MDM or agent fleet. 
