{ "schema": "varexis-public-evidence-record/0.3", "generated_at_utc": "2026-10-14T00:29:51.399Z", "record_id": "VXI-EXT-TOOL-TRUST-SEMGREP-GUARDIAN-01-v1", "record_kind": "external_reference", "title": "Semgrep Guardian: Available scan tools and enforced checks", "system": "Semgrep Guardian MCP", "evidence_family": "agent_tool_trust_review", "index_status": "PUBLIC_SAFE_SOURCE_REVIEW", "evidence_state": "PRIMARY_DOCUMENTATION_REVIEW_ONLY", "canonical_question": "Does installing Semgrep MCP prove every agent code change was scanned?", "near_questions": [ "Does installing Semgrep MCP prove code was scanned?", "What distinguishes Semgrep MCP tools from hooks?", "Is the old standalone Semgrep MCP repository current?", "Which revision does a Semgrep scan result cover?", "Can an agent ignore an available scan tool?", "What evidence proves a required scan ran?", "Does an empty finding list certify secure code?", "Which Semgrep integration handles my code and findings?", "What should procurement ask about scanner enforcement?", "Can a scan of one revision support another revision?", "Can I save the Semgrep enforcement evidence boundary?", "When should an agent refuse to claim a completed security check?" ], "supported_claims": [ { "claim": "Semgrep distinguishes callable MCP scanning tools from event-triggered hooks. Tool availability alone does not prove invocation or coverage of a particular revision. Its former standalone MCP repository is archived and points to the main Semgrep distribution, so verify the installed integration and retain actual scan evidence.", "reliance": "DOCUMENTED_CAPABILITY_ONLY" } ], "not_demonstrated_claims": [ "Verified buyer configuration or effective access rights", "Independent execution, completeness or security testing", "Vendor certification, legal compliance or guaranteed suitability" ], "public_summary": "Semgrep distinguishes callable MCP scanning tools from event-triggered hooks. Tool availability alone does not prove invocation or coverage of a particular revision. Its former standalone MCP repository is archived and points to the main Semgrep distribution, so verify the installed integration and retain actual scan evidence.", "related_record_ids": [ "VXI-EXT-TOOL-TRUST-BROWSERBASE-01-v1", "VXI-EXT-TOOL-TRUST-N8N-01-v1", "VXI-EXT-TOOL-TRUST-SNYK-01-v1", "VXI-EXT-TOOL-TRUST-PAGERDUTY-01-v1" ], "source_review": { "source_type": "official_external_documentation", "source_title": "Semgrep Guardian MCP, hooks and scanning scope", "source_url": "https://semgrep.dev/products/semgrep-guardian/", "checked_on": "2026-10-14", "candidate_record_id": "VXI-EXT-TOOL-TRUST-SEMGREP-GUARDIAN-01-v1", "candidate_record_sha256": "637f2ad9a6d89522b21833bfeea94edb7d79c5572d8fe96c80d8d5e34195086b", "method": "Primary documentation reviewed for the published bounded statement.", "deployment_tested_by_varexis": false, "revalidation": "The delivered snapshot preserves the review date shown. Recheck current primary documentation and deployment context before relying on present applicability; payment does not trigger fresh research." }, "answer_policy": { "classification": "DOCUMENTED_WITH_DEPLOYMENT_BOUNDARY", "bounded_answer": "Semgrep distinguishes callable MCP scanning tools from event-triggered hooks. Tool availability alone does not prove invocation or coverage of a particular revision. Its former standalone MCP repository is archived and points to the main Semgrep distribution, so verify the installed integration and retain actual scan evidence.", "required_buyer_context": "Installed distribution, enabled hooks, repository revision, scan scope, policy and result evidence.", "missing_evidence": "A broader claim needs evidence matching the intended use. Payment does not upgrade the evidence state." }, "private_boundary": "Raw logs, thresholds, private paths, source code, protected mechanisms and reconstruction-level details are excluded from public and paid delivery.", "trust_profile": { "schema": "varexis-agent-tool-trust/1", "identity": { "tool": "Semgrep Guardian MCP", "variant": "Current Guardian integration; archived standalone server distinguished" }, "review_status": "documentation_review_only", "checked_on": "2026-10-14", "version_scope": "Dated rolling documentation snapshot; no installed or hosted runtime version independently verified.", "plan_scope": "Buyer plan, entitlement and effective configuration are not verified.", "findings": [ { "field": "operator", "label": "Publisher and operator", "status": "documented", "statement": "Semgrep publishes Guardian and the current Semgrep distribution.", "source_ids": [ "semgrep-main", "semgrep-hooks", "semgrep-migration" ] }, { "field": "purpose", "label": "Purpose", "status": "documented", "statement": "Expose scanning capabilities to coding agents and support workflow checks.", "source_ids": [ "semgrep-main", "semgrep-hooks", "semgrep-migration" ] }, { "field": "reads", "label": "Read capability", "status": "documented", "statement": "Code or findings within the selected scan and integration scope.", "source_ids": [ "semgrep-main", "semgrep-hooks", "semgrep-migration" ] }, { "field": "writes", "label": "Write capability", "status": "unknown", "statement": "Remediation or local file changes depend on the agent and configured workflow; not independently established.", "source_ids": [ "semgrep-main", "semgrep-hooks", "semgrep-migration" ] }, { "field": "auth", "label": "Authentication", "status": "unknown", "statement": "The exact buyer authentication and account setup are not established by this review.", "source_ids": [ "semgrep-main", "semgrep-hooks", "semgrep-migration" ] }, { "field": "permissions", "label": "Permission surface", "status": "unknown", "statement": "Effective local file access and organizational policy require configuration evidence.", "source_ids": [ "semgrep-main", "semgrep-hooks", "semgrep-migration" ] }, { "field": "egress", "label": "Data leaving the environment", "status": "unknown", "statement": "Determine code, findings and telemetry recipients for the selected integration before use.", "source_ids": [ "semgrep-main", "semgrep-hooks", "semgrep-migration" ] }, { "field": "failures", "label": "Failure modes to consider", "status": "review_inference", "statement": "A tool can be installed but never invoked, or scan a different revision.", "source_ids": [ "semgrep-main", "semgrep-hooks", "semgrep-migration" ] }, { "field": "unknown", "label": "Unknowns and applicability", "status": "unknown", "statement": "Actual hooks, permissions, data flow and completed scan coverage remain unverified.", "source_ids": [] }, { "field": "gate", "label": "Suggested refusal or clarification condition", "status": "varexis_review_policy", "statement": "Do not claim a revision was checked without a matching scan record and demonstrated trigger coverage.", "source_ids": [] } ], "evidence_sources": [ { "source_id": "semgrep-main", "url": "https://semgrep.dev/products/semgrep-guardian/", "final_url": "https://semgrep.dev/products/semgrep-guardian/", "title": "Semgrep Guardian MCP, hooks and scanning scope", "checked_on": "2026-10-14", "sha256": "4c300c56605930d16a796cfc4bc009470ebeef5a1e3ba77989fadfeaa1592e58", "bytes": 323896 }, { "source_id": "semgrep-hooks", "url": "https://semgrep.dev/blog/2026/mcp-vs-hooks-ai-agent-security/", "final_url": "https://semgrep.dev/blog/2026/mcp-vs-hooks-ai-agent-security/", "title": "Semgrep MCP tool availability and hook enforcement", "checked_on": "2026-10-14", "sha256": "79327edfd48d2f3b7f8ffa58fe843feecc5eff367183854cb0a3b3c579cdedd8", "bytes": 80221 }, { "source_id": "semgrep-migration", "url": "https://github.com/semgrep/mcp", "final_url": "https://github.com/semgrep/mcp", "title": "Semgrep archived MCP repository migration notice", "checked_on": "2026-10-14", "sha256": "7c93523605e2a21906eb6bb91809e734e02d70b08d00c7878a03675f27e00483", "bytes": 491439 } ], "observed_tool_execution": false, "policy_basis": "Suggested VAREXIS review gates; apply the buyer's authorized task and policy. These conditions do not execute or enforce controls.", "commercial_reliance_boundary": "A source-linked review aid, not a vendor certification, security clearance or deployment assessment. Unknown does not mean false or unsafe.", "paid_value": { "decision_context": "Preserve why scanner installation was insufficient evidence of a checked code revision.", "free": "Complete review, practical questions, sources and limitations; may be saved locally.", "single_request": "Existing server-saved version-bound route snapshot for later authenticated retrieval.", "evidence_receipt": "The same snapshot plus the existing unsigned delivery receipt.", "excluded": [ "Fresh vendor research", "Continuous monitoring or change alerts", "Testing the buyer configuration", "Private evidence or vendor certification" ], "integrity": "Hashes identify content versions; they do not prove truth or provide a signature." }, "revalidation": { "trigger": "Recheck when permissions, deployment, authentication, source guidance or intended use changes; a purchase does not trigger revalidation.", "specific_watch": "Recheck distribution migration, hook configuration, scan policy and retained results." }, "change_history": [ { "version": 1, "date": "2026-10-14", "change": "Initial documentation review; no earlier vendor assessment claimed." } ] }, "paid_access_note": "The full published answer and boundaries are free. Paid access saves the selected route and source versions, with an unsigned receipt when purchased. Preview coverage before paying. Fresh research, bespoke assessment and protected evidence are excluded.", "service_route": { "request_guide": "/varexis-index/request.html", "request_workflow": "/varexis-index/request-workflow.json", "service_id": "single_request", "service_routes_url": "/varexis-index/service-routes.json", "payment_required": true, "availability_endpoint": "/api/index/capabilities", "operational_status": "AUTOMATIC_SERVICE_CAPABILITIES_GATED", "checkout_url": "/index-access" }, "authority_boundary": "VAREXIS-INDEX informs evidence reliance. It does not provide advice, certification, deployment authority, security assurance, production approval, or guarantee.", "human_page": "/varexis-index/catalog.html#semgrep-guardian-mcp-enforcement-trust", "machine_readable_record": "/varexis-index/records/semgrep-guardian-mcp-enforcement-trust.json" }