[TEC-605] Update docs to clarify Claude Code auth and enterprise tokens#2683
Open
abhijna wants to merge 8 commits into
Open
[TEC-605] Update docs to clarify Claude Code auth and enterprise tokens#2683abhijna wants to merge 8 commits into
abhijna wants to merge 8 commits into
Conversation
abhijna
commented
Jun 26, 2026
abhijna
commented
Collaborator
- A subject matter expert reviews the content
- A technical writer reviews the PR
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
…e-code-auth-and-enterprise
…-and-enterprise' of github.com:semgrep/semgrep-docs into abhijna/tec-605-update-docs-to-clarify-claude-code-auth-and-enterprise
khorne3
reviewed
Jul 9, 2026
khorne3
left a comment
khorne3
left a comment
Collaborator
There was a problem hiding this comment.
Approving as-is, but consider using tabs (i.e., one for Claude users and one for everyone else) for the info you're adding, so readers don't switch back and forth between the two sets of info. If you opt to add this this time around, I'd be happy to re-review.
|
|
||
| Semgrep Guardian integrates natively with AI coding agents like Claude Code and Cursor to catch security issues before they ship. It bundles the Semgrep MCP server, Hooks, and Skills into a single install, and scans every file an agent generates using Semgrep Code, Supply Chain, and Secrets. When findings are detected, the agent is prompted to regenerate code until Semgrep returns clean results or you choose to dismiss them. | ||
|
|
||
| Claude Code uses Semgrep's hosted remote server and authenticates through OAuth, so developers don't need to install or run the Semgrep CLI. Every other supported IDE runs Semgrep through a locally installed CLI. See [Authentication](#authentication) for details on sign-in and enterprise rollout. |
Collaborator
There was a problem hiding this comment.
I think a better place for this might be as the introductory paragraph of the Authentication section; I don't think it needs to be at the very top and we'd remove a link
|
|
||
| Guardian stores credentials in two local files under `~/.semgrep/`: | ||
|
|
||
| * `settings.yml`: written when you sign in through `semgrep login` or set an API token manually. This is the same file the Semgrep CLI uses. |
Collaborator
There was a problem hiding this comment.
Suggested change
| * `settings.yml`: written when you sign in through `semgrep login` or set an API token manually. This is the same file the Semgrep CLI uses. | |
| * `settings.yml`: written to when you sign in through `semgrep login` or set an API token manually. This is the same file the Semgrep CLI uses. |
I don't know if this is correct, so feel free to ignore if you disagree
| Guardian stores credentials in two local files under `~/.semgrep/`: | ||
|
|
||
| * `settings.yml`: written when you sign in through `semgrep login` or set an API token manually. This is the same file the Semgrep CLI uses. | ||
| * `guardian.yml`: written when you sign in through OAuth in the remote Claude Code plugin. |
Collaborator
There was a problem hiding this comment.
Suggested change
| * `guardian.yml`: written when you sign in through OAuth in the remote Claude Code plugin. | |
| * `guardian.yml`: written to when you sign in through OAuth in the remote Claude Code plugin. |
Same as above
|
|
||
| If you are already logged in through `semgrep login`, Guardian can use the credentials from `settings.yml`. For the remote Claude Code plugin, Guardian checks for OAuth credentials in `guardian.yml` first. If OAuth credentials are present, Guardian uses them instead of any API token in `settings.yml`. | ||
|
|
||
| At startup, Guardian fetches its default authentication method from Semgrep's remote server. OAuth is currently the default for users who are not yet signed in. This setting is global and not configurable per user. |
Collaborator
There was a problem hiding this comment.
I think it makes a bit more sense if you switch this paragraph's location with the paragraph above
|
|
||
| To sign in with the legacy API-token method in Claude Code, ask the Guardian MCP to log in to Semgrep using the legacy method. | ||
|
|
||
| <Note> |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.