Field-by-field comparison
Compare the evidence before choosing an MCP.
Each signal stays separate, missing facts remain visible, and the column order follows your selection.
| Evidence field | semgrepMCP100 Selected | Sentry MCPMCP100 Selected |
|---|---|---|
| Task fit | ||
| Best for |
|
|
| Not ideal for |
|
|
| Avoid when |
|
|
| Provenance | ||
| Provenance details | First-party MCP ecosystem:semgrep · Publisher source ↗ | First-party MCP Sentry · Publisher source ↗ |
| Maintenance | ||
| Maintenance details | Repo: Aug 14, 2026 Package: Not documented | Repo: Aug 14, 2026 Package: Jul 2, 2026 |
| Popularity evidence | ||
| GitHub stars | 16,224 GitHub stars · checked 2026-08-14T18:46:26.000Z | 818 GitHub stars · checked 2026-08-14T18:46:26.000Z |
| 30-day package downloads | No reliable download data | 388,760 30-day package downloads · checked 2026-07-29T17:30:00.000Z |
| External adoption evidence |
|
|
| Client coverage | ||
| Client coverage details | Claude Code✓ Local stdio Claude Desktop✓ Local stdio Codex✓ Local stdio VS Code✓ Local stdio Cursor✓ Local stdio OpenCode✓ Local stdio | Claude Code✓ Streamable HTTP Claude Desktop✓ Streamable HTTP Codex✓ Streamable HTTP VS Code✓ Streamable HTTP Cursor✓ Streamable HTTP OpenCode✓ Streamable HTTP |
| Client coverage note | Local stdio runs on your computer. Streamable HTTP connects to a remotely hosted MCP server. | |
| Access and data | ||
| Authentication | Local scanning needs no remote credential; platform features use Semgrep authentication. | The hosted service uses MCP OAuth layered over Sentry OAuth; raw Sentry credentials stay server-side. Stdio uses a Sentry user auth token and may also require OpenAI or Anthropic credentials for AI-powered search. |
| Cost | The MCP integration has no separately verified MCP100 price conclusion. Publisher subscriptions, API usage, compute, storage, and AI-client charges may apply. | The repository is source-available under its published license and the hosted MCP has no separately documented fee in the reviewed sources. Normal Sentry plan/usage, Seer, and external LLM-provider charges may apply. |
| Permissions | Local filesystem scope and optional Semgrep AppSec Platform token permissions define accessible code and findings. | Hosted OAuth requests org:read, project:write, team:write, and event:write upstream, then narrows exposed actions through granted MCP skills and optional /mcp/:org/:project resource paths. Stdio documentation lists org/project/team read/write and event write token scopes. |
| Data handling | Authorized service data and tool results pass through the MCP server to the connected AI client. Review the publisher and client data policies before using sensitive security & testing information. | Issue, event, trace, release, team, project, and related telemetry may be returned to the MCP client. Hosted mode stores upstream OAuth credentials in encrypted grant properties and gives the client a separate MCP token. AI search tools may process query/event context through configured model infrastructure. |
| Limitations | ||
| Tradeoffs |
|
|
| Risk context | Scanning shares source-derived findings with the MCP client and may consume substantial local resources. Use a test environment where practical, least-privilege credentials, narrowly enabled tools, and explicit confirmation for mutations. MCP100 did not execute third-party server code during this documentation review. | Production error telemetry often contains sensitive values, while upstream OAuth scopes include write capabilities. Prefer a project-constrained hosted URL, minimal granted skills, human approval for mutations, and prior telemetry scrubbing. |
| Evidence date | ||
| Editorial review | 2026-07-30 | 2026-07-24 |
| Candidate evidence | 2026-08-14T18:46:26.000Z | 2026-08-14T18:46:26.000Z |
Popularity, maintenance, fit, permissions, and client support are independent evidence fields.
Read the evidence method →