Ask Semgrep which high-severity findings are open on a repository, and what has leaked.
Connect Semgrep with an API token and Memtro reads code, supply-chain and AI findings by severity, status, repository and branch, leaked-secret findings with whether Semgrep validated them as live, and projects. The secret itself is never returned. It reads on demand and there is no hourly sync. When asked, and once an administrator has granted the action by name, it can triage findings, open real Jira tickets for them through your Jira integration, link tickets, tag projects, set a primary branch, switch managed scans on, which use the plan's scan allowance, and permanently delete a project with its findings.
Ask in plain English from chat, your editor, a scheduled job or your own agent. The model picks the right Semgrep tool, reads what it needs, and answers with the source cited.
These tools change something in Semgrep. The model is told to use them only when you ask for exactly that, and an administrator grants each one by name to the teams that may use it; a personal connection acts only after its owner allows it.
Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in Semgrep, choosing the same kinds; the tab shows Semgrep's own steps. Each event can start a job, with the event as its input. Semgrep signs every delivery, and one whose signature does not check out is refused before it is read.
Events and webhooksOnce Semgrep is connected, these are the kinds of things people ask. Plain questions, no syntax. If the answer lives partly in another system you have connected, Memtro looks there too.
What high-severity findings are open on web-app?
What did Semgrep find this week?
Have any leaked secrets been validated as live?
Which dependencies in the payments repository are vulnerable?
Mark finding 88213 as ignored because it is test code
Ahead of a release the engineering lead at Acme asks what critical findings are open on the checkout repository. Memtro lists three, each with its rule, file and line, triage state and a link, and notes one was reintroduced on Monday.
Dan Fletcher asks Memtro to raise tickets for the two open SQL injection findings in the Northwind API. Memtro creates them through Semgrep's Jira integration, which groups both under one issue in the team's Jira project, and sets the findings to fixing.
The teams that lean on Semgrep most, a question each of them asks, and what they connect beside it.
A record in Semgrep is rarely the whole story. Connect the systems that hold the rest and Memtro checks them together, then remembers what it learned so the next question starts further along.
Using something else for the same job, or both? Each connector has its own tools; connect as many as you like.
UptimeRobot
Honeycomb
Cronitor
FireHydrant
StatusCake
GlitchTip
GLPI
Langfuse
LibreNMS
NetBox
Snipe-IT
Woodpecker CI
Zabbix
LangSmith
Helicone
GrowthBook
Drata
Intruder
GitGuardian
Secureframe
ilert
JumpCloud
ConfigCat
Split
Aikido Security
Astronomer
Comet Opik
CrowdStrike Falcon
Detectify
Domotz
LambdaTest
LangWatch
LlamaCloud
Logz.io
Lunary
NinjaOne
Northflank
Portkey
PromptLayer
PRTG Network Monitor
Raygun
Retell AI
Runpod
Shodan
Spike.sh
Squadcast
Tenable
UpGuard
Uptime.com
Vanta
Zenduty
Cortex
WorkOS
Kandji
Automox
Huntress
SimpleMDM
Healthchecks.io
Rapid7 InsightVM
ZenhubSemgrep's API needs a Team or Enterprise plan, and an admin creates the token
In Semgrep open Settings → Tokens → API tokens → Create new token, tick Web API (a CI token cannot call the API) and copy the token, which is shown once
Paste the API token into Connections → Semgrep in Memtro and connect. Memtro finds your deployment from the token
Ask what high-severity findings are open on web-app
Chat in the dashboard, the OpenAI-compatible API, scheduled jobs, and any MCP client: Claude Code, OpenCode, Cursor, Claude Desktop. The Semgrep tools are the same everywhere.
Only when you ask, and only what it has been granted: triage named findings: set ignored, reviewing, fixing or reopened, with a reason or a note; create Jira tickets for named findings through the Jira integration; link an existing ticket URL to named findings; add tags to a project; remove tags from a project; set a project's primary branch; switch Semgrep Managed Scans (diff-aware and weekly full) on or off for a project; delete a project and all its findings, permanently. Every other tool reads, searches or lists. The Connections page labels the tools that act, an administrator grants each one by name to the teams that may use it, and a personal connection acts only after its owner allows it.
A personal connection serves only your own requests. A shared connection serves the organisation: everyone, or only the teams an admin chooses. Admins can always add shared connections; other members need the permission.
Credentials are encrypted at rest. Tool results are cached briefly so agent loops do not repeat identical calls, and the facts the model extracts are saved to your organisation's memory with provenance (system, record and link) so they can be checked and superseded.
API token. Semgrep's API needs a Team or Enterprise plan, and an admin creates the token.
Yes. Turn events on in the connection's Events tab on the Connections page, then add the address it shows as a webhook in Semgrep, choosing the same kinds; the tab shows Semgrep's own steps. A job set to start "When an event arrives" then runs once for each matching event, with the event as its input. The run treats the event as outside data, never as instructions, and anything the run remembers is kept as unverified.
Seven-day free trial, then one monthly price per organisation. Connectors, jobs and memory are never metered.
Sign in, add a provider key, create an API key and point your tools at Memtro. It takes about five minutes.
7-day free trial · card on file, nothing charged until it ends · cancel any time
