semgrep — 8 hooks

Pinned source listing — machine-checked

What declarations and files are present in this pinned source?

Pinned source declarations and file hashes were listed.

Review

Machine-checked · 2026-10-19

Run UTC: 2026-10-19T18:07:17Z
Reviewed: 2026-10-19
Published: 2026-10-19
Updated: 2026-10-19

Observations · Limitations · Evidence

Works with:

Works with Claude Code

Works with Grok Build

What we ran

Git blob acquisition followed by static source inspection.

What we saw

Listed 8 hook declarations. Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

Limits

Scope: acquisition and static inspection. Command results: commands.json.

developer-tools · hooks · Upstream source · Upstream documentation

Pinned source inspection only; no runtime platform was exercised. UTC 2026-10-19T18:07:17Z, tree 546d15f2f4d9afda72463a9111d94d333b745ae57fba2798b3f011e3e5acb028.

No browser or computer-use tools. Pin this exact version; the stamp does not follow updates.

Full record

name: semgrep — 8 hooks
slug: source-hooks-d9dbdaf8415bd8a4f16ccec0
type: hooks
category: developer-tools
example: false
evidence state: pinned_source_listing
stamp: Pinned source listing — machine-checked
summary: Pinned source declarations and file hashes were listed.
outcome: Listed 8 hook declarations. Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.
rule results: ["The retained source tree matches its acquisition manifest.","Declared hook names (listing.json): PreToolUse; PostToolUse; SessionStart; SessionStart; SessionStart; Stop; Stop; SessionEnd"]
task: What declarations and files are present in this pinned source?
setup: Git blob acquisition followed by static source inspection.
limitations: Scope: acquisition and static inspection. Command results: commands.json.
source url: https://github.com/semgrep/mcp-marketplace.git
documentation url: https://github.com/semgrep/mcp-marketplace.git
commit: b58f407c6ac0f5fe47dee8301602f2e290a8ecfb
tree sha256: 546d15f2f4d9afda72463a9111d94d333b745ae57fba2798b3f011e3e5acb028
file sha256: {"plugin/.claude-plugin/plugin.json":"250a198077d2ed00b2bbefca406619423f6233648a02ab1dce0e8069f8357de8","plugin/.codex-plugin/plugin.json":"393ee1f18b8c39a202222435c70048c8807e0be6456e5db6c593017bfe8a5a54","plugin/.mcp.json":"0a295461ec7a8eeb2feea740a079f4ac23e8a4bb14c331421d70147798b0c2e1","plugin/hooks/hooks.json":"85dd9fd7b96e02c51deb903973045f3bf214b400beaf7b1e957fe2c7e0ddecf2","plugin/scripts/hook":"afb45a81c2524b828e844f4e739f88460ffdf1c7f7a1f32ad8da40d1ec3a5a48","plugin/scripts/hook-darwin-amd64":"bed4eda75c4140024cbbc651b80472d24ddb681ff4268fd539827daa28e8dc8d","plugin/scripts/hook-darwin-arm64":"b7f5cc37ac73140cd7cec8adb09841b9f737379278b0d9223b26c5600ce06440","plugin/scripts/hook-linux-amd64":"d874f8da8f39edcbbd84472ec5b1695556598a442c9aac77b83ba63b0d318f10","plugin/scripts/hook-linux-arm64":"5ce8b44adf35eb0a69142f56b414e22c19ca81ea4df65e7fde6df4cae2ade485","plugin/scripts/hook.cmd":"8071d4776249fd78cb2c800cebb863054c6bcf7b5ea6e3b22aeea0ffde43f9fb","plugin/scripts/hook.exe":"3d97802e58b7856767517d34ff32aad5b8c15be900173346cd9391abc712b0d6","plugin/scripts/hook.sh":"3dff8e79d2c2d92211e3d011a82823706a65854f68e447bf2cc5601e01a0df83","plugin/skills/add-and-validate-guardian-developer-semgrep-rule/SKILL.md":"cde31a31c56f1b7408350bf28daa69f8080e2416176df883577c5c768dfd78ef","plugin/skills/install-mfw/SKILL.md":"e5479a19f4456e6280e87ec9dfe1846ae4660b46d146c78c81f605bc88448f60","plugin/skills/install-mfw/scripts/inspect-shell-config.sh":"b687ad351fa160158d9d4f7240334fb891f936b8588b30fe2a080d8f22f57bc6","plugin/skills/install-mfw/scripts/install-binary.sh":"4b668717db33351289ec90027f91e8836722061a6d570a355120dd5a55f2421b","plugin/skills/remove-guardian-developer-semgrep-rule/SKILL.md":"7bb53bab73b48ff668c714f4ba0c6676c49565ed90e1286320c52ed999d8040b"}
lockfiles: ["LOCK.json"]
utc date: 2026-10-19T18:07:17Z
source date: 2026-10-16
discovered date: 2026-10-16
retested date: 2026-10-19
reviewed date: 2026-10-19
published date: 2026-10-19
modified date: 2026-10-19
reviewer: Machine-checked
harness version: toolwitness harness at commit 11dde7217ae6f8e4ac4d18a6380b18ba01450122
claude code version: Not applicable: static source inspection (commands.json).
model id: Not applicable: static source inspection (commands.json).
scanner version: Not applicable: static source inspection.
rulepack version: Not applicable: static source inspection.
agents: []
commands: ["Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."]
prompt list: ["Not applicable: static source inspection (commands.json)."]
history: ["2026-10-19T18:07:17Z: pinned source inspection"]
application: {"applicationCategory":"DeveloperApplication","name":"semgrep — 8 hooks","operatingSystem":"Not exercised","softwareVersion":"b58f407c6ac0f5fe47dee8301602f2e290a8ecfb"}
review input: {"claims":[{"field":"summary","id":"acquired","sources":["LOCK.json","listing.json","commands.json"],"text":"Pinned source declarations and file hashes were listed."},{"field":"outcome","id":"listed","sources":["LOCK.json","listing.json","commands.json"],"text":"Listed 8 hook declarations. Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection."},{"field":"rule_results.0","id":"tree","sources":["LOCK.json","listing.json","commands.json"],"text":"The retained source tree matches its acquisition manifest."},{"field":"rule_results.1","id":"declared","sources":["LOCK.json","listing.json","commands.json"],"text":"Declared hook names (listing.json): PreToolUse; PostToolUse; SessionStart; SessionStart; SessionStart; Stop; Stop; SessionEnd"}],"evidence_sha256":{"LOCK.json":"7510807102d7b3bb4eb04f2a6be040d56db360c027555253e93ebfc6294965c0","commands.json":"570b943d68b346ed9d135c4e7bfc0f6c920eeb34269ca47b61615288584d44d9","complete.json":"91b504b43905fdc009504d516c45eea831f39a1995b9e7d69987c9756c936d6f","identity.json":"7e20deaeeaf1f4d8318b23412ff68f9497d1ad1ad6fd33e30510035e51c059bb","listing.json":"3e70791be960b44234a59a281b89efc53524f734ebf5d501d25d19e810689dfa","selection.json":"41766fd4a9c6175d70545cb5ea218f02b12fe89c6528308986313c43799abc62"},"identity_artifact":"identity.json"}
review: {"codex":"71dcb9693620c8d37f31fdfd4cf9a85e76fb1f6e17f7a2ce5b9c615f58d031d5","date":"2026-10-19","gates":"8ec801ef7e63191262a71f46d586fe04bd0e12ed619745f3e88a92057b2a6e35","grok":"e56b029a607cd737b670f7c0189c7da9f99b6718661217ed052555e5c0d43e12","kind":"machine-checked","reviewed_sha256":"80769a9455512ac52ee50e5f64deb31c3e602fbf24cf8ab237e88a95223e0a61","summary":"Deterministic gates passed; every claim rebuilt from evidence with a reviewed template; Grok reported no standing refutation."}

Downloadable evidence

transcript

Download complete transcript

Ran 22 git commands; each one's exit status and output hash is in commands.json. Scope: acquisition and static inspection.

sinkhole log

Download complete sinkhole log

Not applicable: static source inspection (commands.json).

canary log

Download complete canary log

Not applicable: static source inspection (commands.json).

scanner output

Download complete scanner output

Not applicable: static source inspection (commands.json).

normalized text

Download complete normalized text

{
  "listing": {
    "skills": [
      {
        "path": "plugin/skills/add-and-validate-guardian-developer-semgrep-rule/SKILL.md",
        "name": "add-and-validate-guardian-developer-semgrep-rule",
        "description": "write a custom semgrep rule with the user, add it to guardian in either user or repo scope, and prove it fires by writing a file that should trip it. use when someone wants guardian to catch something it currently misses, asks to write or add a semgrep rule, or wants a project convention enforced on the code claude writes.",
        "files": {
          "plugin/skills/add-and-validate-guardian-developer-semgrep-rule/SKILL.md": "cde31a31c56f1b7408350bf28daa69f8080e2416176df883577c5c768dfd78ef"
        }
      },
      {
        "path": "plugin/skills/install-mfw/SKILL.md",
        "name": "install-mfw",
        "description": "Install the mfw (Semgrep Malware Firewall) CLI via the curl|sh installer and walk the user through setup — trust store, PATH shims, shell integration, and the background daemon — asking questions at real decision points. Detects when the user's shell rc files are *managed* (symlinked into nix / home-manager / chezmoi / GNU stow / a dotfiles git repo) and, instead of clobbering them, adds mfw's source line to the right source-of-truth. Use when the user wants to install, set up, or onboard mfw on this machine.",
        "files": {
          "plugin/skills/install-mfw/SKILL.md": "e5479a19f4456e6280e87ec9dfe1846ae4660b46d146c78c81f605bc88448f60",
          "plugin/skills/install-mfw/scripts/inspect-shell-config.sh": "b687ad351fa160158d9d4f7240334fb891f936b8588b30fe2a080d8f22f57bc6",
          "plugin/skills/install-mfw/scripts/install-binary.sh": "4b668717db33351289ec90027f91e8836722061a6d570a355120dd5a55f2421b"
        }
      },
      {
        "path": "plugin/skills/remove-guardian-developer-semgrep-rule/SKILL.md",
        "name": "remove-guardian-developer-semgrep-rule",
        "description": "Remove a custom Semgrep rule

Excerpt shown; complete evidence is in the download.

Download full record JSON

Disclaimer

This record lists declarations and file hashes from a pinned source tree. Git command results from acquisition and static inspection are retained in commands.json. Scope: acquisition and static inspection. It is not a security or quality verdict. Changed bytes are outside this record.

Template placeholders refer to the snapshot metadata above.

Page updated 2026-10-19