docs(guardian): restructure enterprise deployment page - #2811
Open
milanwilliams wants to merge 6 commits into
Open
docs(guardian): restructure enterprise deployment page#2811milanwilliams wants to merge 6 commits into
milanwilliams wants to merge 6 commits into
Conversation
Reorganize the Guardian enterprise deployment guide around two rollout options and fix download links that 404 in production. - Lead with agent built-in enterprise controls (Option 1), with Claude Code and Cursor tabs as steps; fill in the Cursor team-marketplace rollout from Cursor's docs. - Trim the MDM section (Option 2) to Jamf and Kandji tabs, and note that the templates configure Claude Code only. - Inline the .plist and .mobileconfig templates as collapsible code blocks. Mintlify's hosted build only publishes a whitelist of static file types, so /assets/guardian/*.plist and *.mobileconfig 404 on semgrep.dev even though they resolve under `mintlify dev`. Remove the now-unreferenced asset files. - Move Authentication below the rollout options, pull the shared read-only token guidance out of the tabs since it is IDE-independent, and make the Credentials headings tab-specific. - Use one consistent verification command throughout. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Contributor
|
Preview deployment for your docs. Learn more about Mintlify Previews.
|
Keep both names on the tab so readers searching for either one find it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
abhijna
reviewed
Aug 26, 2026
abhijna
left a comment
abhijna
left a comment
Collaborator
There was a problem hiding this comment.
@milanwilliams added some feedback. Let me know what you think
| description: How to deploy Semgrep Guardian in your enterprise environment. | ||
| sidebarTitle: Enterprise deployment | ||
| --- | ||
|
|
Collaborator
There was a problem hiding this comment.
PREREQUISITES
- You have a Semgrep account and organization.
- Claude Code is the recommended setup for organization-wide rollout.
- You are an admin for your coding agent's enterprise controls and your MDM platform, if applicable.
- For Cursor: your organization is on a Teams or Enterprise plan and can configure team marketplaces.
Collaborator
There was a problem hiding this comment.
I know we removed the prereqs earlier, but it feels like an abrupt start without them 😬. Also, shouldn't these requirements be more visible anyway?
| </Tabs> | ||
|
|
||
| ## Use your agent's built-in enterprise controls | ||
| **Tips** |
Collaborator
There was a problem hiding this comment.
Suggested change
| **Tips** | |
| Deployment recommendations: |
|
|
||
| To roll out Semgrep Guardian organization-wide, standardize the installation process so that the plugin is automatically installed by the developer's agent, rather than relying on each developer to install it manually. | ||
|
|
||
| For individual developer setup, see the [Guardian quick start](/semgrep-guardian/overview). |
Collaborator
There was a problem hiding this comment.
Suggested change
| For individual developer setup, see the [Guardian quick start](/semgrep-guardian/overview). | |
| For individual developer setup, read the instructions on the [Semgrep Guardian](/semgrep-guardian/overview) page. |
| ## Option 2: Deploy via a mobile device management (MDM) platform | ||
|
|
||
| Credentials are written to `~/.semgrep/settings.yml` when you sign in through `semgrep login` or set an API token manually. This is the same file the Semgrep CLI uses. If you are already logged in through `semgrep login`, Guardian can use those credentials. | ||
| Deploy via your MDM platform to scope rollout by a device group. These templates configure Claude Code only. To roll out Guardian to Cursor, use [Option 1](#option-1-use-your-agents-built-in-enterprise-controls). |
Collaborator
There was a problem hiding this comment.
Suggested change
| Deploy via your MDM platform to scope rollout by a device group. These templates configure Claude Code only. To roll out Guardian to Cursor, use [Option 1](#option-1-use-your-agents-built-in-enterprise-controls). | |
| Deploy through your MDM platform to scope rollout by device group. These templates configure Claude Code only. To roll out Guardian to Cursor, use [Option 1](#option-1-use-your-agents-built-in-enterprise-controls). |
| sidebarTitle: Enterprise deployment | ||
| --- | ||
|
|
||
| To roll out Semgrep Guardian organization-wide, standardize the installation process so that the plugin is automatically installed by the developer's agent, rather than relying on each developer to install it manually. |
Collaborator
There was a problem hiding this comment.
Suggested change
| To deploy Semgrep Guardian organization-wide, configure each developer's coding agent to install the plugin automatically. This eliminates the need for developers to install the plugin manually. |
| </Step> | ||
| </Steps> | ||
|
|
||
| Installation modes apply to plugins in a team marketplace, not to plugins developers install themselves from the public Cursor Marketplace. Team marketplaces are available on Teams and Enterprise plans, and on Enterprise plans only admins can add them. See [Team marketplaces](https://cursor.com/docs/plugins#team-marketplaces) for more information. |
Collaborator
There was a problem hiding this comment.
Suggested change
| Installation modes apply to plugins in a team marketplace, not to plugins developers install themselves from the public Cursor Marketplace. Team marketplaces are available on Teams and Enterprise plans, and on Enterprise plans only admins can add them. See [Team marketplaces](https://cursor.com/docs/plugins#team-marketplaces) for more information. | |
| Installation modes apply only to plugins available in a team marketplace, not to plugins that developers install themselves from the public Cursor Marketplace. Team marketplaces are available on Teams and Enterprise plans. Only admins can add plugins to a team marketplace. For more information, see [Team marketplaces](https://cursor.com/docs/plugins#team-marketplaces). |
Co-authored-by: Abhijna Parigi <abhijna@semgrep.com>
Co-authored-by: Abhijna Parigi <abhijna@semgrep.com>
Co-authored-by: Abhijna Parigi <abhijna@semgrep.com>
Co-authored-by: Abhijna Parigi <abhijna@semgrep.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Reorganizes the Guardian enterprise deployment guide around two rollout options, and fixes template download links that 404 in production.
Structure
Option 1: Use your agent's built-in enterprise controls now leads the page, with Claude Code and Cursor tabs written as steps.
Option 2: Deploy via a mobile device management (MDM) platform - Jamf and Iru tabs + clarifies that it's Claude Code only
Authentication moved below the rollout options. The shared-token guidance is pulled out of the tabs (it's IDE-independent) and reframed as [Enterprise only] Shared read-only tokens
Fix: 404ing template downloads
The
.plistand.mobileconfiglinks worked locally but were 404'ing in production. Both templates are now inlined as code blocks & two unreferenced asset files are removed🤖 Generated with Claude Code