diff --git a/pkgs/development/python-modules/semgrep/common.nix b/pkgs/development/python-modules/semgrep/common.nix
index 6c687b88db1e..55ffe9b74ff8 100644
--- a/pkgs/development/python-modules/semgrep/common.nix
+++ b/pkgs/development/python-modules/semgrep/common.nix
@@ -1,9 +1,9 @@
 { lib }:
 
 rec {
-  version = "1.104.0";
+  version = "1.140.0";
 
-  srcHash = "sha256-rVBnjG+g7OaOQ8LYCurqNC2dYY/Dm4hdocgotc4lADg=";
+  srcHash = "sha256-RLcES0kamYMlLo1L4Y+mSJDB91SP84h75oLQxX9eCjQ=";
 
   # submodule dependencies
   # these are fetched so we:
@@ -13,8 +13,8 @@ rec {
     "cli/src/semgrep/semgrep_interfaces" = {
       owner = "semgrep";
       repo = "semgrep-interfaces";
-      rev = "5e0c767ec323f3f2356d3bf8dbdf7c7836497d8a";
-      hash = "sha256-RvkUbS+q/UqkKLDBCvDWkuRYDzWXp+JonFE7qVkEsY8=";
+      rev = "8baadf6b8604b59c9a660dbb371726c12a3666b8";
+      hash = "sha256-37sEprdR8I45tRYsXNNFz0okoTH32MJU9EvMogEMtMw=";
     };
   };
 
@@ -25,19 +25,19 @@ rec {
   core = {
     x86_64-linux = {
       platform = "musllinux_1_0_x86_64.manylinux2014_x86_64";
-      hash = "sha256-Qn97ZJI1//n47z/qX87AuIWRvvXurwH26C/vBrZ12gc=";
+      hash = "sha256-/aZnv5a7ifSk1l98Qf+HKQhnrHKi88SKTuJZwQ7Ons4=";
     };
     aarch64-linux = {
       platform = "musllinux_1_0_aarch64.manylinux2014_aarch64";
-      hash = "sha256-vuLuxsqnaPSbcVuwyhRRTTTwDVCZvOkRJURZUKnh/9I=";
+      hash = "sha256-f0k/sNME/0JGrvV7/H47jWLY3OadslzljfA7Kpp0STo=";
     };
     x86_64-darwin = {
       platform = "macosx_10_14_x86_64";
-      hash = "sha256-QWESQQyBzyupzC1V5zs1GgZBtHEUgayvcKwDn+5pXUc=";
+      hash = "sha256-HldS8Rcx+OkFYfBr/5+rMXVg8prrAuBCDTbkgb8DVsQ=";
     };
     aarch64-darwin = {
       platform = "macosx_11_0_arm64";
-      hash = "sha256-gkX82X79L+v5A1Mby6sCqXcx79fgJGIfmRdARtULmUc=";
+      hash = "sha256-LiIO4Smomx6tHTtg8ewwXaKXdJDpcmE+auJ5FjWi990=";
     };
   };
 
diff --git a/pkgs/development/python-modules/semgrep/default.nix b/pkgs/development/python-modules/semgrep/default.nix
index ee915a30945c..c86bbe502701 100644
--- a/pkgs/development/python-modules/semgrep/default.nix
+++ b/pkgs/development/python-modules/semgrep/default.nix
@@ -22,6 +22,7 @@
   opentelemetry-exporter-otlp-proto-http,
   opentelemetry-instrumentation-requests,
   opentelemetry-sdk,
+  mcp,
   packaging,
   peewee,
   pytest-freezegun,
@@ -97,6 +98,7 @@ buildPythonPackage rec {
     packaging
     jsonschema
     wcmatch
+    mcp
     peewee
     defusedxml
     urllib3
@@ -125,6 +127,7 @@ buildPythonPackage rec {
     "tests/default/e2e"
     "tests/default/e2e-pysemgrep"
     "tests/default/e2e-other"
+    "tests/default/mcp"
   ];
 
   disabledTests = [
diff --git a/pkgs/development/python-modules/semgrep/semgrep-core.nix b/pkgs/development/python-modules/semgrep/semgrep-core.nix
index 5a598631ceae..ea6f1f58eaba 100644
--- a/pkgs/development/python-modules/semgrep/semgrep-core.nix
+++ b/pkgs/development/python-modules/semgrep/semgrep-core.nix
@@ -25,7 +25,7 @@ stdenvNoCC.mkDerivation rec {
       inherit version;
       format = "wheel";
       dist = python;
-      python = "cp39.cp310.cp311.py39.py310.py311";
+      python = "cp310.cp311.cp312.cp313.cp314.py310.py311.py312.py313.py314";
       inherit (data) platform hash;
     };
 
diff --git a/pkgs/development/python-modules/semgrep/update.sh b/pkgs/development/python-modules/semgrep/update.sh
index 914de6c9331f..f4f847f1113f 100755
--- a/pkgs/development/python-modules/semgrep/update.sh
+++ b/pkgs/development/python-modules/semgrep/update.sh
@@ -34,11 +34,6 @@ NEW_VERSION=$(
 NEW_VERSION="${NEW_VERSION:1}"
 OLD_VERSION="$(instantiateClean semgrep.passthru.common.version)"
 
-if [[ "$OLD_VERSION" == "$NEW_VERSION" ]]; then
-    echo "Already up to date"
-    exit
-fi
-
 replace() {
     sed -i "s@$1@$2@g" "$3"
 }
@@ -48,22 +43,6 @@ fetchgithub() {
     nix-build -A "$1" 2>&1 >/dev/null | grep "got:" | cut -d':' -f2 | sed 's| ||g'
     set -eo pipefail
 }
-
-fetch_arch() {
-  VERSION=$1
-  PLATFORM=$2
-  nix-prefetch "{ fetchPypi }:
-fetchPypi rec {
-  pname = \"semgrep\";
-  version = \"$VERSION\";
-  format = \"wheel\";
-  dist = python;
-  python = \"cp38.cp39.cp310.cp311.py37.py38.py39.py310.py311\";
-  platform = \"$PLATFORM\";
-}
-"
-}
-
 replace "$OLD_VERSION" "$NEW_VERSION" "$COMMON_FILE"
 
 echo "Updating src"
@@ -86,8 +65,9 @@ update_core_platform() {
     PLATFORM="$(instantiateClean "semgrep.passthru.common.core.$SYSTEM.platform")"
 
     OLD_HASH="$(instantiateClean "semgrep.passthru.common.core.$SYSTEM.hash")"
+    URL="$(nix-instantiate -A "semgrep.passthru.semgrep-core.src.url" --raw --eval --strict --argstr system "$SYSTEM")"
     echo "Old core hash $OLD_HASH"
-    NEW_HASH="$(fetch_arch "$NEW_VERSION" "$PLATFORM")"
+    NEW_HASH="$(nix hash convert --hash-algo sha256 --to sri $(nix-prefetch-url $URL))"
     echo "New core hash $NEW_HASH"
     replace "$OLD_HASH" "$NEW_HASH" "$COMMON_FILE"
 
@@ -144,4 +124,3 @@ done
 rm -rf "$TMPDIR"
 
 echo "Finished"
-