mcpField
S
snyk

snyk

Local
github.com/snykSecurity58Updated 1w ago
Repository

About snyk

Snyk MCP is an MCP server bundled with the Snyk CLI that lets MCP-enabled agentic tools run Snyk security scans. It is aimed at developers who want security checks inside AI-assisted workflows.

Key features

  1. 01Code, dependency, IaC, container, SBOM and secret scans
  2. 02AIBOM creation and package health assessment
  3. 03Folder trust and authentication management
  4. 04Retrieval of Snyk security findings

Use cases

  1. 01Triggering dependency and code scans from a coding agent
  2. 02Reviewing Snyk findings within an MCP-enabled tool
  3. 03Assessing the health and security of third-party packages

MCP support

The project runs as an MCP server through the snyk mcp command and exposes tools such as snyk_sca_scan and snyk_code_scan to MCP clients. Running snyk_sca_scan may execute third-party ecosystem tools like Gradle or Maven on the local machine.

Configuration

Local server config is the same for every client. Copy it into your client’s MCP config file.

mcp.json · Universal config
{
  "mcpServers": {
    "io-snyk": {
      "command": "npx",
      "args": [
        "-y",
        "snyk"
      ]
    }
  }
}
Run commandnpx -y snyk

Local servers need a runtime on your machine (e.g. Node.js 18+). Config file locations differ by client; see your client’s docs.

Packages
npmsnyk1.1304.2

Tools

No tool list yet

Local servers expose tools only once running on your machine, and the maintainer has not provided a tool list.

Details

From the project README

Snyk Studio MCP

MCP (Model Context Protocol) is an open protocol that standardizes how applications share context with large language models.

MCP can provide AI systems with additional information needed to generate accurate and relevant responses for use cases where the AI systems do not have the context, by integrating the AI systems with tools and platforms that have specific capabilities.

You can integrate Snyk MCP into MCP-supporting tools to provide Snyk security context.

Snyk is introducing an MCP server as part of the Snyk CLI. This allows MCP-enabled agentic tools to integrate Snyk security scanning capabilities directly, thus bridging the gap between security scanning and AI-assisted workflows.

In environments or applications that use MCP, you can use the snyk mcp CLI command to:

  • Invoke Snyk scans:
    Trigger CLI security scans for code, dependencies, or configurations in your codebase in your current MCP context.
  • Retrieve results:
    Obtain Snyk security findings directly in your MCP-enabled tool or environment.

The Snyk MCP server supports integrating the following Snyk security tools into an AI system:

  • snyk_sca_scan (Open Source scan)
  • snyk_code_scan (Code scan)
  • snyk_iac_scan (IaC scan)
  • snyk_container_scan (Container scan)
  • snyk_sbom_scan (SBOM file scan)
  • snyk_secret_scan (Secret detection scan)
  • snyk_aibom (Create AIBOM)
  • snyk_package_health_check (Package health and security assessment)
  • snyk_trust (Trust a given folder before running a scan)
  • snyk_auth (authentication)
  • snyk_logout (logout)
  • snyk_auth_status (authentication status check)
  • snyk_version (version information)

Running snyk_sca_scan may execute third-party ecosystem tools (for example, Gradle or Maven) on your machine to fetch the project's dependency tree.

For more details, see the Snyk MCP installation, configuration and startup and Troubleshooting for the Snyk MCP server pages.

This repository is closed to public contributions.

Comments

Markdown supported

New to MCP?

From what the protocol is to installing your first server, these answers cover most first questions.

An open protocol that defines how AI applications connect to external tools and data in a uniform way. Clients talk to the model; MCP servers provide tools, resources and prompt templates. They exchange standard messages, so one server can be reused by many clients.