Snyk Agent Scan is a command-line scanner for the agent components installed on a machine. It discovers coding agents, their Model Context Protocol (MCP) servers, and their agent skills, then analyses them for prompt injection, tool poisoning, tool shadowing, toxic flows, untrusted content, insecure credential handling, hard-coded secrets, destructive capabilities, and malware payloads hidden in natural language. It reads each agent's configuration files and, for MCP, connects to the servers to retrieve their tool descriptions.
Scanning an MCP configuration executes the commands defined in it, because retrieving tool descriptions requires starting the stdio servers. Interactive runs ask for consent per server and show the server name, command, and redacted environment variables first; a declined server is recorded and never started. Non-interactive environments such as continuous-integration pipelines need --dangerously-run-mcp-servers to bypass the prompt. For untrusted or third-party configurations the guidance is to run the scan inside a sandbox: a Docker container, a virtual machine, or a disposable environment.
Two output lines exist. Version 0.5.x emits issue codes against the 2025-09-02 analysis API and is planned for deprecation; version 0.6 and later emit scored risk indicators against the 2026-07-10 API, covering 15 risks across MCP servers and skills, with --ignore-risks and --ignore-failure-codes to filter them. Both raw output formats — issue codes, risk names, field names, severity labels, and response structure — are marked experimental and may change between releases.
Discovery covers Windsurf, Cursor, VS Code, Claude Desktop, Claude Code, Gemini CLI, OpenClaw, Amp, Kiro, OpenCode, Antigravity, Codex, and Amazon Q, with per-operating-system coverage varying by agent, and it breaks down by configuration scope: system, user, project or workspace, and extension or plugin. Skills can be excluded with --no-skills, and an inspect command lists components without analysing them.
The tool runs in two modes that can be combined: scan mode reports on the current machine on demand, and background mode rescans at intervals and reports to a Snyk Evo instance so a security team can monitor an organisation's agent supply chain centrally. Analysis is partly server-side — agent application details, MCP server configurations and signatures, tool names and descriptions, and skill content are sent to the Agent Scan API, with secrets redacted before transmission — and an API token is required. Release binaries ship with a software bill of materials and GPG-signed checksums.
Features
- Machine-wide discovery: finds installed agents, their MCP servers, and their skills from known configuration paths, without being pointed at each one
- MCP analysis: inspects server tool descriptions, prompts, and resources for prompt injection, tool poisoning, tool shadowing, and toxic flows
- Skill analysis: flags injected instructions, suspicious download URLs, malicious code, credential handling, and detected secrets in skill content
- Consent gate: each stdio server's command and arguments are shown for approval before it is started, with declines recorded
- Risk scoring: version 0.6 and later report scored risk indicators with evidence fields instead of flat issue codes
- Scope coverage: system, user, project or workspace, and extension or plugin configurations, documented per agent
- CI mode: --ci exits non-zero when findings or operational failures remain, with per-risk and per-failure-code ignores
- JSON output: machine-readable results whose schema follows the CLI version line
- Background monitoring: periodic scans reported to a Snyk Evo instance for fleet-wide visibility
- Signed releases: standalone binaries with a software bill of materials, checksums, and a GPG-signed checksum file
