Snyk Agent Scan finds the agent components installed on a machine (agent harnesses, MCP servers, and agent skills) and checks them for security threats such as prompt injection, tool poisoning, exposure to untrusted or private data, destructive capabilities, and malware hidden in natural-language instructions. It reads the configuration files of supported agents, connects to each MCP server to retrieve its tool descriptions, and sends the component details to the Agent Scan API for analysis. Secrets in configuration values and text are redacted before transmission, and a Snyk API token is required.
Two CLI lines exist. Version 0.5.x reports issue codes covering more than 15 risks and is planned for deprecation. Version 0.6 and later reports scored risk indicators across 14 risks, for MCP servers (prompt injection, untrusted content, private data, destructive capabilities) and for skills (prompt injection, suspicious downloads, malicious code, credential handling, secret detection). Both versions scan MCP tools, prompts, resources, and skills, and an inspect command lists components without analysis.
Starting a stdio MCP server means running the command in its config, so interactive scans ask for consent before contacting each server and show the command or remote URL. Remote requests refuse link-local and cloud-metadata addresses and do not follow redirects. Besides the interactive scan mode, a background mode run through device management scans machines at intervals and reports to a Snyk Evo instance, so security teams can monitor the agent supply chain across a company.
| Agent | MCP servers | Skills |
|---|---|---|
| Windsurf, Cursor, VS Code, GitHub Copilot, Claude Code, Gemini CLI, Kiro, OpenCode, Antigravity | ✓ | ✓ |
| Claude Desktop | ✓ | ✓ (not on Windows) |
| Codex | ✓ | ✓ (macOS and Linux) |
| OpenClaw, Amp | ✗ | ✓ |
| Amazon Q | ✓ | ✗ |
Features
- Auto-discovery: finds agents, MCP servers, and skills from the install paths of 14 supported agents on macOS, Linux, and Windows
- MCP risk checks: prompt injection, tool poisoning, tool shadowing, toxic flows, untrusted content, private data, and destructive capabilities
- Skill risk checks: prompt injection, malware payloads, suspicious download URLs, malicious code, insecure credential handling, and hardcoded secrets
- Scored risks: version 0.6 and later reports scored risk indicators instead of issue codes
- Scope coverage: detects components at system, user, project or workspace, and extension or plugin scope
- Server consent: interactive scans ask before contacting each MCP server, with environment variables and headers redacted
- Inspect mode: lists discovered components without running a security analysis
- CI mode: exits non-zero when findings or operational failures remain, with options to ignore named risks
- JSON output: machine-readable results, with a schema that depends on the CLI version
- Background mode: periodic scans through device management, reported to Snyk Evo for central monitoring
- Signed releases: standalone binaries ship with an SBOM and GPG-signed checksums
