The Snyk CLI is a command-line security scanner that checks software projects for vulnerabilities and brings Snyk's scans into a developer's terminal, IDE, or CI/CD pipeline. It covers four kinds of content: open-source dependencies, application source code, container images, and infrastructure-as-code files such as Terraform and Kubernetes manifests. This catalog entry tracks it as the way coding agents reach those scans over MCP.
For each issue found, a scan reports the severity, a link to a detailed description, the dependency path through which a vulnerable module entered the project, and guidance on fixing it. Results can be filtered by a severity threshold, printed as JSON, and run across every project detected in a directory.
An experimental agent mode is aimed at AI coding agents: it runs open-source, code, and secrets scans in one pass and returns compact, token-efficient output. A monitor command snapshots a project's dependencies so Snyk can rescan them over time and send alerts when new vulnerabilities are disclosed or a fix becomes available. Use requires a Snyk account, and private repositories are subject to test limits.
Features
- Open-source dependency scanning: finds known vulnerabilities in package dependencies with the path each one entered through and fix guidance
- Code scanning: checks application source code for security vulnerabilities
- Container scanning: tests container images and Kubernetes applications for vulnerable packages
- Infrastructure as code: flags insecure configuration in Terraform and Kubernetes files
- Agent mode: an experimental single-pass scan of dependencies, code, and secrets with compact output for AI coding agents
- Continuous monitoring: snapshots dependencies and alerts on newly disclosed issues or newly available fixes
- Output controls: severity thresholds, JSON output, and auto-detection of all projects in a directory
- Workflow coverage: runs from the terminal, inside IDEs, and in CI/CD pipelines
