snyk/agent-scan

Security scanner for AI agents, MCP servers and agent skills.

What is Snyk Agent Scan?

Snyk Agent Scan is a command‑line security scanner that looks for agent components on your computer – things like MCP (Model‑Control‑Protocol) servers, agent tools, and agent skills used by AI assistants such as Claude, Cursor, GitHub Copilot, Gemini CLI, etc. It then checks those components for known threats such as prompt‑injection, tool‑poisoning, hidden malware payloads, hard‑coded secrets, and other risky behaviours.

How it works (high‑level)

  1. Discovery – The tool walks the file system (system‑wide, per‑user, project and plugin locations) and automatically finds configuration files for supported agents. It knows where each agent stores its MCP definitions and skill files on macOS, Linux and Windows.
  2. Optional consent – For MCP servers that run as local commands or contact remote URLs, the CLI asks you to approve each connection (unless you use the --dangerously-run-mcp-servers flag).
  3. Analysis – Discovered components are sent (redacted of secrets) to Snyk’s cloud analysis API, which evaluates them against a catalogue of 14‑15 security risks.
  4. Report – The CLI prints a human‑readable report (or JSON) that scores each risk and lists the affected component. The output format changed from “issue‑code” in v0.5 to a risk‑based scoring system in v0.6.

Key features

Feature What it does
Auto‑discovery Finds MCP configs, tools and skill files for many agents (Claude, Cursor, VS Code, Copilot, Gemini, Windsurf, etc.) across OSes.
Risk catalogue Detects prompt‑injection, untrusted content, private‑data exposure, destructive capabilities, malicious code, secret leakage, suspicious downloads, and more.
Two output styles v0.5 – issue‑code list (planned for deprecation). v0.6+ – scored risk indicators with numeric scores.
Standalone binary & uvx install No npm package; run via the Python‑based uvx runner or download a pre‑built binary.
Background/MDM mode Can be deployed enterprise‑wide to run periodically and push results to Snyk Evo.
Safety warnings Explicit consent for MCP servers, sandbox‑recommendations, and network‑address filtering to avoid cloud‑metadata endpoints.
Verification GPG‑signed release checksums and SBOMs are provided for binary integrity.

Who should use it?

  • Security teams that need visibility into the AI‑agent supply chain on employee machines.
  • Developers who build or maintain custom agent skills and want to validate them locally before publishing.
  • Enterprises using Snyk Evo to monitor agent‑related risk across fleets.

Getting started (quick steps)

  1. Create a Snyk account and copy your API token.
  2. Export the token: export SNYK_TOKEN=your‑api‑token.
  3. Run the scanner – either:
    # Using uv (recommended)
uvx snyk-agent-scan@latest               # whole machine
uvx snyk-agent-scan@latest ~/.vscode/mcp.json   # specific config
    or download the binary from the GitHub releases page and execute it.
  4. Review the consent prompts for any MCP servers that would be contacted.
  5. Read the generated report; high‑scoring risks indicate components you may need to patch, remove, or re‑configure.

Limitations & cautions

  • The CLI output is experimental; Snyk does not guarantee stability of field names or risk scores between releases.
  • Scanning MCP configurations can execute commands or make outbound network calls – run untrusted scans inside a sandbox.
  • Only the agents listed in the discovery table are supported; new agents will need explicit addition.
  • Background scans automatically contact remote MCP servers; the --dangerously-run-mcp-servers flag should be used only in trusted environments.

Where to learn more

  • Technical report on agent‑skill threats: .github/reports/skills-report.pdf.
  • CLI reference: docs/cli-reference.md.
  • Risk definitions: docs/risks.md (v0.6+) and docs/issue-codes.md (v0.5).
  • Verification guide for binaries is in the README under Verifying Standalone Binaries.

All information above is taken directly from the project's README; no additional features have been inferred.

Related

  • Project
    NVIDIA/SkillSpector

    SkillSpector is an open‑source security scanner for AI‑agent “skills”. It statically checks code bundles for 71 known vulnerability patterns (prompt injection, data exfiltration, privilege escalation, etc.) and can optionally run an LLM‑based semantic analysis. It accepts directories, zip files, Git URLs, or single SKILL.md files, produces terminal, JSON, Markdown, or SARIF reports, and supports baseline suppression to hide known false positives. Install via `uv tool install` or Docker, and configure many LLM providers (OpenAI, Anthropic, Bedrock, NVIDIA Build, Gemini, Ollama, Azure, etc.) for the optional second stage. Designed for developers and security teams to vet skills before publishing them to NVIDIA’s Verified Skills catalog or internal registries.

  • Project
    cisco-ai-defense/skill-scanner

    Skill Scanner is an open‑source security scanner for AI‑agent skill packages (e.g., OpenAI Codex, Cursor, Claude). It combines signature‑based YARA/YAML rules, AST‑based data‑flow analysis, optional LLM‑as‑a‑judge, and a CEL decision layer to detect prompt‑injection, data‑exfiltration, and malicious code patterns. Install via pip, run from the CLI or Python SDK, and integrate with CI/CD via GitHub Actions or a pre‑commit hook. Findings are reported with severity levels; a clean scan is best‑effort only and does not guarantee safety.

  • Project
    superagent-ai/superagent

    An open-source SDK for AI agent safety that blocks prompt injections, redacts sensitive data, and scans repositories for AI-targeted threats.

  • Project
    asamassekou10/ship-safe

    A local security CLI that scans codebases for vulnerabilities—especially in AI agents, LLM prompts, and AI-written code—and verifies each finding with concrete evidence.

  • Project
    luongnv89/asm

    A scriptable CLI for installing and managing AI agent skills across 21 different providers, featuring token cost tracking and security scanning.