snyk/agent-scan

Security scanner for AI agents, MCP servers and agent skills.

Off-topic? No.

Project Name: Snyk Agent Scan

One-liner: A command-line security scanner that finds AI agents (like Claude, Cursor, or VS Code) on your machine, inspects their connected MCP servers and skills, and checks them for vulnerabilities like prompt injection, malicious code, and exposed secrets.

What it does: Agent Scan automatically discovers configuration files for popular AI coding assistants. It then inspects two main components: MCP servers (which give agents extra tools and capabilities) and agent skills (instruction files that teach agents how to do tasks). It runs local checks and sends redacted information to Snyk's analysis API to identify security risks.

Why it's useful: As AI agents gain the ability to execute code, read files, and interact with the internet, they become a new attack surface. This tool helps developers and security teams secure their AI supply chain by catching malicious or vulnerable components before they cause harm.

Key features:

  • Auto-discovery: Scans for 13+ agents including Windsurf, Cursor, VS Code, Claude Desktop/Code, Gemini CLI, Codex, Amazon Q, and more.
  • Risk detection: Identifies 15 distinct security risks, including prompt injection, dangerous tool descriptions, malicious code in skills, hardcoded secrets, and destructive capabilities.
  • Interactive consent: Before running MCP servers (which execute commands), it asks for your permission and shows you exactly what will run.
  • CI/CD integration: Has a --ci flag that exits with a non-zero code if security findings remain, perfect for automated pipelines.
  • Enterprise monitoring: Can run in background mode (MDM) to report findings to Snyk Evo for company-wide visibility.

How it works: You run snyk-agent-scan (or uvx snyk-agent-scan). It scans your home directory and project files to find agent configs. For MCP servers, it connects to them to fetch tool descriptions (with your consent). It then analyzes everything locally and via Snyk's API, and outputs a report in human-readable or JSON format.

Target audience: Developers, DevSecOps engineers, and security teams using AI coding assistants who want to ensure their agent configurations are safe.

Related

  • Project
    cisco-ai-defense/skill-scanner

    A security scanner for AI Agent Skills that detects prompt injection, data exfiltration, and malicious code using multi-engine analysis.

  • Project
    NVIDIA/SkillSpector

    A security scanner for AI agent skills that detects vulnerabilities and malicious patterns using static analysis and LLM-based semantic evaluation.

  • Project
    affaan-m/agentshield

    A security auditor for AI agent configurations that scans Claude Code setups for secrets, permission misconfigurations, and prompt injection vectors.

  • Project
    tech-leads-club/agent-skills

    A secure, validated skill registry and CLI for extending AI coding agents with verified, safe, and tested capabilities.

  • Project
    asamassekou10/ship-safe

    An AI security scanner that detects vulnerabilities in application code, AI agents, and supply chains, specifically targeting risks like prompt injection and agent hijacking.