Snyk Agent Scan

What is Snyk Agent Scan about?

Snyk Agent Scan discovers agent‑related artifacts on a workstation – MCP server configurations, harnesses, and skill markdown files – and analyzes them for a catalog of more than 15 security issue types. It helps developers and security teams understand the attack surface introduced by locally installed AI assistants.

How to use Snyk Agent Scan?

1. Obtain a Snyk API token and export it as SNYK_TOKEN.
2. Install the CLI via uvx snyk-agent-scan@latest (or pip install snyk-agent-scan).
3. Run a full scan: uvx snyk-agent-scan@latest.
4. Optionally target specific MCP config files or skill directories, e.g.:

   uvx snyk-agent-scan@latest ~/.vscode/mcp.json
   uvx snyk-agent-scan@latest ~/.claude/skills
   

5. For non‑interactive CI/CD pipelines add --dangerously-run-mcp-servers to bypass consent prompts.

Key Features

• Auto‑discovery of agents (Claude, Cursor, Gemini CLI, Windsurf, etc.) across macOS, Linux and Windows.
• Comprehensive issue catalog covering prompt injection, tool poisoning, tool shadowing, toxic flows, malware payloads, hard‑coded secrets, credential mishandling, and more.
• Skill scanning (optional) for vulnerabilities in markdown‑based skill definitions.
• Interactive consent for starting stdio MCP servers, with a flag to skip in trusted environments.
• Background mode for enterprise MDM or CrowdStrike integrations that push results to Snyk Evo.
• Rich output: human‑friendly rich text, JSON export, and detailed per‑issue codes (E001, W008, etc.).

Use Cases

• Developer security hygiene: regular local scans before committing code that bundles AI agents.
• Enterprise monitoring: continuous background scans across employee workstations, reporting to a central Snyk Evo dashboard.
• CI/CD gate: enforce that no vulnerable MCP configurations or skills are shipped in release artifacts.
• Incident response: quickly inventory all agent components on a compromised host to assess exposure.

FAQ

Q: Will scanning MCP configs execute the configured commands? A: Yes. In interactive mode the tool prompts for explicit consent before launching each stdio server. Use the --dangerously-run-mcp-servers flag only in trusted environments.

Q: Can I skip skill analysis? A: Add the --no-skills flag to the scan command.

Q: Does Agent Scan upload my code or data? A: Only metadata such as tool names, descriptions and issue findings are sent to Snyk’s verification API. No raw prompt content or user data is stored.

Q: How do I run the scanner in a sandbox? A: Execute the CLI inside a Docker container, VM, or any disposable environment, especially when scanning third‑party MCP configs.

Q: Is there a way to integrate with existing security platforms? A: Use the background mode (snyk-agent-scan evo …) to push results to Snyk Evo, which can be linked to SIEMs or other monitoring solutions.

NEW Read our technical report on the emerging threats of the agent skill eco-system published together with Agent Scan 0.4, which adds support for scanning agent skills.

Agent Scan helps you keep an inventory of all your installed agent components (harnesses, MCP servers, and skills) and scans them for common threats like prompt injections, sensitive data handling, or malware payloads hidden in natural language. Ignore analysis on skills by using --no-skills.

Security Warning

⚠️ IMPORTANT: Scanning MCP configurations will execute the commands defined in them.

When Agent Scan scans an MCP configuration file, it starts the stdio MCP servers by executing the commands and arguments specified in the config. This is necessary to retrieve tool descriptions and perform security analysis.

Recommendations:

• Run scans inside a sandbox (Docker container, VM, or disposable environment) when evaluating untrusted or third-party MCP configs
• Review the consent prompt carefully during interactive scans, it shows the exact command and arguments that will be executed for each server
• Use --dangerously-run-mcp-servers only in trusted environments where you've verified all MCP server commands

By default, Agent Scan requires explicit user consent (y/n) before starting each stdio MCP server during interactive runs. This gives you control over what gets executed on your system.

Highlights

• Auto-discover MCP configurations, agent tools, skills
• Scanning of Claude, Cursor, Windsurf, Gemini CLI, Amp, Amazon Q, and other agents.
• Detects 15+ distinct security risks across MCP servers and agent skills:
  • MCP: Prompt Injection, Tool Poisoning, Tool Shadowing, Toxic Flows
  • Skills: Prompt Injection, Malware Payloads, Untrusted Content, Credential Handling, Hardcoded Secrets

Supported agents and capabilities

Agent Scan auto-discovers agents and their capabilities (MCP servers or skills) when their install paths exist. The table reflects well-known agent definitions.

• ✓: at least one path is defined for that capability.
• ✗: the agent is listed for that OS but has no paths for that capability.
• —: that agent is not included for that OS.
• Skills Skills can be ignored by using --no-skills

Agent	macOS MCP	macOS Skills	Linux MCP	Linux Skills	Windows MCP	Windows Skills
Windsurf	✓	✓	✓	✓	✓	✓
Cursor	✓	✓	✓	✓	✓	✓
VS Code	✓	✓	✓	✓	✓	✓
Claude Desktop	✓	✗	—	—	✓	✗
Claude Code	✓	✓	✓	✓	✓	✓
Gemini CLI	✓	✓	✓	✓	✓	✓
OpenClaw	✗	✓	✗	✓	✗	✓
Amp	✗	✓	✗	✓	✗	✓
Kiro	✓	✗	✓	✗	✓	✗
OpenCode	✗	✗	✗	✗	✗	✗
Antigravity	✓	✗	✓	✗	✓	✗
Codex	✗	✓	✗	✓	—	—
Amazon Q	✓	✗	✓	✗	✓ (WSL)	✗

Quick Start

To get started:

1. Sign up at Snyk and get an API token from https://app.snyk.io/account (API Token → KEY → click to show).
2. Set the token as an environment variable before running any scan:

   export SNYK_TOKEN=your-api-token-here
   

3. Have uv installed on your system.

Scanning

To run a full scan of your machine (auto-discovers agents, MCP servers, skills), run:

uvx snyk-agent-scan@latest

This will scan for security vulnerabilities in MCP servers, tools, prompts, and resources. It will automatically discover a variety of agent configurations, including Claude Code/Desktop, Cursor, Gemini CLI, and Windsurf.

uvx snyk-agent-scan@latest

You can also scan particular MCP configuration files or skills:

# scan a specific mcp configuration
uvx snyk-agent-scan@latest ~/.vscode/mcp.json
# scan a single agent skill
uvx snyk-agent-scan@latest ~/path/to/my/SKILL.md
# scan all claude skills
uvx snyk-agent-scan@latest ~/.claude/skills

Example Run

Scanner Capabilities

Agent Scan is a security scanning tool to both scan and inspect the supply chain of agent components on your machine. It scans for common security vulnerabilities like prompt injections, tool poisoning, toxic flows, or vulnerabilities in agent skills.

Agent Scan operates in two main modes which can be used jointly or separately:

1. Scan Mode: The CLI command snyk-agent-scan scans the current machine for agents and agent components such as skills and MCP servers. Upon completion, it will output a comprehensive report for the user to review.

2. Background Mode (MDM, Crowdstrike). Agent Scan scans the machine in regular intervals in the background, and reports the results to a Snyk Evo instance. This can be used by security teams to monitor the company-wide agent supply chain in a central location. To set this up, please contact us.

How It Works

Scanning

Agent Scan searches through your local agent's configuration files to find agents, skills, and MCP servers. For MCP, it connects to servers and retrieves tool descriptions.

Interactive Consent for MCP Servers

⚠️ Security Note: Scanning an MCP config executes the commands defined in it. Always review what will be executed before approving.

By default, Agent Scan prompts for user consent before starting each stdio MCP server during interactive runs. This consent flow:

• Shows the server name, command, and environment variables (redacted) that will be executed
• Allows you to approve or decline each server individually
• Prevents potentially untrusted servers from running without your explicit permission
• Records declined servers with a user_declined error (they are never started)

Best Practices:

• Review the command and arguments carefully before approving
• When scanning untrusted or third-party MCP configs, run Agent Scan inside a sandbox (Docker, VM, or disposable environment)
• Decline any servers with unfamiliar or suspicious commands

For non-interactive environments (e.g., CI/CD pipelines), you must use the --dangerously-run-mcp-servers flag to bypass the consent prompt and start all servers automatically. Only use this flag in trusted environments where all MCP server commands have been verified.

Analysis and Validation

Agent Scan validates the components, both with local checks and by invoking the Agent Scan API. For this, skills, agent applications, tool names, and descriptions are shared with Snyk. By using Agent Scan, you agree to the Snyk terms of use for Agent Scan.

Agent Scan does not store or log any usage data, i.e. the contents and results of your MCP tool calls.

Control Server Bootstrap

When --control-server is configured, Agent Scan sends a startup bootstrap request to the first configured control server before doing any other work. This applies to every command that accepts --control-server — scan, inspect, and evo — including the read-only inspect command that performs no other network egress on its own. The guard command does not bootstrap. If more than one --control-server is configured, only the first one receives the bootstrap; the rest receive the eventual scan-result push only.

The request contains an allowlisted host/process fingerprint: Agent Scan version and command, redacted CLI arguments, OS and Python details, hostname, current username, CI/WSL/container flags, shell, terminal, locale, timezone, current working directory, current home directory, executable path, and readable home directories capped at 1000 entries. It does not include schema_version or scanned usernames.

Home-directory enumeration mirrors the scan itself: by default the payload only reports the current user's home directory. Passing --scan-all-users opts in to enumerating every readable human home directory on the machine (and, on Windows, WSL profile directories) — exactly the set the scan would touch — for inclusion in the bootstrap payload.

Bootstrap failures never abort the command. Timeouts, network errors, HTTP errors, and malformed responses fall back to defaults. The HTTP call uses a 3-second per-attempt timeout and retries up to three times on transient failures (5xx, 408, 429), with a linear backoff of 0s, 1s, and 2s between attempts — so on a flaky network a command can wait up to ~12 seconds at startup (3s + 1s + 3s + 2s + 3s) before falling through to the no-bootstrap path. Definitive 4xx responses and malformed payloads do not retry. Home-directory enumeration may take noticeably longer on Windows with --scan-all-users because it can query Windows profiles and WSL homes; the HTTP timeout only applies after the payload has been assembled. Use --no-bootstrap to disable this startup request on any command.

Snyk-managed control server required. Bootstrap is only sent when the configured --control-server URL ends in /mcp-scan/push — the canonical Snyk-managed endpoint. Self-hosted or custom control-server deployments whose URLs do not match this shape will skip the bootstrap call (a warning is logged) and uploads will not include the X-Bootstrap-Event-Id correlation header. Self-hosted deployments should pass --no-bootstrap to suppress the warning and make the opt-out explicit.

CLI Parameters

Agent Scan provides the following commands:

snyk-agent-scan - Security scanner for agents, MCP servers, and skills

Common Options

These options are available for all commands:

--storage-file FILE    Path to store scan results and scanner state (default: ~/.mcp-scan)
--base-url URL         Base URL for the verification server
--verbose              Enable detailed logging output
--print-errors         Show error details and tracebacks
--json                 Output results in JSON format instead of rich text
--no-bootstrap         Disable the startup bootstrap call to the control server

Commands

scan (default)

Scan MCP configurations for security vulnerabilities in tools, prompts, and resources.

snyk-agent-scan scan [CONFIG_FILE...]

Options:

--checks-per-server NUM           Number of checks to perform on each server (default: 1)
--server-timeout SECONDS          Seconds to wait before timing out server connections (default: 10)
--suppress-mcpserver-io BOOL      Suppress stderr from stdio MCP servers (stdout carries the JSON-RPC protocol
                                  and is never shown). Default: False for interactive runs (stderr is streamed
                                  with a [server-name] prefix), True otherwise.
--dangerously-run-mcp-servers     ⚠️ DANGER: Skip the interactive consent prompt and automatically start every
                                  stdio MCP server listed in the scanned configs. Only use in trusted
                                  environments where you've verified all MCP server commands.
--no-skills                       Skip analysis on skills.

inspect

Print descriptions of tools, prompts, and resources without verification.

When invoked with --control-server, inspect also sends a one-shot startup bootstrap to that server before reading any config files — see Control Server Bootstrap. Use --no-bootstrap to skip it.

snyk-agent-scan inspect [CONFIG_FILE...]

Options:

--server-timeout SECONDS          Seconds to wait before timing out server connections (default: 10)
--suppress-mcpserver-io BOOL      Suppress stderr from stdio MCP servers (stdout carries the JSON-RPC protocol
                                  and is never shown). Default: False for interactive runs (stderr is streamed
                                  with a [server-name] prefix), True otherwise.
--dangerously-run-mcp-servers     ⚠️ DANGER: Skip the interactive consent prompt and automatically start every
                                  stdio MCP server listed in the scanned configs. Only use in trusted
                                  environments where you've verified all MCP server commands.

help

Display detailed help information and examples.

snyk-agent-scan help

Examples

# Scan all known MCP configs and agent skills
snyk-agent-scan

# Scan a specific config file
snyk-agent-scan ~/custom/config.json

# Scan a specific skill file
snyk-agent-scan ~/path/to/my/SKILL.md

# Scan a directory for skills
snyk-agent-scan ~/.claude/skills

# Just inspect tools without verification
snyk-agent-scan inspect

# Skip consent prompts and run all servers (ONLY for CI/CD or fully trusted environments)
snyk-agent-scan --dangerously-run-mcp-servers

# Suppress MCP server stderr output during scanning
snyk-agent-scan --suppress-mcpserver-io=true

# CI mode (requires --dangerously-run-mcp-servers in non-interactive environments)
snyk-agent-scan --ci --dangerously-run-mcp-servers

Demo

This repository includes a vulnerable MCP server that can demonstrate Model Context Protocol security issues that Agent Scan finds.

How to demo MCP security issues?

1. Clone this repository
2. Create an mcp.json config file in the cloned git repository root directory with the following contents:

{
  "mcpServers": {
    "Demo MCP Server": {
      "type": "stdio",
      "command": "uv",
      "args": ["run", "mcp", "run", "demoserver/server.py"],
    },
  },
}

3. Run Agent Scan: uvx --python 3.13 snyk-agent-scan@latest scan --full-toxic-flows mcp.json

Note: if you place the mcp.json configuration filepath elsewhere then adjust the args path inside the MCP server configuration to reflect the path to the MCP Server (demoserver/server.py) as well as the uvx command that runs Agent Scan with the correct filepath to mcp.json.

Agent Scan is closed to contributions

Agent Scan does not accept external contributions at this time.

We welcome suggestions, bug reports, or feature requests as GitHub issues.

Development Setup

To run Agent Scan from source, follow these steps:

uv run pip install -e .
uv run -m src.agent_scan.cli

Including Agent Scan results in your own project / registry

If you want to include Agent Scan results in your own project or registry, please reach out. There are designated APIs for this purpose. Using the standard Agent Scan API for large scale scanning is considered abuse and will result in your account being blocked.

Documentation

• Scanning — How scanning works, CLI parameters, and usage examples.
• Issue Codes — Reference for all security issues detected by Agent Scan.

Further Reading

• Introducing MCP-Scan
• MCP Security Notification Tool Poisoning Attacks
• WhatsApp MCP Exploited
• MCP Prompt Injection
• Toxic Flow Analysis
• Skills Report

Changelog

See CHANGELOG.md.