Snyk Agent Scan

Finds the MCP servers and skills installed across your coding agents and checks them for prompt injection, tool poisoning, toxic flows and malicious code.

Install

Snyk token
```
export SNYK_TOKEN=<your-api-token>
```
Needs a Snyk account. The token is at app.snyk.io/account.

Scan your Claude skills (pinned)

uvx snyk-agent-scan@0.6.4 ~/.claude/skills

Scan the whole machine
```
uvx snyk-agent-scan@0.6.4
```
Discovers configs for Claude Code/Desktop, Cursor, VS Code, Gemini CLI, Codex, Windsurf and more.

Formerly Invariant Labs’ mcp-scan, now maintained by Snyk. It looks for what’s actually installed across your agents, not just a folder you name, and flags risks such as prompt injection in tool descriptions, tool shadowing, toxic flows between tools, and malicious code in skills.

When to use it

You want an inventory of every MCP server and skill on a machine, across agents.
You want a second opinion next to SkillSpector, especially for MCP tool-description attacks.

Before you install

Your skill text and MCP tool descriptions go to Snyk for analysis, and scanning a stdio server means running it. Scan untrusted configs inside a container or VM, and read the consent prompt before you answer yes. The README says the CLI output format can change between releases. Don’t build automation on specific field names.

Official

Published by the platform or the maker of the thing itself.

Access: Runs on your machine Works on local files and folders; no access to your online accounts.
Review: Reviewed — install with care
Scan: 100/100 SkillSpector 2.12.0 said do not install at af0d2c9
Checked: Sep 25, 2026

Formerly Invariant Labs' mcp-scan; the old repo now redirects to snyk/agent-scan. Most of the 121 HIGH findings across the whole repo at v0.6.4 are test skills with planted injections, or the scanner reading agent config dirs, which is its job. Read the README security section and verify_api.py. Analysis runs on Snyk's servers, not locally. The scanner sends discovered tool descriptions and skill content to api.snyk.io, gzipped. redact.py strips env values, headers, secret-looking arguments and URL query strings first. To get tool lists, it starts stdio MCP servers from your configs. Interactive runs ask y/n per server first; background runs don't start stdio servers without --dangerously-run-mcp-servers. The `guard` subcommand installs agent hooks that report to Snyk; it's opt-in. The scan now matches the pinned release. src/agent_scan at the v0.6.4 tag (af0d2c9) scores 100 with 0 CRITICAL and 27 HIGH, all agent-config paths it is built to read, a Keychain mention in a comment, and guard.py passing your environment to the hook installer. The refusal of link-local and cloud-metadata addresses for remote MCP servers was added on main after 0.6.4, so the pinned release doesn't have it.

Publisher: Snyk
Source: github.com/snyk/agent-scan
Works with: Any agent, Claude Code, Claude apps, Cursor, Codex, Gemini
Categories: Security & trust, MCP & integrations
License: Apache-2.0
Cost: Free tier, paid plans

Curated by Andrew Borden-Chisholm. Notes on building with these tools are on the blog.