Snyk Agent Scan

Snyk Agent Scan is an open-source command-line tool published by Snyk (originally developed by Invariant Labs AG) under the Apache License 2.0. It auto-discovers AI agent components installed on a machine—MCP servers, agent harnesses, and agent skills—and scans them for security threats including prompt injections, tool poisoning, toxic flows, malware payloads, and hardcoded secrets. The project reached v0.5.16 as of August 2026 and has accumulated over 2,800 GitHub stars.

What It Is

Snyk Agent Scan is a security scanner purpose-built for the emerging AI agent supply chain. As developers increasingly install MCP servers and agent skills from third-party sources, those components can carry hidden threats embedded in natural language—tool descriptions, prompts, and skill files that instruct an AI to behave maliciously. Agent Scan addresses this gap by connecting to MCP servers, retrieving their tool descriptions, and running both local checks and cloud-backed analysis via the Snyk Agent Scan API to surface 15+ distinct security risk categories.

Detection Coverage

Agent Scan detects a broad set of agent-specific threats across two main component types:

• MCP servers: Prompt Injection, Tool Poisoning, Tool Shadowing, Toxic Flows
• Agent skills: Prompt Injection, Malware Payloads, Untrusted Content, Credential Handling, Hardcoded Secrets

Auto-discovery covers a wide range of popular AI coding environments across macOS, Linux, and Windows, including Windsurf, Cursor, VS Code, Claude Desktop, Claude Code, Gemini CLI, Amp, Amazon Q, Kiro, OpenCode, Antigravity, and Codex. Detection spans system-wide, user, project/workspace, and extension/plugin configuration scopes.

How Scanning Works

Agent Scan operates in two modes:

1. Scan Mode — The default CLI command scans the local machine, auto-discovers agent configurations, connects to MCP servers (executing their startup commands to retrieve tool descriptions), and produces a comprehensive security report.
2. Background Mode (MDM) — Runs on a schedule and reports results to a Snyk Evo enterprise instance, enabling security teams to monitor the company-wide agent supply chain centrally.

A key security consideration: scanning MCP configurations requires executing the commands defined in them. By default, Agent Scan prompts for explicit user consent before starting each stdio MCP server, showing the exact command and arguments. For CI/CD pipelines, the --dangerously-run-mcp-servers flag bypasses this prompt and should only be used in fully trusted environments.

Deployment and Setup

Agent Scan can be run two ways:

• Python package via uvx: uvx snyk-agent-scan@latest — requires uv and a Snyk API token set as SNYK_TOKEN
• Standalone binary: Pre-built binaries for each platform are available on GitHub Releases, with GPG-signed checksums and SBOMs for supply chain verification

The tool supports scanning specific MCP config files, individual skill files, or entire skill directories in addition to full machine auto-discovery. JSON output mode and CI flags make it suitable for integration into automated pipelines.

Update: Agent Scan v0.5.16

The latest release is v0.5.16, published August 3, 2026. Version 0.4 introduced agent skills scanning alongside a published technical report on emerging threats in the agent skill ecosystem. The CLI output is explicitly marked experimental and subject to change between releases, while the underlying enterprise integration with Snyk Evo is described as stable. The project does not accept external code contributions but welcomes bug reports and feature requests via GitHub Issues.