# Snyk Agent Scan

> An open-source CLI security scanner that discovers and scans AI agent components—including MCP servers, agent harnesses, and skills—for prompt injections, tool poisoning, and other vulnerabilities.

Snyk Agent Scan is an open-source command-line tool published by Snyk (originally developed by Invariant Labs AG) under the Apache License 2.0. It auto-discovers AI agent components installed on a machine—MCP servers, agent harnesses, and agent skills—and scans them for security threats including prompt injections, tool poisoning, toxic flows, malware payloads, and hardcoded secrets. The project reached v0.5.16 as of August 2026 and has accumulated over 2,800 GitHub stars.

## What It Is

Snyk Agent Scan is a security scanner purpose-built for the emerging AI agent supply chain. As developers increasingly install MCP servers and agent skills from third-party sources, those components can carry hidden threats embedded in natural language—tool descriptions, prompts, and skill files that instruct an AI to behave maliciously. Agent Scan addresses this gap by connecting to MCP servers, retrieving their tool descriptions, and running both local checks and cloud-backed analysis via the Snyk Agent Scan API to surface 15+ distinct security risk categories.

## Detection Coverage

Agent Scan detects a broad set of agent-specific threats across two main component types:

- **MCP servers**: Prompt Injection, Tool Poisoning, Tool Shadowing, Toxic Flows
- **Agent skills**: Prompt Injection, Malware Payloads, Untrusted Content, Credential Handling, Hardcoded Secrets

Auto-discovery covers a wide range of popular AI coding environments across macOS, Linux, and Windows, including Windsurf, Cursor, VS Code, Claude Desktop, Claude Code, Gemini CLI, Amp, Amazon Q, Kiro, OpenCode, Antigravity, and Codex. Detection spans system-wide, user, project/workspace, and extension/plugin configuration scopes.

## How Scanning Works

Agent Scan operates in two modes:

1. **Scan Mode** — The default CLI command scans the local machine, auto-discovers agent configurations, connects to MCP servers (executing their startup commands to retrieve tool descriptions), and produces a comprehensive security report.
2. **Background Mode (MDM)** — Runs on a schedule and reports results to a Snyk Evo enterprise instance, enabling security teams to monitor the company-wide agent supply chain centrally.

A key security consideration: scanning MCP configurations requires executing the commands defined in them. By default, Agent Scan prompts for explicit user consent before starting each stdio MCP server, showing the exact command and arguments. For CI/CD pipelines, the `--dangerously-run-mcp-servers` flag bypasses this prompt and should only be used in fully trusted environments.

## Deployment and Setup

Agent Scan can be run two ways:
- **Python package via `uvx`**: `uvx snyk-agent-scan@latest` — requires uv and a Snyk API token set as `SNYK_TOKEN`
- **Standalone binary**: Pre-built binaries for each platform are available on GitHub Releases, with GPG-signed checksums and SBOMs for supply chain verification

The tool supports scanning specific MCP config files, individual skill files, or entire skill directories in addition to full machine auto-discovery. JSON output mode and CI flags make it suitable for integration into automated pipelines.

## Update: Agent Scan v0.5.16

The latest release is v0.5.16, published August 3, 2026. Version 0.4 introduced agent skills scanning alongside a published technical report on emerging threats in the agent skill ecosystem. The CLI output is explicitly marked experimental and subject to change between releases, while the underlying enterprise integration with Snyk Evo is described as stable. The project does not accept external code contributions but welcomes bug reports and feature requests via GitHub Issues.

## Features
- Auto-discover MCP configurations, agent tools, and skills
- Scan for 15+ distinct security risks across MCP servers and agent skills
- Detect prompt injection, tool poisoning, tool shadowing, and toxic flows
- Detect malware payloads, hardcoded secrets, and credential handling issues in skills
- Interactive consent prompt before executing MCP server commands
- Background MDM mode for enterprise-wide agent supply chain monitoring
- JSON output for programmatic parsing and CI/CD integration
- Standalone binary distribution with GPG-signed checksums and SBOM
- Supports Claude, Cursor, Windsurf, VS Code, Gemini CLI, Amazon Q, and more
- Inspect mode to view tool descriptions without running security checks
- Scan specific MCP config files, skill files, or skill directories

## Integrations
Claude Desktop, Claude Code, Cursor, Windsurf, VS Code, Gemini CLI, Amazon Q, Amp, Kiro, OpenCode, Antigravity, Codex, OpenClaw, Snyk Evo, PyPI (snyk-agent-scan), uv / uvx

## Platforms
WINDOWS, MACOS, LINUX, API, VSC_EXTENSION, CLI

## Pricing
Open Source

## Version
v0.5.16

## Links
- Website: https://github.com/snyk/agent-scan
- Documentation: https://github.com/snyk/agent-scan/blob/main/docs/cli-reference.md
- Repository: https://github.com/snyk/agent-scan
- EveryDev.ai: https://www.everydev.ai/tools/snyk-agent-scan