Snyk Agent Scan Discover and scan agent components on your machine for prompt injections and vulnerabilities (including agents, MCP servers, skills). > Note: We don't publish an npm package for Agent Scan. Install it via or as a . > Note: CLI output is experimental and subject to change > > Agent Scan v0.5.x (planned for deprecation) > > The raw output of this CLI — including issue codes, field na
Tools
Tools
No tool list yet. Remote servers get one after the first health check.
Copy the stdio config for Cursor, Claude Desktop, Claude Code, or VS Code on this page. It uses the publisher's install, not a PlugMCP proxy.
Does Agent Scan need an API key?
No required environment variable is listed on this record.
What transport does Agent Scan use?
Agent Scan runs locally over stdio.
When was Agent Scan last checked?
Last checked 2026-11-08. Snyk Agent Scan Discover and scan agent components on your machine for prompt injections and vulnerabilities (including agents, MCP servers, skills). > Note: We don't publish an npm package for Agent Scan. Install it via or as a . > Note: CLI output is experimental and subject to change > > Agent Scan v0.5.x (planned for deprecation) > > The raw output of this CLI — including issue codes, field na
From the publisher
Documentation
Note: We don't publish an npm package for Agent Scan. Install it via uvx or as a standalone binary.
Note: CLI output is experimental and subject to change
Agent Scan v0.5.x (planned for deprecation)
The raw output of this CLI — including issue codes, field names, severity labels, and response structure — is experimental and may change without notice between releases. We do not recommend building production workflows that depend on specific CLI output fields or issue codes.
Agent Scan v0.6 and later
The raw output of this CLI — including risk indicator names, scores, field names, and response structure — is experimental and may change without notice between releases. We do not recommend building production workflows that depend on specific CLI output fields or risk names.
If you are an enterprise customer using Snyk to manage agent security risk at scale, the CLI output may not reflect what is sent to and shown in the Evo platform. The underlying integration, discovery, and risk assessment that powers enterprise deployments is stable and supported — any changes will be communicated in line with standard Snyk product practices. Contact your account team for deployment guidance.
NEW Read our published together with Agent Scan 0.4, which adds support for scanning agent skills.
[!WARNING]
Agent Scan v0.5.x uses issue-code output. This CLI line is planned for deprecation.
Agent Scan v0.6 and later output
Agent Scan helps you discover all your installed agent components (harnesses, MCP servers, and skills) and scans them for common threats like prompt injections, sensitive data handling, or malware payloads hidden in natural language. Ignore analysis on skills by using --no-skills.
Security Warning
⚠️ IMPORTANT: Scanning MCP configurations can execute commands or make outbound network requests.
To retrieve tool descriptions, Agent Scan starts stdio MCP servers by executing the commands in the config and connects to configured remote MCP server URLs with their configured headers.
Recommendations:
Run scans inside a sandbox (Docker container, VM, or disposable environment) when evaluating untrusted or third-party MCP configs
Review the consent prompt carefully during interactive scans; it shows the command or remote URL for each server
Use --dangerously-run-mcp-servers only in trusted environments where you've verified all MCP server commands and remote URLs
Remote MCP requests refuse destinations resolving to link-local addresses or known cloud-metadata endpoints (169.254.0.0/16, fe80::/10, fd00:ec2::254, and 100.100.100.200). Loopback and private addresses remain allowed for local and internal MCP servers. HTTP redirects are not followed. DNS is validated before each request, but resolution again at connection time leaves a DNS-rebinding window.
By default, Agent Scan requires explicit user consent (y/n) before contacting each discovered MCP server during foreground interactive runs. Background and push-key scans continue to inspect remote servers automatically for fleet coverage, but do not start stdio servers unless --dangerously-run-mcp-servers is set.
Quick Start
Choose one of two ways to run Agent Scan:
Run the Python package with uvx using the instructions below.
Download a standalone binary for your platform from GitHub Releases. Releases also include the SBOM, checksums, signed checksums, and source code archives.
[!WARNING]
v0.5.x uses issue-code output and the 2025-09-02 analysis API. This CLI line is planned for deprecation.
Agent Scan v0.6 and later
# Scan the whole machine
uvx snyk-agent-scan@latest
# Scan a specific MCP configuration
uvx snyk-agent-scan@latest ~/.vscode/mcp.json
# Scan a single agent skill
uvx snyk-agent-scan@latest ~/path/to/my/SKILL.md
# Scan all Claude skills
uvx snyk-agent-scan@latest ~/.claude/skills
v0.6 and later use the risk-based output and the 2026-07-10 analysis API.
Both versions scan MCP servers, tools, prompts, resources, and skills, and automatically discover supported agent configurations such as Claude Code/Desktop, Cursor, Gemini CLI, and Windsurf.
Run with a standalone binary
Download the binary for your operating system and architecture from the latest GitHub Release. The release page also provides an SBOM (sbom-<version>.json), checksum files, and GitHub-generated source code archives. See Verifying Standalone Binaries to verify your download.
Agent Scan auto-discovers agents and their capabilities (MCP servers or skills) when their install paths exist. The table below shows on which operating systems each agent is scanned.
✓: at least one path is defined for that capability.
✗: the agent is listed for that OS but has no paths for that capability.
—: that agent is not included for that OS.
Skills Skills can be ignored by using --no-skills
Agent
macOS MCP
macOS Skills
Linux MCP
Linux Skills
Windows MCP
Windows Skills
Windsurf
✓
✓
✓
✓
✓
✓
Cursor
✓
✓
✓
✓
✓
✓
VS Code
✓
✓
✓
✓
✓
✓
GitHub Copilot
✓
✓
✓
✓
✓
✓
Claude Desktop
✓
✓
✓
✓
✓
✗
Claude Code
✓
✓
✓
✓
✓
✓
Gemini CLI
✓
✓
✓
✓
✓
✓
OpenClaw
✗
✓
✗
✓
✗
✓
Amp
✗
✓
✗
✓
✗
✓
Kiro
✓
✓
✓
✓
✓
✓
OpenCode
✓
✓
✓
✓
✓
✓
Antigravity
✓
✓
✓
✓
✓
✓
Codex
✓
✓
✓
✓
—
—
Amazon Q
✓
✗
✓
✗
✓ (WSL)
✗
Detection coverage by scope
The matrix above shows on which operating systems each agent is scanned. This one breaks detection down by configuration scope and component type (skills vs MCP servers), combined across operating systems. "Servers" means MCP servers.
The four scopes:
System — machine-wide / admin-managed / enterprise config that applies to all users (e.g. managed-mcp.json, files under /etc, /Library/Application Support, or ProgramData).
User — the user's home-directory config (applies across all their projects).
Project / workspace — config scoped to an opened project or workspace.
Legend: ✓ detected · ✗ the agent supports this but Agent Scan does not scan it yet · N/A the agent has no such component at this scope.
Agent
Systemskills
Systemservers
Userskills
Userservers
Project / WSskills
Project / WSservers
Ext / pluginskills
Ext / pluginservers
Windsurf
✓
N/A
✓
✓
✓
✓
✓
✓
Cursor
N/A
N/A
✓
✓
✓
✓
✓
✓
VS Code
N/A
N/A
✓
✓
✓
✓
✓
✓
GitHub Copilot §
N/A
N/A
✓
✓
✓
✓
✓
✓
Claude Desktop
N/A
N/A
✗
✓
N/A
N/A
✓
✓
Claude Code
✗
✓
✓
✓
✓
✓
✓
✓
Gemini CLI
N/A
✗
✓
✓
✗
✗
✗
✗
OpenClaw
N/A
N/A
✓
✗
✓ †
N/A
✗
✗
Amp
N/A
✗
✓
✗
✗ ‡
✗
✗
✗
Kiro
N/A
N/A
✓
✓
✓
✓
✓
✓
OpenCode
✓
✓
✓
✓
✓
✓
N/A
N/A
Antigravity
N/A
N/A
✓
✓
✓
✓
✓
✓
Codex
✓
✓
✓
✓
✓
✓
✓
✓
Amazon Q
N/A
N/A
N/A
✓
N/A
✗
N/A
N/A
† OpenClaw has no opened-project enumeration: its project/workspace skills are found only at the fixed ~/.openclaw/workspace/skills
‡ Amp stores project/workspace skills at .agents/skills (and the .claude/skills compatibility path); only the user-scope ~/.config/agents/skills is detected today, so project-scope skills are supported but not yet scanned.
§ GitHub Copilot covers the CLI and the desktop app, which share the ~/.copilot home with Copilot in VS Code, and is detected from that home rather than from a VS Code install. COPILOT_HOME relocations are honored when scanning your own home. Project scope covers the repo-relative .mcp.json / .github/mcp.json files and the .github/skills, .claude/skills and .agents/skills directories, for the folders passed to the scan and the existing local directories Copilot has recorded in permissions-config.json (locations), config.json (trusted_folders / trustedFolders path lists), or session-state/*/workspace.yaml (cwd and a containing git_root), plus their ancestors. JSONC config files are supported; session discovery reads only size-bounded workspace metadata, skipping malformed or unreadable files. Plugin scope covers ~/.copilot/installed-plugins, including plugin.json manifests that relocate their MCP config or declare extra skills roots. Copilot's user-level paths are also listed under VS Code, which reads the same files.
Claude Desktop plugin discovery is supported on macOS and Linux. For Claude Code, Guard's install and session-start discovery events also report logged connectors from claude-code-sessions/*/*/local_*.json and local-agent-mode-sessions/*/*/local_*.json, grouped by organization and deduplicated by connector UUID using the newest session metadata. Only each connector's UUID, name, URL, tool definitions and instructions are sent; other fields such as headers are dropped, and URL query values are redacted. On Windows, connector discovery uses ~/AppData/Roaming/Claude with the same assumed session layout, which has not yet been verified on a Windows machine. Windows plugin discovery remains unsupported.
Verifying Standalone Binaries
We use GPG signing on the release checksums file to ensure distribution integrity and authenticity.
Step-by-Step Verification Guide
Download the release assets:
Download the binary for your platform (e.g., agent-scan-<version>-<os>-<arch>) and the signed checksums file (sha256sums.txt.asc) from the GitHub Releases page into the same directory.
Verify GPG signature of the checksums file:
Download the GPG public key into the same directory, then run:
grep agent-scan-<version>-<os>-<arch> sha256sums.txt.asc | shasum -a 256 -c -
This will output agent-scan-<version>-<os>-<arch>: OK.
Scanner Capabilities
Agent Scan v0.5.x
Agent Scan is a security scanning tool to both scan and inspect the supply chain of agent components on your machine. It scans for common security vulnerabilities like prompt injections, tool poisoning, toxic flows, or vulnerabilities in agent skills.
Agent Scan v0.6 and later
Agent Scan reports scored risk indicators for threats such as prompt injection, exposure to untrusted or private data, destructive capabilities, and malicious agent skills.
Agent Scan operates in two main modes which can be used jointly or separately:
Scan Mode: The CLI command snyk-agent-scan scans the current machine for agents and agent components such as skills and MCP servers. Upon completion, it will output a comprehensive report for the user to review.
Background Mode (MDM). Agent Scan scans the machine in regular intervals in the background, and reports the results to a Snyk Evo instance. This can be used by security teams to monitor the company-wide agent supply chain in a central location. To set this up, please contact us.
How It Works
Scanning
Agent Scan searches through your local agent's configuration files to find agents, skills, and MCP servers. For MCP, it connects to servers and retrieves tool descriptions.
Interactive Consent for MCP Servers
⚠️ Security Note: Scanning an MCP config can execute its stdio commands or make outbound requests to its remote URLs. Always review what will be contacted before approving.
By default, Agent Scan prompts for user consent before contacting each discovered MCP server during interactive runs. This consent flow:
Shows the server name and its command or remote URL; environment variables and headers are redacted
Allows you to approve or decline each server individually
Prevents potentially untrusted servers from being contacted without your explicit permission
Records declined servers with a user_declined error (they are never contacted)
Best Practices:
Review commands, arguments, and remote URLs carefully before approving
When scanning untrusted or third-party MCP configs, run Agent Scan inside a sandbox (Docker, VM, or disposable environment)
Decline any servers with unfamiliar or suspicious commands
Non-interactive environments (e.g., background and push-key scans) inspect remote MCP servers automatically. They do not start stdio servers unless --dangerously-run-mcp-servers is set. Only use this flag in trusted environments where all MCP server commands and remote URLs have been verified.
Analysis and Validation
Agent Scan validates discovered components with local checks and the Agent Scan API. It sends the component information needed for analysis, including agent application details, MCP server configurations and signatures, tool names and descriptions, and skill content. Secrets in configuration values and text are redacted before transmission.
Agent Scan does not store or log any usage data, i.e. the contents and results of your MCP tool calls.
CLI Parameters
The complete flag reference is in docs/cli-reference.md. Most commands and flags are shared across v0.5.x and v0.6 and later.
Shared commands
snyk-agent-scan scan [CONFIG_FILE...] Scan MCP servers and skills (default)
snyk-agent-scan inspect [CONFIG_FILE...] Inspect components without analysis
snyk-agent-scan help Display help
Options shared by both version lines
These options exist in both v0.5.x and v0.6 and later. Their command applicability is detailed in the full CLI reference.
--storage-file FILE Path to store scan state (default: ~/.mcp-scan)
--analysis-url URL Analysis endpoint; the default API version depends on the CLI version
--verification-H HEADER Additional analysis request header (repeatable)
--mcp-oauth-tokens-path PATH OAuth tokens for protected remote MCP servers
--verbose Enable detailed logging
--print-errors Show error details and tracebacks
--print-full-descriptions Show full entity descriptions without truncation
--json Emit JSON; the response schema depends on the CLI version
--skip-ssl-verify Disable TLS certificate verification
--skills / --no-skills Include skills (default) or skip them
--scan-all-users Scan all readable user home directories
--show-analysis-results Force synchronous analysis so results display for push-key scans
--ci Exit non-zero when findings or operational failures remain
--server-timeout SECONDS MCP connection timeout (default: 10)
--suppress-mcpserver-io BOOL Suppress stdio MCP server stderr
--dangerously-run-mcp-servers Skip consent and contact all configured MCP servers
--control-server URL Upload destination (repeatable)
--control-server-H HEADER Header for the current control-server block
--control-identifier ID Identifier for the current control-server block
--no-bootstrap Accepted compatibility no-op; does not change behavior
--checks-per-server NUM Accepted compatibility no-op; does not change behavior
Agent Scan v0.5.x
[!WARNING]
v0.5.x is planned for deprecation. The examples pin v0.5.17 as a concrete v0.5.x release.
--analysis-url URL Defaults to the 2025-09-02 analysis API
--ignore-issues-codes CODES Comma-separated E/W security finding codes and X failure codes to ignore in CI
--analysis-url URL Defaults to the 2026-07-10 analysis API
--ignore-risks NAMES Comma-separated risk names to omit from output and CI evaluation
--ignore-failure-codes CODES Comma-separated X codes to omit from CI evaluation
--show-full-discovery List every MCP entity and skill file instead of compact scan summaries
v0.6 and later emit scored risk indicators and scan_path_responses JSON. Human-readable scan output is compact by default; --show-full-discovery expands it without changing JSON or inspect output. See the v0.6-and-later CLI reference, risk reference, and failure-code reference.
Examples
# Scan all known MCP configs and agent skills
snyk-agent-scan
# Scan a specific config file or skill
snyk-agent-scan ~/custom/config.json
snyk-agent-scan ~/path/to/my/SKILL.md
# Inspect without security analysis
snyk-agent-scan inspect
# CI mode
snyk-agent-scan --ci --dangerously-run-mcp-servers
Demo
This repository includes a vulnerable MCP server that demonstrates Model Context Protocol security findings that Agent Scan reports.
How to demo MCP security findings?
Clone this repository
Create an mcp.json config file in the cloned git repository root directory with the following contents:
Agent Scan v0.6 and later (risk-based output): uvx --python 3.13 snyk-agent-scan@latest scan mcp.json
Note: if you place the mcp.json configuration filepath elsewhere then adjust the args path inside the MCP server configuration to reflect the path to the MCP Server (demoserver/server.py) as well as the uvx command that runs Agent Scan with the correct filepath to mcp.json.
Agent Scan is closed to contributions
Agent Scan does not accept external contributions at this time.
We welcome suggestions, bug reports, or feature requests as GitHub issues.
Development Setup
To run Agent Scan from source, follow these steps:
uv run pip install -e .
uv run -m src.agent_scan.cli
Including Agent Scan results in your own project / registry
If you want to include Agent Scan results in your own project or registry, please reach out. There are designated APIs for this purpose. Using the standard Agent Scan API for large scale scanning is considered abuse and will result in your account being blocked.
