Agent Scan by Snyk is a security scanner designed for AI agents, MCP servers, and agent skills on the mcp platform. Developed by Snyk and available under a free license, it helps developers and security teams identify vulnerabilities within their AI-driven systems. The tool operates by connecting to local agent configurations and Snyk's cloud API for validation and reporting. It supports both on-demand CLI scans and continuous background monitoring, making it a versatile addition to any security workflow.

What does Agent Scan connect to?

Agent Scan connects to local agent configurations, including Claude Code/Desktop, Cursor, Gemini CLI, Windsurf, and VS Code. It also establishes connections with stdio-based MCP servers to retrieve tool descriptions. For validation and reporting, Agent Scan interfaces with Snyk's cloud API. In its continuous background mode, the scanner reports results directly to a Snyk Evo instance, enabling centralized monitoring of security findings across an organization's agent supply chain.

Core features and tools

The primary callable tool is snyk-agent-scan, which operates in two distinct modes. "Scan Mode" functions as a CLI command, "snyk-agent-scan", for immediate scanning of the current machine. "Background Mode (MDM)" performs scans at regular intervals for continuous monitoring. It supports flags like "--no-skills" to skip skill analysis. Users can also target specific skill files or directories for scanning, such as "uvx snyk-agent-scan@latest ~/path/to/my/SKILL.md".

Who is it for?

Agent Scan is intended for developers and security teams. It assists in auditing the MCP surface area on developer machines or in CI, monitoring agent supply chains, and scanning individual agent skills for vulnerabilities. The tool helps identify prompt injection, malicious code, and hardcoded secrets. This is not the right fit if your environment does not involve AI agents, MCP servers, or agent skills.

How to get started

The server authenticates using an API key passed as an environment variable. Users must obtain a Snyk API token and set it as the SNYK_TOKEN environment variable.

Use cases

• Auditing the MCP surface area on developer machines or in CI by scanning for agents, MCP servers, and skills, then generating a report.
• Monitoring the company-wide agent supply chain through regular background scans that report to a Snyk Evo instance.
• Scanning individual agent skills for vulnerabilities, including prompt injection, malicious code, and hardcoded secrets.

Agent Scan provides essential security scanning for AI agents and MCP servers, supporting both immediate audits and continuous monitoring. Its ability to connect with various AI clients and report to Snyk Evo makes it a valuable asset for security-conscious organizations. The tool addresses critical vulnerabilities such as prompt injection and hardcoded secrets in agent skills.