Snyk MCP Server

Apache-2.0

snyksecurityscasbomvulnerabilitiesdevsecops

Summary

Snyk's official MCP server, shipped inside the Snyk CLI: scan code, dependencies, containers and IaC for vulnerabilities, generate SBOMs and monitor projects from your agent.

Features

Vulnerability scanning for code, open-source dependencies, containers and IaC
SBOM generation from an agent request
Project monitoring so new advisories surface against a scanned project
Ships inside the Snyk CLI, so agent results match what CI reports
One-command setup for Claude Code via snyk mcp configure

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

Open your agent's MCP configuration file.
Merge the snippet below into it, filling in the environment variables with your own values.
Restart the agent — the "Snyk MCP Server" tools will be available.

{
  "mcpServers": {
    "snyk-mcp": {
      "command": "snyk",
      "args": [
        "mcp",
        "-t",
        "stdio"
      ],
      "env": {
        "SNYK_CFG_ORG": "your-org-id"
      }
    }
  }
}

Claude Code

Add the server with a single CLI command.

claude mcp add snyk-mcp -e SNYK_CFG_ORG=your-org-id -- snyk mcp -t stdio

Claude Desktop

Add the server to claude_desktop_config.json (Settings → Developer → Edit Config).

{
  "mcpServers": {
    "snyk-mcp": {
      "command": "snyk",
      "args": [
        "mcp",
        "-t",
        "stdio"
      ],
      "env": {
        "SNYK_CFG_ORG": "your-org-id"
      }
    }
  }
}

Cursor

{
  "command": "snyk",
  "args": [
    "mcp",
    "-t",
    "stdio"
  ]
}

Windsurf

{
  "command": "snyk",
  "args": [
    "mcp",
    "-t",
    "stdio"
  ]
}

VS Code

{
  "command": "snyk",
  "args": [
    "mcp",
    "-t",
    "stdio"
  ]
}

One-step setup for Claude Code: installs the latest Snyk CLI and registers the server

{
  "command": "npx",
  "args": [
    "-y",
    "snyk@latest",
    "mcp",
    "configure",
    "--tool=claude-cli"
  ]
}

Description

Snyk ships its MCP server inside the Snyk CLI itself rather than as a separate package, which is a meaningful detail: the scanning engine an agent invokes is exactly the one your CI already runs, so results do not diverge between the assistant and the pipeline.

Once connected, an agent can test an application or its infrastructure definitions for known vulnerabilities, generate a software bill of materials, and monitor a project so new advisories surface against it over time. The workflow this unlocks is the one that makes security tooling actually get used — a coding agent that has just written or changed a dependency can scan the result and act on the findings in the same turn, instead of the developer discovering them in a pull-request check an hour later.

Setup

Install and authenticate the CLI first:

npm install -g snyk
snyk auth

Then point your client at it. Claude Desktop takes a snyk entry running snyk mcp -t stdio, optionally with SNYK_CFG_ORG set to the organisation ID that findings should be attributed to. For Claude Code, npx -y snyk@latest mcp configure --tool=claude-cli downloads the current CLI and wires up the integration in one step. Cursor and Windsurf take the same stdio command.

Requirements

A Snyk account and an authenticated CLI. Snyk's free tier covers a limited monthly test volume; larger usage and features such as container and IaC scanning depend on your plan.

Who it is for

Engineering teams already using Snyk who want vulnerability scanning available to their coding agents inline, and security teams who would rather agents triage findings against the canonical scanner than approximate it from a package manifest.

Related MCP Servers

MCP: Azure DevOps MCP Server

by Microsoft

New

Microsoft's official MCP server for Azure DevOps - work items, repos, pipelines, wikis, test plans and iterations, reachable from any MCP client in plain language.

Developer Tools