Skip to content
Snyk MCP Server

Snyk MCP Server

by Snyk
Added to Onei
Apache-2.0
Repository Docs npm
Developer Tools

Summary

Snyk's official MCP server, shipped inside the Snyk CLI: scan code, dependencies, containers and IaC for vulnerabilities, generate SBOMs and monitor projects from your agent.

Features

  • Vulnerability scanning for code, open-source dependencies, containers and IaC
  • SBOM generation from an agent request
  • Project monitoring so new advisories surface against a scanned project
  • Ships inside the Snyk CLI, so agent results match what CI reports
  • One-command setup for Claude Code via snyk mcp configure

Installation

Set up this MCP server in your favorite AI agent — copy a ready-made configuration below.

Any MCP-compatible agent

Most agents (Claude, Cursor, Windsurf, VS Code, and more) read a standard mcpServers configuration.

  1. Open your agent's MCP configuration file.
  2. Merge the snippet below into it, filling in the environment variables with your own values.
  3. Restart the agent — the "Snyk MCP Server" tools will be available.
{
  "mcpServers": {
    "snyk-mcp": {
      "command": "snyk",
      "args": [
        "mcp",
        "-t",
        "stdio"
      ],
      "env": {
        "SNYK_CFG_ORG": "your-org-id"
      }
    }
  }
}

Description

Snyk ships its MCP server inside the Snyk CLI itself rather than as a separate package, which is a meaningful detail: the scanning engine an agent invokes is exactly the one your CI already runs, so results do not diverge between the assistant and the pipeline.

Once connected, an agent can test an application or its infrastructure definitions for known vulnerabilities, generate a software bill of materials, and monitor a project so new advisories surface against it over time. The workflow this unlocks is the one that makes security tooling actually get used — a coding agent that has just written or changed a dependency can scan the result and act on the findings in the same turn, instead of the developer discovering them in a pull-request check an hour later.

Setup

Install and authenticate the CLI first:

npm install -g snyk
snyk auth

Then point your client at it. Claude Desktop takes a snyk entry running snyk mcp -t stdio, optionally with SNYK_CFG_ORG set to the organisation ID that findings should be attributed to. For Claude Code, npx -y snyk@latest mcp configure --tool=claude-cli downloads the current CLI and wires up the integration in one step. Cursor and Windsurf take the same stdio command.

Requirements

A Snyk account and an authenticated CLI. Snyk's free tier covers a limited monthly test volume; larger usage and features such as container and IaC scanning depend on your plan.

Who it is for

Engineering teams already using Snyk who want vulnerability scanning available to their coding agents inline, and security teams who would rather agents triage findings against the canonical scanner than approximate it from a package manifest.

Related MCP Servers

See all Snyk MCP Server alternatives

MCP: Semgrep MCP

by Semgrep

Semgrep's official MCP server — scan code for security vulnerabilities, write and test custom rules, and pull findings from Semgrep Cloud, from inside an agent session.

Developer Tools

MCP: CVE MCP Server

by mukul975

Vulnerability triage for AI agents: 28 security tools across 24 free intelligence sources — NVD, EPSS, CISA KEV, MITRE ATT&CK, Shodan and VirusTotal — behind a single triage_cve call.

Developer Tools

MCP: HackerOne

by HackerOne

Featured

Official read-only MCP server for HackerOne bug bounty reports, programs, and remediation data.

Developer Tools
Browse all MCP servers →