Snyk MCP

Snyk's MCP server is built into the Snyk CLI. It lets your agent run Snyk security scans on the project you're working in and read the findings in the chat, so it can fix issues in the code it writes and rescan to check the fix. It's the scanning layer of Snyk Studio, Snyk's security setup for AI coding agents. What you can do with it - Scan your own code for vulnerabilities with Snyk Code (SAST) - Scan dependencies for open-source vulnerabilities and license issues with Snyk Open Source - Check Terraform, Kubernetes, CloudFormation, ARM and Serverless Framework files for misconfigurations - Scan container images and SBOM files for known vulnerabilities - Check a package's health (vulnerabilities, maintenance, community and popularity) before adding it, for npm, PyPI, NuGet, Maven and Go How it connects It runs on your machine through the Snyk CLI: npx -y snyk@latest mcp -t stdio, or snyk mcp -t stdio if you already have the CLI. Snyk doesn't offer a hosted server, because scans need your local files. The first time, sign in to Snyk and trust the project folder; you can also pass a Snyk token in the SNYK_TOKEN environment variable. Snyk has setup guides for Claude Code, Cursor, Codex CLI, Gemini CLI and more, and it works in any agent that runs local MCP servers. Good to know - You need a Snyk account. - Profiles choose which tools it offers: Lite keeps the essential scans, Full (the default) has every stable tool, and Experimental adds tools still being evaluated. Set one with --profile or SNYK_MCP_PROFILE. - Open-source scans may run your build tools, such as Gradle or Maven, to read the dependency tree. - For coding agents with hooks, Snyk also offers a Snyk Studio installer that makes the agent scan new code automatically.