Snyk

io.snykPublished by snyk.iov1.1304.2Updated Oct 24, 2026

Easily find and fix security issues in your applications leveraging Snyk platform capabilities.

VerifiedSTDIODesktop onlyDeveloper Tools Security & Monitoring

Server details

Identifier: io.snyk/mcp
Transport: STDIO
Runtime: Desktop only
Trust: Verified
Published: Sep 16, 2026

Security note

MCP servers receive tool arguments from a conversation and may perform external actions. Review what a server can do before you enable it, and give it only the access it needs.

The registry verified that this server's namespace belongs to snyk.io. It runs from a package rather than a hosted endpoint, so there is no endpoint to match against that domain.

SourceWeft's checks cover whether the listing is complete and the endpoint answered; they do not review the server's code or what its tools do.

Add a badge to your README

Show readers this MCP server is listed on SourceWeft. The badge links to this page.

[![Listed on SourceWeft](https://sourceweft.com/badge/mcp/io.snyk%2Fmcp.svg)](https://sourceweft.com/mcp/io.snyk%2Fmcp?utm_source=readme&utm_medium=badge)

Overview

AI-generated overview

Snyk's local MCP server that lets an AI assistant run Snyk security scans on code, dependencies, containers and IaC and read the findings.

What you can do: Run security scans on open-source dependencies, source code, infrastructure-as-code, containers and SBOM files, plus secret detection and package health checks. Create an AIBOM and retrieve the resulting Snyk findings in the assistant's context. Manage Snyk authentication: sign in, sign out and check authentication status. Mark a folder as trusted before scanning and report the Snyk CLI version.
When to use it: Useful when you want an AI coding assistant to check a project for vulnerabilities, leaked secrets or misconfigured infrastructure and act on Snyk findings without leaving the chat. Best for teams already using the Snyk CLI and platform.
Requirements: Runs as a local process via the Snyk CLI npm package, so Node.js and the Snyk CLI are needed on the machine. A Snyk account and authentication are required, handled through the server's own auth tools. Desktop-only; no environment variables or headers are declared.

Before you install

The server can trigger scans that read your codebase and may execute third-party ecosystem tools such as Gradle or Maven to resolve dependency trees. Authentication tools handle your Snyk credentials, and scan results are sent to the Snyk platform. Scans and package health checks may consume Snyk plan quota.

Installation

In SourceWeft

Open Snyk in the dashboard and add it to a workspace.
Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

Snyk Studio MCP

MCP (Model Context Protocol) is an open protocol that standardizes how applications share context with large language models.

MCP can provide AI systems with additional information needed to generate accurate and relevant responses for use cases where the AI systems do not have the context, by integrating the AI systems with tools and platforms that have specific capabilities.

You can integrate Snyk MCP into MCP-supporting tools to provide Snyk security context.

Snyk is introducing an MCP server as part of the Snyk CLI. This allows MCP-enabled agentic tools to integrate Snyk security scanning capabilities directly, thus bridging the gap between security scanning and AI-assisted workflows.

In environments or applications that use MCP, you can use the snyk mcp CLI command to:

Invoke Snyk scans:
Trigger CLI security scans for code, dependencies, or configurations in your codebase in your current MCP context.
Retrieve results:
Obtain Snyk security findings directly in your MCP-enabled tool or environment.

The Snyk MCP server supports integrating the following Snyk security tools into an AI system:

snyk_sca_scan (Open Source scan)
snyk_code_scan (Code scan)
snyk_iac_scan (IaC scan)
snyk_container_scan (Container scan)
snyk_sbom_scan (SBOM file scan)
snyk_secret_scan (Secret detection scan)
snyk_aibom (Create AIBOM)
snyk_package_health_check (Package health and security assessment)
snyk_trust (Trust a given folder before running a scan)
snyk_auth (authentication)
snyk_logout (logout)
snyk_auth_status (authentication status check)
snyk_version (version information)

Running snyk_sca_scan may execute third-party ecosystem tools (for example, Gradle or Maven) on your machine to fetch the project's dependency tree.

For more details, see the Snyk MCP installation, configuration and startup and Troubleshooting for the Snyk MCP server pages.

This repository is closed to public contributions.

Source: README.md at commit f9756fa

Tools

SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

v1.1304.2LatestSep 16, 2026

Score

50% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

Reached in the last 30 days25 pts
Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.
Auth declared10 pts
Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.
Tools listed15 pts
Answer tools/list without a credential, or ship a package that starts in a sandbox without one.
DescriptionRequired15 pts
Logo10 pts
Documentation15 pts
License10 pts