What it is
Agent Scan, formerly Invariant Labs' mcp-scan and now maintained by Snyk, finds the agent components on a machine and checks them for supply-chain risks. It discovers configurations for Claude Code, Claude Desktop, Cursor, GitHub Copilot, Windsurf, Gemini CLI, Amp, OpenClaw and others, at system, user, project and plugin scope, then inspects their MCP servers, tools, prompts, resources and skills.
It looks for prompt injection in tool descriptions and skills, tool poisoning, tool shadowing (one server's tool overriding another's), toxic flows (combinations of tools that could leak data), hardcoded secrets and malware payloads hidden in natural-language skill files. Analysis uses local checks plus Snyk's Agent Scan API: tool names and descriptions, MCP configurations and skill content are sent to Snyk, with secrets redacted first. A Snyk account and API token are required.
To read tool descriptions it starts stdio MCP servers by running their configured commands, so the README recommends scanning untrusted configurations in a sandbox; interactive runs ask for consent per server. It installs with uvx snyk-agent-scan or as a standalone binary with SBOM and signed checksums. It is Apache 2.0-licensed; v0.6.9 was released on 20 October 2026, and the README warns that CLI output is still experimental.
Our review
Agent Scan covers the part of agent security that red-teaming tools miss: the tools themselves. An MCP server or skill can carry instructions in its description that the model reads and obeys, and few open scanners look for that across every client on a machine. Version 0.6 reports 14 named risks, from prompt injection in skill instructions to suspicious download URLs and hardcoded secrets.
Discovery is thorough. The README's matrix tracks system, user, project and plugin scopes per client, including Copilot's shared ~/.copilot home and Claude Desktop plugins, and notes gaps such as Amp project-scope skills not yet being scanned. Standalone binaries ship with SBOMs and GPG-signed checksums, which is fitting for a supply-chain tool.
The caveats are real. Analysis is not local: tool descriptions, MCP configurations and skill content go to Snyk's API, with secrets redacted, and the README says tool-call contents are not stored. Interactive scans ask before starting each stdio server, but starting one means running its command, so an untrusted config is safer in a container. The 0.5 line, still pinned in parts of the README, uses an older analysis API and is slated for deprecation.
The output format is labelled experimental, and Snyk discourages building CI gates on specific risk names; enterprise customers are told the CLI output may differ from what Snyk Evo shows. That split says where the product is headed. The CLI is the free sensor, and the managed fleet view through Evo is the thing Snyk sells.
Where it earns its place
A security engineer at a 300-developer company that allows Claude Code and Cursor
Find which MCP servers and skills developers have installed and which look malicious
Run uvx snyk-agent-scan@latest on a sample of machines, or background mode reporting into Snyk Evo for the fleet; Evo pricing is on request.
A developer about to install a third-party MCP server
Check its tool descriptions for injected instructions before trusting it
Point the scanner at the server's config inside a disposable Docker container; the scan takes one command and a free Snyk token.
A platform team publishing internal agent skills
Screen new SKILL.md files for prompt injection and leaked secrets in review
Run the scanner on the skills directory in a pre-merge job, treating results as advisory because the output schema may change between releases.
Before you commit
- Setup
- Create a Snyk account, export SNYK_TOKEN, then uvx snyk-agent-scan@latest, or download a standalone binary and verify its signed checksums. No npm package is published.
- Integrations
- Auto-discovers Claude Code, Claude Desktop, Cursor, GitHub Copilot, VS Code, Windsurf, Gemini CLI, Amp and OpenClaw configs; background mode reports to Snyk Evo.
- Data and privacy
- Sends agent details, MCP configs, tool names and descriptions, and skill content to Snyk's Agent Scan API with secrets redacted; the README says MCP tool-call contents are not stored or logged. Apache 2.0; no GitHub security advisories published.
- Cost at scale
- The CLI is free with a Snyk token. Company-wide background scanning through Snyk Evo is arranged through Snyk sales; pricing is not published.
- Limits
- CLI output is experimental and can change between releases; some project-scope skill paths are not yet scanned, and Windows plugin discovery is unsupported. 11 open issues.
What's good
- Scans MCP servers and agent skills, not just prompts
- Detects tool poisoning, shadowing, toxic flows and hardcoded secrets
- Discovers configs across scopes for most popular agent clients
- Signed binaries with SBOMs
What's not
- Sends tool descriptions and skill content to Snyk
- Starts stdio MCP servers to inspect them
- Output format still experimental; 0.5 line being deprecated
Best for
Teams that let developers or agents install MCP servers and skills and want a supply-chain check before trusting them.
Alternatives
Snyk Agent Scan: common questions
- Is Snyk Agent Scan worth it?
- A sensible first check on the MCP servers and skills your agents trust, provided you accept sending their descriptions to Snyk and scan untrusted configs in a sandbox. We rate it 3.8 out of 5.
- How much does Snyk Agent Scan cost?
- Free and open source under Apache 2.0; needs a Snyk account and API token. Fleet-wide background scanning reports into Snyk Evo, priced on request.
- What are the downsides of Snyk Agent Scan?
- Sends tool descriptions and skill content to Snyk; starts stdio MCP servers to inspect them; output format still experimental; 0.5 line being deprecated.
- Who is Snyk Agent Scan best for?
- Teams that let developers or agents install MCP servers and skills and want a supply-chain check before trusting them.
- How much does Snyk Agent Scan cost for a team or in production?
- The CLI is free with a Snyk token. Company-wide background scanning through Snyk Evo is arranged through Snyk sales; pricing is not published.
- Is Snyk Agent Scan safe for company data?
- Sends agent details, MCP configs, tool names and descriptions, and skill content to Snyk's Agent Scan API with secrets redacted; the README says MCP tool-call contents are not stored or logged. Apache 2.0; no GitHub security advisories published.
- What are the best Snyk Agent Scan alternatives?
- The closest alternatives we have reviewed are promptfoo and garak.
Answers checked Oct 23, 2026.