Agent Scan

Snyk Agent Scan

Discover and scan agent components on your machine for prompt injections and vulnerabilities (including agents, MCP servers, skills).

> Note: CLI output is experimental and subject to change > > The raw output of this CLI — including issue codes, field names, severity labels, and response structure — is experimental and may change without notice between releases. We do not recommend building production workflows that depend on specific CLI output fields or issue codes. > > If you are an enterprise customer using Snyk to manage agent security risk at scale, the CLI output may not reflect what is sent to and shown in the Evo platform. The underlying integration, discovery, and risk assessment that powers enterprise deployments is stable and supported — any changes will be communicated in line with standard Snyk product practices. Contact your account team for deployment guidance.

> NEW Read our [technical report on the emerging threats of the agent skill eco-system](.github/reports/skills-report.pdf) published together with Agent Scan 0.4, which adds support for scanning agent skills.

Agent Scan helps you keep an inventory of all your installed agent components (harnesses, MCP servers, and skills) and scans them for common threats like prompt injections, sensitive data handling, or malware payloads hidden in natural language. Ignore analysis on skills by using --no-skills.

Security Warning

> ⚠️ IMPORTANT: Scanning MCP configurations will execute the commands defined in them. > > When Agent Scan scans an MCP configuration file, it starts the stdio MCP servers by executing the commands and arguments specified in the config. This is necessary to retrieve tool descriptions and perform security analysis. > > Recommendations: > - Run scans inside a sandbox (Docker container, VM, or disposable environment) when evaluating untrusted or third-party MCP configs > - Review the consent prompt carefully during interactive scans, it shows the exact command and arguments that will be executed for each server > - Use --dangerously-run-mcp-servers only in trusted environments where you've verified all MCP server commands > > By default, Agent Scan requires explicit user consent (y/n) before starting each stdio MCP server during interactive runs. This gives you control over what gets executed on your system.

Highlights

• Auto-discover MCP configurations, agent tools, skills
• Scanning of Claude, Cursor, Windsurf, Gemini CLI, Amp, Amazon Q, and other agents.
• Detects [15+ distinct security risks](docs/issue-codes.md) across MCP servers and agent skills:
• MCP: [Prompt Injection](docs/issue-codes.md#E001), [Tool Poisoning](docs/issue-codes.md#E001), [Tool Shadowing](docs/issue-codes.md#E002), [Toxic Flows](docs/issue-codes.md#ToxicFlows)
• Skills: [Prompt Injection](docs/issue-codes.md#E004), [Malware Payloads](docs/issue-codes.md#E006), [Untrusted Content](docs/issue-codes.md#W011), [Credential Handling](docs/issue-codes.md#W007), [Hardcoded Secrets](docs/issue-codes.md#W008)

Supported agents and capabilities

Agent Scan auto-discovers agents and their capabilities (MCP servers or skills) when their install paths exist. The table below shows on which operating systems each agent is scanned.

• ✓: at least one path is defined for that capability.
• ✗: the agent is listed for that OS but has no paths for that capability.
• —: that agent is not included for that OS.
• Skills Skills can be ignored by using --no-skills

| Agent | macOS MCP | macOS Skills | Linux MCP | Linux Skills | Windows MCP | Windows Skills | | --- | :---: | :---: | :---: | :---: | :---: | :---: | | Windsurf | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | Cursor | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | VS Code | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | Claude Desktop | ✓ | ✗ | — | — | ✓ | ✗ | | Claude Code | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | Gemini CLI | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | OpenClaw | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ | | Amp | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ | | Kiro | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | OpenCode | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ | | Antigravity | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | Codex | ✓ | ✓ | ✓ | ✓ | — | — | | Amazon Q | ✓ | ✗ | ✓ | ✗ | ✓ (WSL) | ✗ |

Detection coverage by scope

The matrix above shows on which operating systems each agent is scanned. This one breaks detection down by configuration scope and component type (skills vs MCP servers), combined across operating systems. "Servers" means MCP servers.

The four scopes:

• System — machine-wide / admin-managed / enterprise config that applies to all users (e.g. managed-mcp.json, files under /etc, /Library/Application Support, or ProgramData).
• User — the user's home-directory config (applies across all their projects).
• Project / workspace — config scoped to an opened project or workspace.
• Extension / plugin — components bundled inside installed extensions or plugins.

Legend: ✓ detected · ✗ the agent supports this but Agent Scan does not scan it yet · N/A the agent has no such component at this scope.

| Agent | Systemskills | Systemservers | Userskills | Userservers | Project / WSskills | Project / WSservers | Ext / pluginskills | Ext / pluginservers | | --- | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: | | Windsurf | ✓ | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | Cursor | N/A | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | VS Code | N/A | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | Claude Desktop | N/A | N/A | ✗ | ✓ | N/A | N/A | N/A | ✗ | | Claude Code | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | Gemini CLI | N/A | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ | | OpenClaw | N/A | N/A | ✓ | ✗ | ✓ † | N/A | ✗ | ✗ | | Amp | N/A | ✗ | ✓ | ✗ | ✗ ‡ | ✗ | ✗ | ✗ | | Kiro | N/A | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | OpenCode | N/A | ✗ | ✗ | ✗ | ✗ | ✗ | N/A | N/A | | Antigravity | N/A | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | Codex | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | | Amazon Q | N/A | N/A | N/A | ✓ | N/A | ✗ | N/A | N/A |

† OpenClaw has no opened-project enumeration: its project/workspace skills are found only at the fixed ~/.openclaw/workspace/skills

‡ Amp stores project/workspace skills at .agents/skills (and the .claude/skills compatibility path); only the user-scope ~/.config/agents/skills is detected today, so project-scope skills are supported but not yet scanned.

Quick Start

To get started:

1. Sign up at Snyk and get an API token from https://app.snyk.io/account (API Token → KEY → click to show).
2. Set the token as an environment variable before running any scan:

``bash export SNYK_TOKEN=your-api-token-here ``

1. Have uv installed on your system.

Scanning

To run a full scan of your machine (auto-discovers agents, MCP servers, skills), run:

uvx snyk-agent-scan@latest

This will scan for security vulnerabilities in MCP servers, tools, prompts, and resources. It will automatically discover a variety of agent configurations, including Claude Code/Desktop, Cursor, Gemini CLI, and Windsurf.

uvx snyk-agent-scan@latest

You can also scan particular MCP configuration files or skills:

# scan a specific mcp configuration
uvx snyk-agent-scan@latest ~/.vscode/mcp.json
# scan a single agent skill
uvx snyk-agent-scan@latest ~/path/to/my/SKILL.md
# scan all claude skills
uvx snyk-agent-scan@latest ~/.claude/skills

Example Run

[](https://asciinema.org/a/716858)

Scanner Capabilities

Agent Scan is a security scanning tool to both scan and inspect the supply chain of agent components on your machine. It scans for common security vulnerabilities like prompt injections, tool poisoning, toxic flows, or vulnerabilities in agent skills.

Agent Scan operates in two main modes which can be used jointly or separately:

1. Scan Mode: The CLI command snyk-agent-scan scans the current machine for agents and agent components such as skills and MCP servers. Upon completion, it will output a comprehensive report for the user to review.

1. Background Mode (MDM, Crowdstrike). Agent Scan scans the machine in regular intervals in the background, and reports the results to a Snyk Evo instance. This can be used by security teams to monitor the company-wide agent supply chain in a central location. To set this up, please contact us.

How It Works

Scanning

Agent Scan searches through your local agent's configuration files to find agents, skills, and MCP servers. For MCP, it connects to servers and retrieves tool descriptions.

Interactive Consent for MCP Servers

> ⚠️ Security Note: Scanning an MCP config executes the commands defined in it. Always review what will be executed before approving.

By default, Agent Scan prompts for user consent before starting each stdio MCP server during interactive runs. This consent flow:

• Shows the server name, command, and environment variables (redacted) that will be executed
• Allows you to approve or decline each server individually
• Prevents potentially untrusted servers from running without your explicit permission
• Records declined servers with a user_declined error (they are never started)

Best Practices:

• Review the command and arguments carefully before approving
• When scanning untrusted or third-party MCP configs, run Agent Scan inside a sandbox (Docker, VM, or disposable environment)
• Decline any servers with unfamiliar or suspicious commands

For non-interactive environments (e.g., CI/CD pipelines), you must use the --dangerously-run-mcp-servers flag to bypass the consent prompt and start all servers automatically. Only use this flag in trusted environments where all MCP server commands have been verified.

Analysis and Validation

Agent Scan validates the components, both with local checks and by invoking the Agent Scan API. For this, skills, agent applications, tool names, and descriptions are shared with Snyk. By using Agent Scan, you agree to the Snyk [terms of use for Agent Scan](./TERMS.md).

Agent Scan does not store or log any usage data, i.e. the contents and results of your MCP tool calls.

Control Server Bootstrap

When --control-server is configured, Agent Scan sends a startup bootstrap request to the first configured control server before doing any other work. This applies to every command that accepts --control-server — scan, inspect, and evo — including the read-only inspect command that performs no other network egress on its own. The guard command does not bootstrap. If more than one --control-server is configured, only the first one receives the bootstrap; the rest receive the eventual scan-result push only.

The request contains an allowlisted host/process fingerprint: Agent Scan version and command, redacted CLI arguments, OS and Python details, hostname, current username, CI/WSL/container flags, shell, terminal, locale, timezone, current working directory, current home directory, executable path, and readable home directories capped at 1000 entries. It does not include schema_version or scanned usernames.

Home-directory enumeration mirrors the scan itself: by default the payload only reports the current user's home directory. Passing --scan-all-users opts in to enumerating every readable human home directory on the machine (and, on Windows, WSL profile directories) — exactly the set the scan would touch — for inclusion in the bootstrap payload.

Bootstrap failures never abort the command. Timeouts, network errors, HTTP errors, and malformed responses fall back to defaults. The HTTP call uses a 3-second per-attempt timeout and retries up to three times on transient failures (5xx, 408, 429), with a linear backoff of 0s, 1s, and 2s between attempts — so on a flaky network a command can wait up to ~12 seconds at startup (3s + 1s + 3s + 2s + 3s) before falling through to the no-bootstrap path. Definitive 4xx responses and malformed payloads do not retry. Home-directory enumeration may take noticeably longer on Windows with --scan-all-users because it can query Windows profiles and WSL homes; the HTTP timeout only applies after the payload has been assembled. Use --no-bootstrap to disable this startup request on any command.

> Snyk-managed control server required. Bootstrap is only sent when the configured --control-server URL ends in /mcp-scan/push — the canonical Snyk-managed endpoint. Self-hosted or custom control-server deployments whose URLs do not match this shape will skip the bootstrap call (a warning is logged) and uploads will not include the X-Bootstrap-Event-Id correlation header. Self-hosted deployments should pass --no-bootstrap to suppress the warning and make the opt-out explicit.

CLI Parameters

Agent Scan provides the following commands:

snyk-agent-scan - Security scanner for agents, MCP servers, and skills

Common Options

These options are available for all commands:

--storage-file FILE    Path to store scan results and scanner state (default: ~/.mcp-scan)
--base-url URL         Base URL for the verification server
--verbose              Enable detailed logging output
--print-errors         Show error details and tracebacks
--json                 Output results in JSON format instead of rich text
--no-bootstrap         Disable the startup bootstrap call to the control server

Commands

scan (default)

Scan MCP configurations for security vulnerabilities in tools, prompts, and resources.

snyk-agent-scan scan [CONFIG_FILE...]

Options:

--checks-per-server NUM           Number of checks to perform on each server (default: 1)
--server-timeout SECONDS          Seconds to wait before timing out server connections (default: 10)
--suppress-mcpserver-io BOOL      Suppress stderr from stdio MCP servers (stdout carries the JSON-RPC protocol
                                  and is never shown). Default: False for interactive runs (stderr is streamed
                                  with a [server-name] prefix), True otherwise.
--dangerously-run-mcp-servers     ⚠️ DANGER: Skip the interactive consent prompt and automatically start every
                                  stdio MCP server listed in the scanned configs. Only use in trusted
                                  environments where you've verified all MCP server commands.
--no-skills                       Skip analysis on skills.

inspect

Print descriptions of tools, prompts, and resources without verification.

When invoked with --control-server, inspect also sends a one-shot startup bootstrap to that server before reading any config files — see [Control Server Bootstrap](#control-server-bootstrap). Use --no-bootstrap to skip it.

snyk-agent-scan inspect [CONFIG_FILE...]

Options:

--server-timeout SECONDS          Seconds to wait before timing out server connections (default: 10)
--suppress-mcpserver-io BOOL      Suppress stderr from stdio MCP servers (stdout carries the JSON-RPC protocol
                                  and is never shown). Default: False for interactive runs (stderr is streamed
                                  with a [server-name] prefix), True otherwise.
--dangerously-run-mcp-servers     ⚠️ DANGER: Skip the interactive consent prompt and automatically start every
                                  stdio MCP server listed in the scanned configs. Only use in trusted
                                  environments where you've verified all MCP server commands.

help

Display detailed help information and examples.

snyk-agent-scan help

Examples

# Scan all known MCP configs and agent skills
snyk-agent-scan

# Scan a specific config file
snyk-agent-scan ~/custom/config.json

# Scan a specific skill file
snyk-agent-scan ~/path/to/my/SKILL.md

# Scan a directory for skills
snyk-agent-scan ~/.claud

…

## Source & license

This open-source MCP server is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [snyk](https://github.com/snyk)
- **Source:** [snyk/agent-scan](https://github.com/snyk/agent-scan)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.