MCP-Scan: An MCP Security Scanner

@invariantlabs-ai

Basic information

About MCP-Scan: An MCP Security Scanner

Security scanner for AI agents, MCP servers and agent skills.

MCP-Scan: An MCP Security Scanner config

Add this server to your MCP-compatible client using the configuration below.

{
  "mcpServers": {
    "mcp-scan": {
      "command": "uvx",
      "args": [
        "snyk-agent-scan@latest"
      ]
    }
  }
}

MCP-Scan: An MCP Security Scanner tools

Tool list not available yet

This listing does not currently have a tool list to display. This does not mean the server has no tools; check its documentation for supported capabilities.

Fetch the live tool list by running this server in a temporary sandbox using the button above.

Overview

What is MCP-Scan: An MCP Security Scanner?

MCP-Scan (also known as Snyk Agent Scan) is a security scanner that discovers and scans agent components on your machine—including MCP servers, agent tools, and skills—for prompt injections, malware payloads, and other vulnerabilities. It is designed for developers and security teams who need to inspect the supply chain of AI agents.

How to use MCP-Scan: An MCP Security Scanner?

Obtain a Snyk API token and set it as the SNYK_TOKEN environment variable. Install uv on your system, then run uvx snyk-agent-scan@latest to auto-discover and scan all agents, MCP servers, and skills. You can also scan specific MCP configuration files or skill files by passing file paths as arguments.

Key features of MCP-Scan: An MCP Security Scanner

Auto-discovers MCP configurations, agent tools, and skills
Detects 15+ distinct security risks (e.g., prompt injection, tool poisoning)
Supports scanning of Claude, Cursor, Windsurf, Gemini CLI, and more
Interactive consent prompt before running any stdio MCP server
Background mode for enterprise-wide monitoring via Snyk Evo

Use cases of MCP-Scan: An MCP Security Scanner

Scan your local machine for vulnerable MCP servers and agent skills
Integrate security into CI/CD pipelines (non‑interactive mode)
Monitor the company‑wide agent supply chain from a central dashboard

Frequently asked questions

Do I need a Snyk account to use it?

Yes. You must sign up at Snyk, obtain an API token, and set it as the `SNYK_TOKEN` environment variable.

What happens when scanning MCP configuration files?

Scanning an MCP config executes the commands defined in it to retrieve tool descriptions. Agent Scan prompts for user consent before starting each stdio server; for non‑interactive environments use `--dangerously-run-mcp-servers`.

Is my data shared with Snyk?

Yes. Skills, agent applications, tool names, and descriptions are shared with Snyk for security analysis. Agent Scan does not store or log the contents or results of MCP tool calls.

Which agents are supported?

Claude Desktop/Code, Cursor, Windsurf, VS Code, Gemini CLI, Amazon Q, and several others across macOS, Linux, and Windows.

What are the runtime requirements?

Python (via PyPI package `snyk-agent-scan`), the `uv` tool, and network access to Snyk’s API.

Comments

More Developer Tools MCP servers

Eddyter AI Rich Text Editor MCP

EddyterAI

Set up and manage the Eddyter AI rich text editor by talking to your AI agent — for Claude, Cursor, Codex and other MCP tools. A Model Context Protocol server that lets AI tools add Eddyter to a React, Next.js, Vite or R

LocalCan

Gives AI agents public URLs (tunnels) for localhost, live HTTP traffic inspection, snapshot publishing, and access control. Part of LocalCan, the ngrok alternative for Mac, Windows and Linux. Free plan.

OrangePro

Aamir Siddiqui

OrangePro local-first CLI + MCP server for behavior mapping, grounded test generation, and dynamic proof.

SSH MCP Server

hypnosis

SSH MCP server for AI agents: remote commands, file transfer, log search and server audits through OpenSSH.

Modelglass

Modelglass turns "which model should I use?" into a lookup instead of a guess. Seven tools give your agent live pricing across image, language, video, and audio models. Sourced and versioned, not scraped once and forgott