# Snyk API & Web MCP Server

Connects Claude Code to Snyk API & Web for target setup, DAST checks, and vulnerability triage.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 8
- Author: snyk
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/snyk/saw-mcp
- Updated: 2026-10-09
- HTML: https://affpapa.org/en/nevibecode/mcp/snyk-api-web-mcp-server

## What it does

This MCP server links an AI coding assistant with Snyk API & Web. It can onboard API and web targets, set up authentication details, start DAST checks, and help review the resulting findings. The server is built with FastMCP 2.0.

You need Python 3.10+ and a Snyk API & Web API key. Login-based web targets also need browser automation through `playwright-cli` with Chromium, or a separate Playwright MCP server. The API connection depends on `MCP_SAW_API_KEY` being available.

The key can come from an environment variable, `.env`, or `config/config.yaml`; `uvx` installs normally use the environment variable. In Claude Code, register the server with `claude mcp add`, then ask the assistant to configure targets or inspect scan results.

## Requirements
- Needs: Python and uv (commands run via uvx)
- Environment variables: `MCP_SAW_API_KEY` — keys and tokens: ask the human for the values, never commit them or put them in shared files.

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add saw-mcp -e MCP_SAW_API_KEY=<MCP_SAW_API_KEY> -- uvx snyk-apiweb-mcp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from snyk-apiweb-mcp <command>

### Codex

**Platform CLI**
```bash
codex mcp add snyk-api-web-mcp-server --env MCP_SAW_API_KEY=<MCP_SAW_API_KEY> -- uvx snyk-apiweb-mcp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from snyk-apiweb-mcp <command>

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "snyk-api-web-mcp-server": {
            "command": "uvx",
            "args": [
                "snyk-apiweb-mcp"
            ],
            "env": {
                "MCP_SAW_API_KEY": "<MCP_SAW_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from snyk-apiweb-mcp <command>

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "snyk-api-web-mcp-server": {
            "type": "stdio",
            "command": "uvx",
            "args": [
                "snyk-apiweb-mcp"
            ],
            "env": {
                "MCP_SAW_API_KEY": "<MCP_SAW_API_KEY>"
            }
        }
    }
}
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from snyk-apiweb-mcp <command>

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add -e MCP_SAW_API_KEY=<MCP_SAW_API_KEY> snyk-api-web-mcp-server uvx snyk-apiweb-mcp
```
Replace <…> with your own values. uvx runs the command named after the package; if the README names another one, use uvx --from snyk-apiweb-mcp <command>

## When to use it
- onboard an API from an OpenAPI schema
- connect a web app that requires login
- start a DAST check for a target
- review and triage vulnerability findings
- pass Snyk access through an API key

## Example prompts
- Set up a Snyk API & Web target from this OpenAPI schema.
- Prepare this authenticated web application for a security check.
- Run a DAST scan for the target and sort the findings by issue.

## Similar
- [REA](https://affpapa.org/en/nevibecode/mcp/rea.md) — MCP server · ★ 392262
- [World Monitor](https://affpapa.org/en/nevibecode/mcp/world-monitor.md) — MCP server · ★ 89609
- [mcp](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — MCP server · ★ 12110
- [Robin: AI-Powered Dark Web OSINT](https://affpapa.org/en/nevibecode/mcp/robin-ai-powered-dark-web-osint.md) — MCP server · ★ 7718
- [jshookmcp](https://affpapa.org/en/nevibecode/mcp/jshookmcp.md) — MCP server · ★ 2066
- [OpenOSINT](https://affpapa.org/en/nevibecode/mcp/openosint.md) — MCP server · ★ 1816

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md