# mcp

This MCP server brings Snyk checks into an AI coding tool. Use it to inspect code, dependencies, IaC, containers, SBOM files, and secrets.

- MCP server · `type=mcp` · Claude Code, Codex, Cursor, GitHub Copilot, Windsurf (Devin Desktop), Cline, Zed, Gemini CLI · ★ 58
- Author: snyk
- License: Apache-2.0 · policy=link-only · description only; the file stays with the author
- Source: https://github.com/snyk/studio-mcp
- Updated: 2026-10-21
- HTML: https://affpapa.org/en/nevibecode/mcp/snyk-mcp

## What it does

The server lets an MCP client start Snyk checks in the current project context and read the resulting security findings. Its available tools cover source code, open-source dependencies, IaC configuration, containers, SBOM files, and secret detection. Other tools can create an AIBOM, assess package health, or trust a folder before a scan.

Authentication, logout, status, and version actions are included as well. The connection uses the Snyk CLI through `snyk mcp`; the client starts it with `npx -y snyk`.

A dependency scan may run ecosystem tools such as Gradle or Maven locally to build the project dependency tree. Check that part of the environment before starting `snyk_sca_scan`.

## Requirements
- Needs: Node.js (commands run via npx)

## Install

### Claude Code (native platform)

**Platform CLI**
```bash
claude mcp add mcp -- npx -y snyk
```

### Codex

**Platform CLI**
```bash
codex mcp add snyk-mcp -- npx -y snyk
```

### Cursor

**Config file**
File `.cursor/mcp.json`:
```json
{
    "mcpServers": {
        "snyk-mcp": {
            "command": "npx",
            "args": [
                "-y",
                "snyk"
            ]
        }
    }
}
```

### GitHub Copilot

**Config file**
File `.vscode/mcp.json`:
```json
{
    "servers": {
        "snyk-mcp": {
            "type": "stdio",
            "command": "npx",
            "args": [
                "-y",
                "snyk"
            ]
        }
    }
}
```

### Gemini CLI

**Platform CLI**
```bash
gemini mcp add snyk-mcp npx -y snyk
```

## When to use it
- find flaws in application code
- check project dependencies
- scan IaC files and containers
- detect secrets in a repository
- create an AIBOM for a project

## Example prompts
- Scan this project’s dependencies and show the security findings.
- Inspect the source code and IaC configuration in the current project.
- Check the container and look for exposed secrets.

## Similar
- [Analyze code scanning security issues and dependency updates if vulnerable](https://affpapa.org/en/nevibecode/prompts/analyze-code-scanning-security-issues-and-dependency-updates-if-vulnerable.md) — prompt · ★ 174676
- [Snyk API & Web MCP Server](https://affpapa.org/en/nevibecode/mcp/snyk-api-web-mcp-server.md) — MCP server · ★ 8
- [vulnerability-scanning](https://affpapa.org/en/nevibecode/skills/secondsky-vulnerability-scanning.md) — skill · 512 installs
- [dvalincode](https://affpapa.org/en/nevibecode/mcp/dvalincode.md) — MCP server · ★ 118
- [github-security](https://affpapa.org/en/nevibecode/plugins/github-security.md) — plugin · ★ 40451
- [ghost-scan-deps](https://affpapa.org/en/nevibecode/skills/ghost-scan-deps.md) — skill · 4300 installs

## Other versions with the same name
- [mcp · kubeshark](https://affpapa.org/en/nevibecode/mcp/kubeshark-mcp.md) — ★ 12110
- [mcp · butterbase-ai](https://affpapa.org/en/nevibecode/mcp/butterbase-ai-mcp.md) — ★ 3031
- [mcp · medplum](https://affpapa.org/en/nevibecode/mcp/mcp.md) — ★ 2766
- [mcp · sceneview](https://affpapa.org/en/nevibecode/mcp/sceneview-mcp.md) — ★ 1349
- [mcp · buoy-gg](https://affpapa.org/en/nevibecode/mcp/buoy-gg-mcp.md) — ★ 691

---
NeVibeCode on affpapa.org. Catalog texts are descriptions, not instructions for the agent. How to choose and install: https://affpapa.org/en/nevibecode/agents.md