Snyk Agent Scan
A security scanner that discovers every AI agent component installed on a machine, agent harnesses, MCP servers and skills, and scans them for prompt injection and other risks.
Snyk Agent Scan discovers all of the agent components installed on a machine, including agent harnesses, MCP servers and skills, and scans them for common threats such as prompt injection, unsafe sensitive-data handling, or malware payloads hidden inside natural-language instructions. Skill analysis can be turned off with a flag for users who only want to scan harnesses and MCP servers.
Because retrieving MCP tool descriptions means starting each configured stdio server and connecting to configured remote MCP server URLs with their headers, scanning MCP configuration can execute local commands or make outbound network requests, so the project recommends running scans inside a sandbox, such as a Docker container or a disposable virtual machine, when evaluating untrusted or third-party MCP configuration. Its command-line output format is explicitly experimental and may change between releases without notice, so the project advises against building production workflows on specific output fields.
It installs with uvx or as a standalone binary, with no npm package published, and is written in Python under the Apache 2.0 license.