{"slug": "security-scanner-for-ai-agents-mcp-servers-and-agent-skills", "title": "Security scanner for AI agents, MCP servers and agent skills", "summary": "Snyk released Agent Scan, a security scanner that discovers and analyzes AI agent components—including harnesses, MCP servers, and agent skills—for threats such as prompt injections, sensitive data handling, and malware payloads. The tool, available via uvx or standalone binaries, requires a Snyk API token and executes MCP server commands during scans, prompting for user consent and recommending sandboxed execution. Version 0.5.x is planned for deprecation, with output formats subject to change.", "body_md": "Discover and scan agent components on your machine for prompt injections\n\nand vulnerabilities (including agents, MCP servers, skills).\n\nNote:We don't publish an npm package for Agent Scan. Install it via[or as a]`uvx`\n\n[standalone binary].\n\nNote: CLI output is experimental and subject to change\n\nAgent Scan v0.5.x (planned for deprecation)The raw output of this CLI — including issue codes, field names, severity labels, and response structure — is experimental and may change without notice between releases. We do not recommend building production workflows that depend on specific CLI output fields or issue codes.\n\nAgent Scan v0.6 and laterThe raw output of this CLI — including risk indicator names, scores, field names, and response structure — is experimental and may change without notice between releases. We do not recommend building production workflows that depend on specific CLI output fields or risk names.\n\nIf you are an enterprise customer using Snyk to manage agent security risk at scale, the CLI output may not reflect what is sent to and shown in the Evo platform. The underlying integration, discovery, and risk assessment that powers enterprise deployments is stable and supported — any changes will be communicated in line with standard Snyk product practices. Contact your account team for deployment guidance.\n\nNEWRead our[technical report on the emerging threats of the agent skill eco-system]published together with Agent Scan 0.4, which adds support for scanning agent skills.\n\nWarning\n\nAgent Scan v0.5.x uses issue-code output. This CLI line is planned for deprecation.\n\nAgent Scan helps you discover all your installed agent components (harnesses, MCP servers, and skills) and scans them for common threats like prompt injections, sensitive data handling, or malware payloads hidden in natural language. Ignore analysis on skills by using `--no-skills`\n\n.\n\n⚠️ IMPORTANT: Scanning MCP configurations will execute the commands defined in them.When Agent Scan scans an MCP configuration file, it starts the stdio MCP servers by executing the commands and arguments specified in the config. This is necessary to retrieve tool descriptions and perform security analysis.\n\nRecommendations:\n\nRun scans inside a sandbox(Docker container, VM, or disposable environment) when evaluating untrusted or third-party MCP configsReview the consent prompt carefullyduring interactive scans, it shows the exact command and arguments that will be executed for each serverUseonly in trusted environments where you've verified all MCP server commands`--dangerously-run-mcp-servers`\n\nBy default, Agent Scan requires explicit user consent (y/n) before starting each stdio MCP server during interactive runs. This gives you control over what gets executed on your system.\n\nChoose one of two ways to run Agent Scan:\n\n**Run the Python package with** using the instructions below.`uvx`\n\n**Download a standalone binary** for your platform from[GitHub Releases](https://github.com/snyk/agent-scan/releases). Releases also include the SBOM, checksums, signed checksums, and source code archives.\n\nBefore using either option:\n\n**Sign up at** and get an API token from[Snyk](https://snyk.io)[https://app.snyk.io/account](https://app.snyk.io/account)(API Token → KEY → click to show).**Set the token as an environment variable** before running any scan:\n\n```\nexport SNYK_TOKEN=your-api-token-here\n```\n\nHave [uv](https://docs.astral.sh/uv/getting-started/installation/) installed on your system. Choose the instructions for your CLI version.\n\nThe examples pin v0.5.17 as a concrete v0.5.x release:\n\n```\n# Scan the whole machine\nuvx snyk-agent-scan@0.5.17\n\n# Scan a specific MCP configuration\nuvx snyk-agent-scan@0.5.17 ~/.vscode/mcp.json\n\n# Scan a single agent skill\nuvx snyk-agent-scan@0.5.17 ~/path/to/my/SKILL.md\n\n# Scan all Claude skills\nuvx snyk-agent-scan@0.5.17 ~/.claude/skills\n```\n\nWarning\n\nv0.5.x uses issue-code output and the `2025-09-02`\n\nanalysis API. This CLI line is planned for deprecation.\n\n```\n# Scan the whole machine\nuvx snyk-agent-scan@latest\n\n# Scan a specific MCP configuration\nuvx snyk-agent-scan@latest ~/.vscode/mcp.json\n\n# Scan a single agent skill\nuvx snyk-agent-scan@latest ~/path/to/my/SKILL.md\n\n# Scan all Claude skills\nuvx snyk-agent-scan@latest ~/.claude/skills\n```\n\nv0.6 and later use the risk-based output and the `2026-07-10`\n\nanalysis API.\n\nBoth versions scan MCP servers, tools, prompts, resources, and skills, and automatically discover supported agent configurations such as Claude Code/Desktop, Cursor, Gemini CLI, and Windsurf.\n\nDownload the binary for your operating system and architecture from the [latest GitHub Release](https://github.com/snyk/agent-scan/releases/latest). The release page also provides an SBOM (`sbom-<version>.json`\n\n), checksum files, and GitHub-generated source code archives. See [Verifying Standalone Binaries](#verifying-standalone-binaries) to verify your download.\n\n- Auto-discover MCP configurations, agent tools, skills\n- Scanning of Claude, Cursor, Windsurf, Gemini CLI, Amp, Amazon Q, and other agents.\n\n- Detects\n[15+ distinct security risks](/snyk/agent-scan/blob/main/docs/issue-codes.md)across MCP servers and agent skills:\n\n- Detects\n[15 distinct security risks](/snyk/agent-scan/blob/main/docs/risks.md)across MCP servers and agent skills:- MCP:\n[Prompt injection](/snyk/agent-scan/blob/main/docs/risks.md#prompt_injection_tool_desc),[dangerous words](/snyk/agent-scan/blob/main/docs/risks.md#dangerous_words),[untrusted content](/snyk/agent-scan/blob/main/docs/risks.md#untrusted_content),[private data](/snyk/agent-scan/blob/main/docs/risks.md#private_data), and[destructive capabilities](/snyk/agent-scan/blob/main/docs/risks.md#destructive_capabilities) - Skills:\n[prompt injection](/snyk/agent-scan/blob/main/docs/risks.md#prompt_injection_skill_instructions),[suspicious downloads](/snyk/agent-scan/blob/main/docs/risks.md#suspicious_download_url),[malicious code](/snyk/agent-scan/blob/main/docs/risks.md#malicious_code),[credential handling](/snyk/agent-scan/blob/main/docs/risks.md#insecure_credential_handling),[secret detection](/snyk/agent-scan/blob/main/docs/risks.md#secret_detection), and more\n\n- MCP:\n\nAgent Scan auto-discovers agents and their capabilities (MCP servers or skills) when their install paths exist. The table below shows on which operating systems each agent is scanned.\n\n**✓**: at least one path is defined for that capability.**✗**: the agent is listed for that OS but has no paths for that capability.**—**: that agent is not included for that OS.** Skills**Skills can be ignored by using`--no-skills`\n\n| Agent | macOS MCP | macOS Skills | Linux MCP | Linux Skills | Windows MCP | Windows Skills |\n|---|---|---|---|---|---|---|\n| Windsurf | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| Cursor | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| VS Code | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| Claude Desktop | ✓ | ✗ | — | — | ✓ | ✗ |\n| Claude Code | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| Gemini CLI | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| OpenClaw | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ |\n| Amp | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ |\n| Kiro | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| OpenCode | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| Antigravity | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| Codex | ✓ | ✓ | ✓ | ✓ | — | — |\n| Amazon Q | ✓ | ✗ | ✓ | ✗ | ✓ (WSL) | ✗ |\n\nThe matrix above shows on which operating systems each agent is scanned. This one breaks detection down by **configuration scope** and **component type** (skills vs MCP servers), combined across operating systems. \"Servers\" means MCP servers.\n\nThe four scopes:\n\n**System**— machine-wide / admin-managed / enterprise config that applies to all users (e.g.`managed-mcp.json`\n\n, files under`/etc`\n\n,`/Library/Application Support`\n\n, or`ProgramData`\n\n).**User**— the user's home-directory config (applies across all their projects).** Project / workspace**— config scoped to an opened project or workspace.** Extension / plugin**— components bundled inside installed extensions or plugins.\n\nLegend: **✓** detected · **✗** the agent supports this but Agent Scan does not scan it yet · **N/A** the agent has no such component at this scope.\n\n| Agent | System skills |\nSystem servers |\nUser skills |\nUser servers |\nProject / WS skills |\nProject / WS servers |\nExt / plugin skills |\nExt / plugin servers |\n|---|---|---|---|---|---|---|---|---|\n| Windsurf | ✓ | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| Cursor | N/A | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| VS Code | N/A | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| Claude Desktop | N/A | N/A | ✗ | ✓ | N/A | N/A | N/A | ✗ |\n| Claude Code | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| Gemini CLI | N/A | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |\n| OpenClaw | N/A | N/A | ✓ | ✗ | ✓ † | N/A | ✗ | ✗ |\n| Amp | N/A | ✗ | ✓ | ✗ | ✗ ‡ | ✗ | ✗ | ✗ |\n| Kiro | N/A | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| OpenCode | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | N/A | N/A |\n| Antigravity | N/A | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| Codex | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| Amazon Q | N/A | N/A | N/A | ✓ | N/A | ✗ | N/A | N/A |\n\n† OpenClaw has no opened-project enumeration: its project/workspace skills are found only at the fixed `~/.openclaw/workspace/skills`\n\n‡ Amp stores project/workspace skills at `.agents/skills`\n\n(and the `.claude/skills`\n\ncompatibility path); only the user-scope `~/.config/agents/skills`\n\nis detected today, so project-scope skills are supported but not yet scanned.\n\nWe use GPG signing on the release checksums file to ensure distribution integrity and authenticity.\n\n-\n**Download the release assets:** Download the binary for your platform (e.g.,`agent-scan-<version>-<os>-<arch>`\n\n) and the signed checksums file (`sha256sums.txt.asc`\n\n) from the[GitHub Releases](https://github.com/snyk/agent-scan/releases)page into the same directory. -\n**Verify GPG signature of the checksums file:** Download the[GPG public key](https://github.com/snyk/agent-scan/blob/main/help/_about-this-project/snyk-code-signing-public.pgp)into the same directory, then run:\n\n``` python\ngpg --import snyk-code-signing-public.pgp\ngpg --verify sha256sums.txt.asc\n```\n\nLook for a line in the output saying\n\n`gpg: Good signature from \"Snyk Limited <code-signing@snyk.io>\"`\n\n. -\n**Verify the binary's integrity:** After confirming the signature is valid, check that your downloaded binary matches the checksum:**On Linux (or macOS with**`coreutils`\n\n):\n\n```\ngrep agent-scan-<version>-<os>-<arch> sha256sums.txt.asc | sha256sum -c -\n```\n\n**On macOS (using default**`shasum`\n\n):\n\n```\ngrep agent-scan-<version>-<os>-<arch> sha256sums.txt.asc | shasum -a 256 -c -\n```\n\nThis will output\n\n`agent-scan-<version>-<os>-<arch>: OK`\n\n.\n\nAgent Scan is a security scanning tool to both scan and inspect the supply chain of agent components on your machine. It scans for common security vulnerabilities like prompt injections, tool poisoning, toxic flows, or vulnerabilities in agent skills.\n\nAgent Scan reports scored risk indicators for threats such as prompt injection, exposure to untrusted or private data, destructive capabilities, and malicious agent skills.\n\nAgent Scan operates in two main modes which can be used jointly or separately:\n\n-\n**Scan Mode**: The CLI command`snyk-agent-scan`\n\nscans the current machine for agents and agent components such as skills and MCP servers. Upon completion, it will output a comprehensive report for the user to review. -\n**Background Mode**(MDM). Agent Scan scans the machine in regular intervals in the background, and reports the results to a[Snyk Evo](https://evo.ai.snyk.io)instance. This can be used by security teams to monitor the company-wide agent supply chain in a central location. To set this up, please[contact us](https://evo.ai.snyk.io/#contact-us).\n\nAgent Scan searches through your local agent's configuration files to find agents, skills, and MCP servers. For MCP, it connects to servers and retrieves tool descriptions.\n\n: Scanning an MCP config executes the commands defined in it. Always review what will be executed before approving.⚠️ Security Note\n\nBy default, Agent Scan prompts for user consent before starting each stdio MCP server during interactive runs. This consent flow:\n\n- Shows the server name, command, and environment variables (redacted) that will be executed\n- Allows you to approve or decline each server individually\n- Prevents potentially untrusted servers from running without your explicit permission\n- Records declined servers with a\n`user_declined`\n\nerror (they are never started)\n\n**Best Practices:**\n\n- Review the command and arguments carefully before approving\n- When scanning untrusted or third-party MCP configs, run Agent Scan inside a sandbox (Docker, VM, or disposable environment)\n- Decline any servers with unfamiliar or suspicious commands\n\nFor non-interactive environments (e.g., CI/CD pipelines), you must use the `--dangerously-run-mcp-servers`\n\nflag to bypass the consent prompt and start all servers automatically. **Only use this flag in trusted environments where all MCP server commands have been verified.**\n\nAgent Scan validates discovered components with local checks and the Agent Scan API. It sends the component information needed for analysis, including agent application details, MCP server configurations and signatures, tool names and descriptions, and skill content. Secrets in configuration values and text are redacted before transmission.\n\nBy using Agent Scan, you agree to the Snyk [terms of use for Agent Scan](/snyk/agent-scan/blob/main/TERMS.md).\n\nAgent Scan does not store or log any usage data, i.e. the contents and results of your MCP tool calls.\n\nThe complete flag reference is in [docs/cli-reference.md](/snyk/agent-scan/blob/main/docs/cli-reference.md). Most commands and flags are shared across v0.5.x and v0.6 and later.\n\n```\nsnyk-agent-scan scan [CONFIG_FILE...]       Scan MCP servers and skills (default)\nsnyk-agent-scan inspect [CONFIG_FILE...]    Inspect components without analysis\nsnyk-agent-scan help                        Display help\n```\n\nThese options exist in both v0.5.x and v0.6 and later. Their command applicability is detailed in the full CLI reference.\n\n```\n--storage-file FILE               Path to store scan state (default: ~/.mcp-scan)\n--analysis-url URL                Analysis endpoint; the default API version depends on the CLI version\n--verification-H HEADER           Additional analysis request header (repeatable)\n--mcp-oauth-tokens-path PATH      OAuth tokens for protected remote MCP servers\n--verbose                         Enable detailed logging\n--print-errors                    Show error details and tracebacks\n--print-full-descriptions         Show full entity descriptions without truncation\n--json                            Emit JSON; the response schema depends on the CLI version\n--skip-ssl-verify                 Disable TLS certificate verification\n--skills / --no-skills            Include skills (default) or skip them\n--scan-all-users                  Scan all readable user home directories\n--show-analysis-results           Force synchronous analysis so results display for push-key scans\n--ci                              Exit non-zero when findings or operational failures remain\n--server-timeout SECONDS          MCP connection timeout (default: 10)\n--suppress-mcpserver-io BOOL      Suppress stdio MCP server stderr\n--dangerously-run-mcp-servers     Skip consent and start configured stdio MCP servers\n--control-server URL              Upload destination (repeatable)\n--control-server-H HEADER         Header for the current control-server block\n--control-identifier ID           Identifier for the current control-server block\n--no-bootstrap                    Accepted compatibility no-op; does not change behavior\n--checks-per-server NUM           Accepted compatibility no-op; does not change behavior\n```\n\nWarning\n\nv0.5.x is planned for deprecation. The examples pin v0.5.17 as a concrete v0.5.x release.\n\n```\n--analysis-url URL                Defaults to the 2025-09-02 analysis API\n--ignore-issues-codes CODES       Comma-separated E/W security finding codes and X failure codes to ignore in CI\n```\n\nv0.5.x emits issue-code findings and path-keyed `ScanPathResult`\n\nJSON. See the [v0.5.x CLI reference](/snyk/agent-scan/blob/main/docs/cli-reference.md#agent-scan-v05x) and [issue-code reference](/snyk/agent-scan/blob/main/docs/issue-codes.md).\n\n```\n--analysis-url URL                Defaults to the 2026-07-10 analysis API\n--ignore-risks NAMES              Comma-separated risk names to omit from output and CI evaluation\n--ignore-failure-codes CODES      Comma-separated X codes to omit from CI evaluation\n--show-full-discovery             List every MCP entity and skill file instead of compact scan summaries\n```\n\nv0.6 and later emit scored risk indicators and `scan_path_responses`\n\nJSON. Human-readable scan output is compact by default; `--show-full-discovery`\n\nexpands it without changing JSON or `inspect`\n\noutput. See the [v0.6-and-later CLI reference](/snyk/agent-scan/blob/main/docs/cli-reference.md#agent-scan-v06-and-later), [risk reference](/snyk/agent-scan/blob/main/docs/risks.md), and [failure-code reference](/snyk/agent-scan/blob/main/docs/failure-codes.md).\n\n```\n# Scan all known MCP configs and agent skills\nsnyk-agent-scan\n\n# Scan a specific config file or skill\nsnyk-agent-scan ~/custom/config.json\nsnyk-agent-scan ~/path/to/my/SKILL.md\n\n# Inspect without security analysis\nsnyk-agent-scan inspect\n\n# CI mode\nsnyk-agent-scan --ci --dangerously-run-mcp-servers\n```\n\nThis repository includes a vulnerable MCP server that demonstrates Model Context Protocol security findings that Agent Scan reports.\n\nHow to demo MCP security findings?\n\n- Clone this repository\n- Create an\n`mcp.json`\n\nconfig file in the cloned git repository root directory with the following contents:\n\n```\n{\n  \"mcpServers\": {\n    \"Demo MCP Server\": {\n      \"type\": \"stdio\",\n      \"command\": \"uv\",\n      \"args\": [\"run\", \"mcp\", \"run\", \"demoserver/server.py\"],\n    },\n  },\n}\n```\n\n-\nRun the appropriate version:\n\n- Agent Scan v0.5.x (issue-code output):\n`uvx --python 3.13 snyk-agent-scan@0.5.17 scan mcp.json`\n\n- Agent Scan v0.6 and later (risk-based output):\n`uvx --python 3.13 snyk-agent-scan@latest scan mcp.json`\n\n- Agent Scan v0.5.x (issue-code output):\n\nNote: if you place the `mcp.json`\n\nconfiguration filepath elsewhere then adjust the `args`\n\npath inside the MCP server configuration to reflect the path to the MCP Server (`demoserver/server.py`\n\n) as well as the `uvx`\n\ncommand that runs Agent Scan with the correct filepath to `mcp.json`\n\n.\n\nAgent Scan does not accept external contributions at this time.\n\nWe welcome suggestions, bug reports, or feature requests as GitHub issues.\n\nTo run Agent Scan from source, follow these steps:\n\n```\nuv run pip install -e .\nuv run -m src.agent_scan.cli\n```\n\nIf you want to include Agent Scan results in your own project or registry, please [reach out](https://evo.ai.snyk.io/#contact-us). There are designated APIs for this purpose. Using the standard Agent Scan API for large scale scanning is considered abuse and will result in your account being blocked.\n\n[Documentation index](/snyk/agent-scan/blob/main/docs/README.md)— Versioned documentation for both CLI lines.[CLI reference](/snyk/agent-scan/blob/main/docs/cli-reference.md)— v0.5.x and v0.6-and-later commands, flags, options, and environment variables.[Scanning](/snyk/agent-scan/blob/main/docs/scanning.md)— v0.5.x and v0.6-and-later scanning behavior and examples.[JSON output](/snyk/agent-scan/blob/main/docs/json-output.md)— The v0.5.x path-keyed output and the v0.6 response schema.[Issue Codes](/snyk/agent-scan/blob/main/docs/issue-codes.md)— v0.5.x`E*`\n\nand`W*`\n\nsecurity finding reference.[Risk reference](/snyk/agent-scan/blob/main/docs/risks.md)— v0.6 security risk indicators, scores, and evidence fields.[Failure codes](/snyk/agent-scan/blob/main/docs/failure-codes.md)— v0.6 operational discovery, inspection, and analysis failures.\n\n[Introducing MCP-Scan](https://invariantlabs.ai/blog/introducing-mcp-scan)[MCP Security Notification Tool Poisoning Attacks](https://invariantlabs.ai/blog/mcp-security-notification-tool-poisoning-attacks)[WhatsApp MCP Exploited](https://invariantlabs.ai/blog/whatsapp-mcp-exploited)[MCP Prompt Injection](https://simonwillison.net/2025/Apr/9/mcp-prompt-injection/)[Toxic Flow Analysis](https://invariantlabs.ai/blog/toxic-flow-analysis)[Skills Report](/snyk/agent-scan/blob/main/.github/reports/skills-report.pdf)\n\nSee [CHANGELOG.md](/snyk/agent-scan/blob/main/CHANGELOG.md).", "url": "https://wpnews.pro/news/security-scanner-for-ai-agents-mcp-servers-and-agent-skills", "canonical_source": "https://github.com/snyk/agent-scan/", "published_at": "2026-08-30 15:36:40+00:00", "updated_at": "2026-08-30 15:52:02.219372+00:00", "lang": "en", "topics": ["ai-safety", "ai-tools", "ai-agents"], "entities": ["Snyk", "Agent Scan", "MCP"], "alternates": {"html": "https://wpnews.pro/news/security-scanner-for-ai-agents-mcp-servers-and-agent-skills", "markdown": "https://wpnews.pro/news/security-scanner-for-ai-agents-mcp-servers-and-agent-skills.md", "text": "https://wpnews.pro/news/security-scanner-for-ai-agents-mcp-servers-and-agent-skills.txt", "jsonld": "https://wpnews.pro/news/security-scanner-for-ai-agents-mcp-servers-and-agent-skills.jsonld"}}