Snyk MCP Server for Claude

Content

Snyk MCP Server is the official local MCP bridge for Snyk Studio. It lets AI development environments call Snyk security tools while working inside a local project, so Claude Code, Codex CLI, Cursor, Gemini CLI, and other MCP-capable clients can scan generated code, dependencies, IaC, containers, SBOM files, and package choices from the assistant workflow.

The strongest fit is secure-at-inception review: ask the assistant to run Snyk scans before declaring generated code complete, use Snyk context to draft fixes, rescan after changes, and keep a human in the loop before committing remediation. Start with the lite profile when you only need source-code and dependency checks, then move to full or experimental only after reviewing the additional tool surface.

Features

• Official Snyk Studio MCP Server documented by Snyk.
• Local stdio MCP server run by the Snyk CLI.
• Claude Code quickstart with installer, npx, direct MCP config, and SSE options.
• Codex CLI quickstart through .codex/config.toml.
• General MCP configuration for clients that do not support the default hooks-based Snyk Studio setup.
• Snyk Studio installer path for Claude Code, Cursor, Codex CLI, and Gemini CLI hooks-based workflows.
• Tool profiles: lite, full, and experimental.
• Stable tools for authentication, logout, version checks, project trust, source-code scanning, open-source dependency scanning, and feedback.
• Full-profile tools for container scanning, IaC scanning, SBOM scanning, AI-BOM creation, and package-health checks.
• Secure-at-inception directives for scanning newly generated first-party code and rescanning after fixes.

Use Cases

• Ask Claude to scan generated source code before marking a task complete.
• Run Snyk Open Source scans against dependency manifests while reviewing a package upgrade or newly added library.
• Review Terraform, Kubernetes, CloudFormation, ARM, or Serverless Framework files with Snyk IaC checks before opening an infrastructure PR.
• Scan a container image or Dockerfile-related dependency surface before release review.
• Analyze an SBOM for known vulnerabilities when validating a supply-chain artifact.
• Ask for package-health context before selecting a new dependency.
• Generate an AI-BOM for a supported Python project when AI model, dataset, and tool inventory is needed.

Installation

Claude Code

Snyk documents an installer-style command for Claude Code:

npx -y snyk@latest mcp configure --tool=claude-cli

For reproducible project configuration, pin the Snyk package version after checking the current Snyk docs and package metadata:

{
  "mcpServers": {
    "Snyk": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "snyk@1.1305.1", "mcp", "-t", "stdio", "--profile=lite"],
      "env": {}
    }
  }
}

Run /mcp in Claude Code to confirm the server and tools are visible, then authenticate the Snyk account and trust the current project directory when prompted.

Codex CLI

Add Snyk to .codex/config.toml:

[mcp_servers.snyk-security]
command = "npx"
args = ["-y", "snyk@1.1305.1", "mcp", "-t", "stdio", "--profile=lite"]

Restart Codex and ask the agent to authenticate the Snyk account or scan the current directory. Snyk notes that the workflow may open a browser confirmation dialog during setup.

Generic MCP config

Snyk's general MCP setup uses npx and stdio:

{
  "mcpServers": {
    "Snyk": {
      "command": "npx",
      "args": ["-y", "snyk@1.1305.1", "mcp", "-t", "stdio"],
      "env": {
        "SNYK_MCP_PROFILE": "lite"
      }
    }
  }
}

If the Snyk CLI is already installed locally, configure the MCP client to run that executable with:

snyk mcp -t stdio

Use the official docs for the exact client-specific config location and keep real authentication material out of committed files.

Tool Profiles

Use profiles to keep the tool surface aligned with the task:

• lite: essential authentication, trust, code scan, dependency scan, version, logout, and feedback tools.
• full: the default stable toolset, adding container, IaC, SBOM, AI-BOM, and package-health tools.
• experimental: full profile plus tools still under evaluation.

Example:

npx -y snyk@1.1305.1 mcp -t stdio --profile=lite

Examples

Secure generated code

Use Snyk MCP to scan the first-party code changed in this task before you mark it complete. Show findings and proposed fixes before editing.

Dependency review

Run a Snyk Open Source scan for this package manifest and summarize dependency vulnerabilities, license issues, and the safest upgrade path.

IaC review

Use Snyk MCP to scan the Terraform and Kubernetes files changed in this branch. Keep the result read-only and list each finding with file context.

Package selection

Before adding this dependency, use Snyk package health checks and explain the security and maintenance tradeoffs.

Source Notes

• Snyk's Agentic security with Snyk Studio overview describes Snyk Studio as a connection between the Snyk platform, development environment, AI tools, directives, and a local Snyk MCP Server.
• Snyk's getting-started guide states that the Snyk MCP Server is designed as a local server that runs through the Snyk CLI, and that Snyk does not offer a hosted remote MCP server.
• Snyk's Codex CLI guide documents .codex/config.toml setup using npx -y snyk@latest mcp -t stdio.
• Snyk's Claude Code guide documents npx -y snyk@latest mcp configure --tool=claude-cli, alternate MCP configuration, authentication, project trust, and secure-at-inception directives.
• Snyk's docs list MCP tools including snyk_sca_scan, snyk_code_scan, snyk_iac_scan, snyk_container_scan, snyk_sbom_scan, snyk_aibom, snyk_trust, snyk_auth, snyk_logout, snyk_version, snyk_send_feedback, and snyk_package_health_check.
• The npm package metadata checked at submission time showed snyk@1.1305.1 with MCP package name io.snyk/mcp and repository redirect target https://github.com/snyk/cli.

Duplicate Check

Checked current upstream/main, open PR titles, open PR changed files, source URLs, and content files for Snyk MCP, Snyk Studio, snyk-mcp-server, snyk@latest mcp, snyk_code_scan, snyk_sca_scan, docs.snyk.io/evo-by-snyk/agentic-security-with-snyk-studio, and related title variants. Existing security hooks, rules, and scanner entries mention Snyk only as a possible security tool or dependency scanner. No dedicated Snyk MCP Server entry, Snyk Studio source URL duplicate, or open content PR for this server was found.

Editorial Disclosure

Snyk is a commercial security platform, but this listing is not sponsored, paid, affiliate-backed, or submitted by Snyk. Use Snyk's current docs, package metadata, account permissions, privacy terms, and organization policies as the source of truth before connecting a local codebase to any AI client.