agent-scan
Security scanner for AI agents, MCP servers and agent skills.
- 3.2k stars
- 293 forks
- 24 open issues
- Language: Python
- License: Apache-2.0
- updated
Install
local · uvx (python)claude mcp add agent-scan -- uvx agent-scan{
"mcpServers": {
"agent-scan": {
"command": "uvx",
"args": ["agent-scan"]
}
}
}{
"mcpServers": {
"agent-scan": {
"command": "uvx",
"args": ["agent-scan"]
}
}
}- Run the command above in your terminal (Claude Code), or paste the JSON config into claude_desktop_config.json (Claude Desktop).
- Replace any <placeholder> values with your API keys or paths.
- Restart Claude. The MCP server and its tools appear automatically.
Package name inferred from the repository name. Verify it exists on PyPI, or clone https://github.com/snyk/agent-scan and follow its README.
Editor's note
Snyk Agent Scan is a Python-based security scanner, distributed via PyPI and usable as an MCP server, that audits agent components installed on a developer's machine for more than 15 distinct vulnerability classes. It auto-discovers configuration files for Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI, Amazon Q, and several other agents, then checks their MCP servers and agent skills for prompt injection, tool poisoning, tool shadowing, toxic flows, hardcoded secrets, malware payloads hidden in natural language, and unsafe credential handling. The tool operates in a scan mode that inspects existing configurations and an inventory mode that catalogs installed components; targeted scans of individual MCP JSON configs or skill Markdown files are also supported. A notable operational caveat is that scanning stdio MCP servers requires actually executing the commands defined in the configuration, so Snyk recommends running the tool inside a Docker container or VM when evaluating untrusted third-party configs. Security engineers, platform teams, and individual developers integrating MCP servers into their Claude or multi-agent workflows are the primary audience.
MCP Servers overview
What people ask about agent-scan
What is snyk/agent-scan?
snyk/agent-scan is mcp servers for the Claude AI ecosystem. Security scanner for AI agents, MCP servers and agent skills. It has 3.2k GitHub stars and its last recorded update is dated 2026-10-23.
How do I install agent-scan?
You can install agent-scan by cloning the repository (https://github.com/snyk/agent-scan) or following the README instructions on GitHub. ClaudeWave also provides quick install blocks on this page.
Is snyk/agent-scan safe to use?
Our security agent has analyzed snyk/agent-scan and assigned a Trust Score of 100/100 (tier: Verified). See the full breakdown of passed checks and flags on this page.
Who maintains snyk/agent-scan?
snyk/agent-scan is maintained by snyk. The last recorded GitHub activity is dated 2026-10-23, with 24 open issues.
Are there alternatives to agent-scan?
Yes. On ClaudeWave you can browse similar mcp servers at /categories/mcp, sorted by popularity or recent activity.