agent-scan

Snyk Agent Scan is a Python-based security scanner, distributed via PyPI and usable as an MCP server, that audits agent components installed on a developer's machine for more than 15 distinct vulnerability classes. It auto-discovers configuration files for Claude Desktop, Claude Code, Cursor, VS Code, Windsurf, Gemini CLI, Amazon Q, and several other agents, then checks their MCP servers and agent skills for prompt injection, tool poisoning, tool shadowing, toxic flows, hardcoded secrets, malware payloads hidden in natural language, and unsafe credential handling. The tool operates in a scan mode that inspects existing configurations and an inventory mode that catalogs installed components; targeted scans of individual MCP JSON configs or skill Markdown files are also supported. A notable operational caveat is that scanning stdio MCP servers requires actually executing the commands defined in the configuration, so Snyk recommends running the tool inside a Docker container or VM when evaluating untrusted third-party configs. Security engineers, platform teams, and individual developers integrating MCP servers into their Claude or multi-agent workflows are the primary audience.

Lo que la gente pregunta sobre agent-scan