Field-by-field comparison

Compare the evidence before choosing an MCP.

Each signal stays separate, missing facts remain visible, and the column order follows your selection.

MCPs in this comparison

Snyk MCPCodebase Memory MCP

Uncheck an MCP to remove it. Comparing two or three keeps each signal in its own row.

Comparable alternatives

Azure MCP ServerMCP100 RecommendedChrome DevTools MCPMCP100 RecommendedContext7 MCPMCP100 RecommendedGrafana Cloud MCPMCP100 RecommendedGoogle MCP Toolbox for DatabasesMCP100 RecommendedPlaywright MCPMCP100 Recommended

Shown only when capability or industry context overlaps.

Side-by-side MCP evidence comparison
Evidence field	Snyk MCPShortlist candidate	Codebase Memory MCPMCP100 Recommended
Task fit
Best for	Run Snyk application-security scans from coding agents with local project access Snyk users who need to run snyk application-security scans from coding agents with local project access.	Repository indexing, symbol search, call-path tracing, impact analysis, and architecture queries across many languages
Not ideal for	The Snyk CLI MCP runs locally because it needs project/file access; scan data can be security-sensitive and may be sent to Snyk services according to the selected product/configuration. This record is the Snyk CLI MCP, not the separate Snyk Evo MCP endpoint.	Tiny repositories, one-off text searches, or semantic questions unsupported by the indexed parsers
Avoid when	The Snyk CLI MCP runs locally because it needs project/file access; scan data can be security-sensitive and may be sent to Snyk services according to the selected product/configuration. This record is the Snyk CLI MCP, not the separate Snyk Evo MCP endpoint.	The source tree cannot be indexed locally or persistent cache files are prohibited
Provenance
Provenance details	First-party MCP Snyk · Publisher source ↗	First-party MCP DeusData · Publisher source ↗
Maintenance
Maintenance details	Repo: Not documented Package: Not documented	Repo: Aug 14, 2026 Package: Aug 14, 2026
Popularity evidence
GitHub stars	Not documented	44,904 GitHub stars · checked 2026-09-25T18:35:00Z
Package downloads / 30 days	No reliable download data	28,000 package downloads / 30 days · checked 2026-08-14T00:00:00.000Z
Shared repository stars	5,684 Shared repository stars (not MCP-specific) · checked 2026-10-20	Not documented
Shared-package downloads / 30 days	2,608,272 shared-package downloads / 30 days (not MCP-specific) · checked 2026-10-20	Not documented
External adoption evidence	Not documented	npm: package downloads: 28,015Exact attributable signal.npm: package downloads · Rolling 30 days · checked 2026-08-14T18:46:26.000ZEvidence source ↗
Client coverage
Client coverage details	Not documented	Claude Code✓ Local stdio Claude Desktop✓ Local stdio Codex✓ Local stdio VS Code✓ Local stdio Cursor✓ Local stdio OpenCode✓ Local stdio
Client coverage note	Local stdio runs on your computer. Streamable HTTP connects to a remotely hosted MCP server.
Access and data
Authentication	Uses Snyk CLI authentication; an existing authenticated Snyk CLI session is sufficient.	local stdio; no remote auth needed
Cost	The MCP is distributed through the Snyk CLI. Snyk offers a Free plan and paid Team/Enterprise plans; scan limits/features depend on the Snyk plan.	none beyond local resources
Permissions	The MCP runs locally because it needs project/file access, and scan access follows the local filesystem/project plus the authenticated Snyk account/product permissions.	reads indexed source/project data; installer writes supported agent/editor configs/hooks
Data handling	Not documented in the reviewed sources. The reviewed Snyk MCP cheat sheet does not define an MCP-specific retention policy. Scan input/results may involve proprietary source, dependency, IaC, container, or SBOM data and use Snyk services according to the selected scan/product.	local processing; current docs state no source/index/query/env/telemetry upload
Limitations
Tradeoffs	First-party evidence confirms the Snyk CLI MCP, local setup, and supported scan families. Exact runtime tool schema/context footprint and exhaustive security review remain unmeasured.	Persistent indexing can reduce repeated reads, but consumes local storage and graph results can become stale until the repository is re-indexed. Version 0.10.8 includes correctness and reliability fixes affecting graph/search results and Windows behavior.
Risk context	The MCP reads local project/security material and may send scan-related data to Snyk services. Findings can reveal vulnerable dependencies, source-code issues, infrastructure configuration and container details.	latest 0.10.x supported; SLSA/Sigstore/checksums/VirusTotal/security policy
Evidence date
Editorial review	2026-10-19	2026-09-23
Candidate evidence	2026-10-20	2026-09-25T18:35:00Z

Popularity, maintenance, fit, permissions, and client support are independent evidence fields.

Read the evidence method →