MCP100 verdict
Not currently recommended. First-party evidence supports Shortlist admission; this is not a Recommended-tier security certification.
MCP100 Assessment
Editorial verdict
Reviewed October 19, 2026
Task Fit
Mapped
Specialized workflows
Trust
Status warning
First-party evidence confirms the Snyk CLI MCP, local setup, and supported scan families. Exact runtime tool schema/context footprint and exhaustive security review remain unmeasured.
Maintenance
Date unavailable
No dated repository or package update is currently stored.
Popularity
Signals unavailable
No independently comparable adoption metric is currently stored.
Evidence scope
5.7k shared-repository stars · not MCP-specific
2.6M shared-package downloads / 30 days · not MCP-specific
Repository identity: snyk/cli
Package identity: snyk · version 1.1308.1
Stars observed October 20, 2026 · Downloads observed October 20, 2026
Snyk MCP is implemented as a capability of the broader Snyk CLI. CLI repository stars are shared product/CLI evidence and not MCP-specific.
The `snyk` package is the full Snyk CLI, which includes MCP support. Its downloads measure the entire CLI and are not MCP-specific.
Publisher activity observed October 20, 2026
Current source snapshot
Source relationship: First-party MCP
Reviewed October 19, 2026
Evidence-backed setup
Choose your MCP client. A client connects to the MCP server; the language model is selected inside that client. Only stored, source-backed configurations are shown.
Transport not recorded
Complete client-specific setup, verification and removal are not documented in this reviewed source.
Publisher-documented setup is not the same as MCP100 execution testing. “MCP100 logic checked” means the stored configuration shape was reviewed, not that third-party MCP software was run.
Evidence checked 2026-10-20
Type-appropriate, source-backed setup for this mcp server profile.
{"command":"snyk","args":["mcp","-t","stdio"]}Capability
Snyk MCP is a first-party MCP for run snyk application-security scans from coding agents with local project access. Authentication/setup: Snyk CLI authentication. The Snyk CLI MCP runs locally because it needs project/file access; scan data can be security-sensitive and may be sent to Snyk services according to the selected product/configuration. This record is the Snyk CLI MCP, not the separate Snyk Evo MCP endpoint.
Current Snyk official documentation enumerates 11 MCP tools.
Not measured yet
Estimated token footprint of the MCP tool schemas exposed to the agent.
Reviewed access
Related reviewed MCPs
Codebase knowledge graph for AI agents — 159 languages, sub-ms queries, 99% fewer tokens.
Choose this instead if
Choose Codebase Memory MCP instead if repository indexing, symbol search, call-path tracing, impact analysis, and architecture queries across many languages.
Recommended after reviewed 2026-09-25 admission dossier: all_current_selected_gates_pass.
Connect compatible AI clients to HashiCorp's documented MCP capabilities.
Choose this instead if
Choose Terraform MCP instead if connect compatible AI clients to HashiCorp's documented MCP capabilities.
Recommended after reviewed Batch 1 correction: exact 61-tool contract closes the prior formal Recommended gap.
Connect agents to Azure resources and more than forty Azure services.
Choose this instead if
Choose Azure MCP Server instead if discovering and inspecting resources across supported Azure services.
Connect agents to Azure resources and more than forty Azure services.
Snyk is listed as First-party MCP in MCP100’s current evidence.
Current official resources:
Original product, capability, tool, and usage documentation from the MCP publisher. Installation sections appear under Install & Agents.
This repository provides integration wrappers that enable AI coding assistants to leverage Snyk's security platform capabilities through the Model Context Protocol (MCP).
The wrappers in this repository allow agentic AI systems (AI coding assistants) to perform security scanning on code, dependencies, infrastructure, and containers using Snyk's comprehensive security platform. This enables AI assistants to proactively identify and fix security vulnerabilities during code generation and review.
manifest.jsonbuild-mcpb.sh - Creates a .mcpb file for distributiongemini-extension.jsonserver.jsonsnyk.io)Through these integrations, AI assistants gain access to:
All integrations use the Snyk CLI's MCP server capability (snyk mcp -t stdio), which exposes Snyk's security tools through the Model Context Protocol. The AI assistant can invoke Snyk scans during code generation, review, and security analysis workflows.
The repository uses an automated GitHub Actions workflow (build-and-release.yml) that:
repository_dispatch or manual workflow_dispatch).mcpb file) using build-mcpb.shThis repository is closed to public contributions.