# snyk/studio-mcp [Health: Active]

**Category:** 🔒 Security  
**Repository:** https://github.com/snyk/studio-mcp  
**GitHub Stars:** 58  
**Views:** 1  
**Installs:** 0  
**Upvotes:** 0  
**Directory Page:** https://allmcps.com/mcp/snyk-studio-mcp

## Description
Embeds Snyk's security engines into agentic workflows. Secures AI-generated code in real-time and accelerates the fixing vulnerability backlogs.

## Claude Desktop Quick Installation
No confirmed install details yet, so no config is published. Follow the setup steps in the repository above.

## Documentation

## What snyk/studio-mcp does

snyk/studio-mcp brings Snyk’s security scanning capabilities into MCP-compatible agentic tools. It is delivered as part of the Snyk CLI and lets an MCP-enabled environment invoke scans and receive their results without leaving the agent workflow.

The server covers several security analysis areas: open-source dependency risk, source-code vulnerabilities, infrastructure-as-code issues, container vulnerabilities, SBOM file analysis, and exposed secrets. It also provides package health and security assessment, AIBOM creation, authentication state management, folder trust, and version information.

## How it works

An MCP-enabled application uses the `snyk mcp` CLI command to interact with Snyk in the current MCP context. Scan tools start the corresponding Snyk CLI security operation, while result retrieval makes the findings available to the connected tool or environment.

The available scan operations are represented by named MCP tools:

- `snyk_sca_scan` checks open-source dependencies.
- `snyk_code_scan` analyzes source code.
- `snyk_iac_scan` checks infrastructure-as-code.
- `snyk_container_scan` analyzes containers.
- `snyk_sbom_scan` scans an SBOM file.
- `snyk_secret_scan` detects secrets.

Supporting tools include `snyk_aibom`, `snyk_package_health_check`, `snyk_trust`, `snyk_auth`, `snyk_logout`, `snyk_auth_status`, and `snyk_version`.

## Setup and configuration

Use the `snyk mcp` command from the Snyk CLI to expose Snyk capabilities to an MCP-supporting application. The Snyk MCP installation, configuration, and startup process is covered in Snyk’s Studio agentic integration quickstart documentation.

Authentication is available through the MCP interface with `snyk_auth`, while `snyk_auth_status` checks the current state and `snyk_logout` ends the session. The `snyk_trust` tool can trust a folder before a scan is run.

## Tools and capabilities

The server supports security checks across dependencies, code, IaC, containers, SBOMs, and secrets. It can also create an AIBOM and assess package health and security. These operations allow an agent to request targeted Snyk analysis as part of an AI-assisted coding workflow and inspect the resulting security findings.

Running `snyk_sca_scan` can invoke third-party ecosystem tooling on the local machine to build a project’s dependency tree. Examples include Gradle and Maven, which may fetch dependency data during the scan.

_Full upstream README: https://allmcps.com/mcp/snyk-studio-mcp/readme_