Snyk Language Server (Snyk-LS)

Supported features

The language server follows the Language Server Protocol and integrates with Snyk Open Source, Snyk Infrastructure as Code, Snyk Code, and Snyk Secrets. For Open Source and IaC it uses the Snyk CLI as a data provider; Snyk Code uses the Snyk Code API; Secrets scanning uses the CLI where applicable.

Right now the language server supports the following actions:

• Send diagnostics to client on opening a document if it's part of the current set of folders.
• Starting a folder scan on startup and sending diagnostics.
• Starting a workspace scan of all folders on command.
• Cache diagnostics until saving or triggering a new workspace scan.
• Invalidate caches on saving a document and retrieve saved document diagnostics anew.
• Provides range calculation to correctly highlight Snyk Open Source issues in their file.
• Provides formatted hovers with diagnostic details and follow-up links
• Progress reporting to the client for background jobs
• Notifications & Log messages to the client
• Authentication when needed, using OAuth2 or Token authentication and opening a webpage if necessary
• Copying the authentication URL to clipboard if there are problems opening a webpage
• Automatic download of the Snyk CLI if none is found or configured to XDG_DATA_HOME
• Selective activation of products according to settings transmitted
• Scanning errors are reported as diagnostics to the Language Server Client
• Code Lenses to navigate the Snyk Code dataflow from within the editor
• Code Actions for in-editor commands, like opening a browser, doing a quickfix or opening a Snyk Learn lesson for the found diagnostic

Implemented operations

Language Server Protocol support

Requests

• initialize
• exit
• textDocument/codeAction
• textDocument/codeLens
• textDocument/didClose
• textDocument/didSave
• textDocument/hover
• textDocument/inlineValue
• shutdown
• workspace/didChangeWorkspaceFolders
• workspace/didChangeConfiguration
• workspace/executeCommand
• window/workDoneProgress/create (from server -> client)
• window/showMessageRequest
• window/showDocument

Notifications

• $/progress

• $/cancelRequest

• textDocument/publishDiagnostics

  • params: types.PublishDiagnosticsParams
  • example: Snyk Open Source
  JSON Config

  Copy

  {
    "uri": "file:///path/to/file",
    "diagnostics": [
      {
        "range": {
          "start": { "line": 1, "character": 0 },
          "end": { "line": 2, "character": 0 },
        },
        "severity": 1,
        "code": "S100",
        "source": "Snyk",
        "message": "Message",
        "tags": ["security"],
        "data": {
          "id": "123",
          "issueType": "vulnerability",
          "packageName": "packageName",
          "packageVersion": "packageVersion",
          "issue": "issue",
          "additionalData": {
            "ruleId": "ruleId",
            "identifiers": {
              "cwe": ["cwe"],
              "cve": ["cve"]
            },
            "description": "description",
            "language": "language",
            "packageManager": "packageManager",
            "packageName": "packageName"
          }
        }
      }
    ]
  }
  

  • example: Snyk Code
  JSON Config

  Copy

  {
    "uri": "file:///path/to/file",
    "diagnostics": [
      {
        "range": {
          "start": { "line": 1, "character": 0 },
          "end": { "line": 2, "character": 0 },
        },
        "severity": 1,
        "code": "S100",
        "source": "Snyk",
        "message": "Message",
        "tags": ["security"],
        "data": {
          "id": "123",
          "filePath": "filePath",
          "range": {
            "start": { "line": 1, "character": 0 },
            "end": { "line": 2, "character": 0 },
          },
          "additionalData": {
            "message": "message",
            "rule": "rule",
            "ruleId": "ruleId",
            "dataFlow": [
              {
                "filePath": "filePath",
                "range": {
                  "start": { "line": 1, "character": 0 },
                  "end": { "line": 2, "character": 0 },
                },
              }
            ],
            "cwe": "cwe",
            "isSecurityType": true
          }
        }
      }
    ]
  }
  

• window/logMessage

• window/showMessage

Custom additions to Language Server Protocol (server -> client)

• SDKs callback to retrieve configured SDKs from the client

  • method: workspace/snyk.sdks
  • params: types.WorkspaceFolder
  • example:
  json5

  Copy

  [{
    "type": "java", // or python or go
    "path": "/path/to/sdk" // JAVA_HOME for java, GOROOT for Go, Python executable for Python
  }]
  

• Configuration Notification (protocol v25+)

  • method: $/snyk.configuration
  • params: types.LspConfigurationParam
  • note: unified map-based protocol — global settings + per-folder settings, each carrying value, source, origin, and lock status
  • example:
  JSON Config

  Copy

  {
      "settings": {
          "api_endpoint": { "value": "https://api.snyk.io", "source": "global" },
          "snyk_oss_enabled": { "value": true, "source": "ldx-sync", "originScope": "organization" },
          "proxy_http": { "value": "http://proxy:8080", "source": "ldx-sync-locked", "originScope": "tenant", "isLocked": true }
      },
      "folderConfigs": [
        {
          "folderPath": "/path/to/project",
          "settings": {
              "base_branch": { "value": "main", "source": "folder" },
              "preferred_org": { "value": "org-id", "source": "folder" },
              "snyk_code_enabled": { "value": false, "source": "ldx-sync-locked", "originScope": "group", "isLocked": true },
              "severity_filter_critical": { "value": true, "source": "ldx-sync", "originScope": "organization" },
              "severity_filter_high": { "value": true, "source": "ldx-sync", "originScope": "organization" },
              "severity_filter_medium": { "value": false, "source": "ldx-sync", "originScope": "organization" },
              "severity_filter_low": { "value": false, "source": "ldx-sync", "originScope": "organization" }
          }
        }
      ]
  }
  

  • IDE→LS uses changed: true for PATCH semantics: {"snyk_oss_enabled": {"value": true, "changed": true}}

• Custom Publish Diagnostics Notification

  • method: $/snyk.publishDiagnostics316
  • params: types.PublishDiagnosticsParams
  • note: alias for textDocument/publishDiagnostics

• Authentication Notification

  • method: $/snyk.hasAuthenticated
  • params: types.AuthenticationParams
  • example:
  JSON Config

  Copy

  {
    "token": "the snyk token", // this can be an oauth2.Token string or a legacy token
    "apiUrl": "https://api.snyk.io"
  }
  

  • See https://pkg.go.dev/golang.org/x/oauth2@v0.6.0#Token for more details regarding oauth tokens.

• CLI Path Notification

  • method: $/snyk.isAvailableCli
  • params: types.SnykIsAvailableCli
  • example:
  JSON Config

  Copy

  {
    "cliPath": "/a/path/to/cli-executable"
  }
  

• Trusted Folder Notification

  • method: $/snyk.addTrustedFolders
  • params: types.SnykTrustedFoldersParams
  • example:
  JSON Config

  Copy

  {
    "trustedFolders": ["/a/path/to/trust"]
  }
  

• Scan Notification

  • method: $/snyk.scan
  • params: types.ScanParams
  • example: Successful scan
  JSON Config

  Copy

  {
    "status": "success", // possible values: "error", "inProgress", "success"
    "product": "code", // possible values: "code", "oss", "iac", "secrets"
    "folderPath": "/a/path/to/folder",
  }
  

  • example: Failed scan with errors
  JSON Config

  Copy

  {
    "status": "error",
    "product": "code",
    "folderPath": "/a/path/to/folder",
    "presentableError": {
      "cliError": {
        "code": "CLI_ERROR_CODE",
        "error": "An error occurred"
      },
      "showNotification": true,
      "treeNodeSuffixError": "(failed)"
    }
  }
  

• Summary Panel Status Notification

  • method: $/snyk.scanSummary
  • params: types.ScanSummary
  • example:
  JSON Config

  Copy

  {
    "scanSummary": "<html><body<p> Summary </p></body></html>"
  }
  

• Register MCP Notification

  • method: $/snyk.registerMcp
  • params: types.SnykRegisterMcpParams
  • example:
  JSON Config

  Copy

    {
      "command": "/path/to/cli",
      "args": [ "mcp", "-t", "stdio" ],
      "env": {
        "ENV1": "value1",
        "ENV2": "value2"
      }
    }
  

Commands