CODE SECURITY / Snyk
Snyk Studio MCP
Invoke Snyk source, dependency, configuration and package-health checks through its CLI-integrated MCP server.
“You can integrate Snyk MCP into MCP-supporting tools to provide Snyk security context.”
01 / THE REASONING
Why this made the selection.
- Brings dependency and package-health investigation together with source and configuration scans.
- Tool profiles (lite, full, experimental) select which tools load, and the dependency scan refuses an untrusted folder until snyk_trust has run.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- README.md, LICENSE, go.mod, pkg/mcp/main.go, internal/mcp/profiles.go, internal/mcp/tools.go and internal/mcp/snyk_tools.json at c85d2d3f0d00600af22dbb63cae852e0de9b476e.
- Snyk's Codex guide, read 2026-10-13 at its current address (the old docs path redirects there).
Our findings
- The implementation is Go inside the Snyk CLI integration; the npm package is a distribution route.
- The default full profile loads all 14 tools defined in snyk_tools.json; the lite profile loads 7 (snyk_auth, snyk_sca_scan, snyk_code_scan, snyk_version, snyk_logout, snyk_trust, snyk_send_feedback). The profile comes from -p/--profile or SNYK_MCP_PROFILE.
- Only the dependency scan (snyk_sca_scan) and snyk_aibom check folder trust; the other tools set ignoreTrust. The record said scan handlers check folder trust in general until 2026-10-13, which overstated it.
- The README lists snyk_auth_status; snyk_tools.json at this commit defines no tool of that name, and defines snyk_send_feedback and snyk_breakability_check, which the README does not list.
- pkg/mcp/main.go registers one transport flag, -t, defaulting to stdio. Since the previous pin the only change is in the auth tool: it now leaves stored credentials in place when Snyk cannot be reached.
Not established by this review
- Server launch, authenticated tool calls, and release-to-source parity were not tested.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Connect a server deliberately.
- Follow the client guide; for Codex it configures npx with args -y, snyk@latest, mcp, -t, stdio. Neither the README nor the guide gives that as a one-line command, so none is shown. It was not run.
- Authenticate the intended Snyk account and approve trust for only the project you intend to scan.
- Choose an appropriate tool profile and review scans that invoke build-system dependency resolution.
Before you start
- Snyk CLI, or Node.js/npx for the documented package launcher.
- A Snyk account and any required scanner entitlements; applicable project build tools.
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://raw.githubusercontent.com/snyk/studio-mcp/c85d2d3f0d00600af22dbb63cae852e0de9b476e/README.md
Supports: summary, upstreamDescription, whySelected, bestFor, limitations, install, access, compatibility, transports, review
https://docs.snyk.io/agent-security/agentic-security-with-snyk-studio/quickstart-guides/codex-cli-guide
Supports: install, compatibility, access, review, limitations
https://raw.githubusercontent.com/snyk/studio-mcp/c85d2d3f0d00600af22dbb63cae852e0de9b476e/go.mod
Supports: language
- Snyk CLI MCP integration ↗Checked
https://raw.githubusercontent.com/snyk/studio-mcp/c85d2d3f0d00600af22dbb63cae852e0de9b476e/pkg/mcp/main.go
Supports: review, transports
https://raw.githubusercontent.com/snyk/studio-mcp/c85d2d3f0d00600af22dbb63cae852e0de9b476e/internal/mcp/profiles.go
Supports: review, limitations, install
https://raw.githubusercontent.com/snyk/studio-mcp/c85d2d3f0d00600af22dbb63cae852e0de9b476e/internal/mcp/tools.go
Supports: review, access
https://raw.githubusercontent.com/snyk/studio-mcp/c85d2d3f0d00600af22dbb63cae852e0de9b476e/internal/mcp/snyk_tools.json
Supports: summary, whySelected, bestFor, access, review
https://raw.githubusercontent.com/snyk/studio-mcp/c85d2d3f0d00600af22dbb63cae852e0de9b476e/LICENSE
Supports: license