[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"project-72491":3},{"id":4,"name":5,"fullName":6,"owner":7,"repo":5,"description":8,"homepage":9,"htmlUrl":10,"language":11,"languages":10,"totalLinesOfCode":10,"stars":12,"forks":13,"watchers":14,"openIssues":15,"contributorsCount":16,"subscribersCount":16,"size":16,"stars1d":14,"stars7d":17,"stars30d":18,"stars90d":16,"forks30d":16,"starsTrendScore":19,"compositeScore":20,"rankGlobal":10,"rankLanguage":10,"license":21,"archived":22,"fork":22,"defaultBranch":23,"hasWiki":22,"hasPages":22,"topics":24,"createdAt":10,"pushedAt":10,"updatedAt":30,"readmeContent":31,"aiSummary":32,"trendingCount":16,"starSnapshotCount":16,"syncStatus":33,"lastSyncTime":34,"discoverSource":35},72491,"agent-scan","snyk\u002Fagent-scan","snyk","Security scanner for AI agents, MCP servers and agent skills.","",null,"Python",2548,230,14,19,0,44,165,42,29.09,"Apache License 2.0",false,"main",[25,26,27,28,29],"agent","ai","mcp","modelcontextprotocol","security","2026-06-12 02:03:03","\u003Cp align=\"center\">\n  \u003Ch1 align=\"center\">\n  Snyk Agent Scan\n  \u003C\u002Fh1>\n\u003C\u002Fp>\n\n\u003Cp align=\"center\">\n  Discover and scan agent components on your machine for prompt injections\u003Cbr\u002F>\n  and vulnerabilities (including agents, MCP servers, skills).\n\u003C\u002Fp>\n\n> **NEW** Read our [technical report on the emerging threats of the agent skill eco-system](.github\u002Freports\u002Fskills-report.pdf) published together with Agent Scan 0.4, which adds support for scanning agent skills.\n\n\u003Cp align=\"center\">\n  \u003Ca href=\"https:\u002F\u002Fpypi.python.org\u002Fpypi\u002Fsnyk-agent-scan\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fpypi\u002Fv\u002Fsnyk-agent-scan.svg\" alt=\"snyk-agent-scan\"\u002F>\u003C\u002Fa>\n  \u003Ca href=\"https:\u002F\u002Fpypi.python.org\u002Fpypi\u002Fsnyk-agent-scan\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fpypi\u002Fl\u002Fsnyk-agent-scan.svg\" alt=\"snyk-agent-scan license\"\u002F>\u003C\u002Fa>\n  \u003Ca href=\"https:\u002F\u002Fpypi.python.org\u002Fpypi\u002Fsnyk-agent-scan\">\u003Cimg src=\"https:\u002F\u002Fimg.shields.io\u002Fpypi\u002Fpyversions\u002Fsnyk-agent-scan.svg\" alt=\"snyk-agent-scan python version requirements\"\u002F>\u003C\u002Fa>\n\u003C\u002Fp>\n\n\u003Cdiv align=\"center\">\n  \u003Cimg width=\"1304\" height=\"976\" alt=\"agent-scan-pretty\" src=\"https:\u002F\u002Fgithub.com\u002Fuser-attachments\u002Fassets\u002F49c32115-703c-465f-bb09-1b6bae852253\" \u002F>\n\u003C\u002Fdiv>\n\n\u003Cbr>\n\nAgent Scan helps you keep an inventory of all your installed agent components (harnesses, MCP servers, and skills) and scans them for common threats like prompt injections, sensitive data handling, or malware payloads hidden in natural language. Ignore analysis on skills by using `--no-skills`.\n\n## Security Warning\n\n> **⚠️ IMPORTANT: Scanning MCP configurations will execute the commands defined in them.**\n>\n> When Agent Scan scans an MCP configuration file, it starts the stdio MCP servers by executing the commands and arguments specified in the config. This is necessary to retrieve tool descriptions and perform security analysis.\n>\n> **Recommendations:**\n> - **Run scans inside a sandbox** (Docker container, VM, or disposable environment) when evaluating untrusted or third-party MCP configs\n> - **Review the consent prompt carefully** during interactive scans, it shows the exact command and arguments that will be executed for each server\n> - **Use `--dangerously-run-mcp-servers`** only in trusted environments where you've verified all MCP server commands\n>\n> By default, Agent Scan requires explicit user consent (y\u002Fn) before starting each stdio MCP server during interactive runs. This gives you control over what gets executed on your system.\n\n## Highlights\n\n- Auto-discover MCP configurations, agent tools, skills\n- Scanning of Claude, Cursor, Windsurf, Gemini CLI, Amp, Amazon Q, and other agents.\n- Detects [15+ distinct security risks](docs\u002Fissue-codes.md) across MCP servers and agent skills:\n  - MCP: [Prompt Injection](docs\u002Fissue-codes.md#E001), [Tool Poisoning](docs\u002Fissue-codes.md#E001), [Tool Shadowing](docs\u002Fissue-codes.md#E002), [Toxic Flows](docs\u002Fissue-codes.md#ToxicFlows)\n  - Skills: [Prompt Injection](docs\u002Fissue-codes.md#E004), [Malware Payloads](docs\u002Fissue-codes.md#E006), [Untrusted Content](docs\u002Fissue-codes.md#W011), [Credential Handling](docs\u002Fissue-codes.md#W007), [Hardcoded Secrets](docs\u002Fissue-codes.md#W008)\n\n## Supported agents and capabilities\n\nAgent Scan auto-discovers agents and their capabilities (MCP servers or skills) when their install paths exist. The table reflects [well-known agent definitions](src\u002Fagent_scan\u002Fwell_known_clients.py).\n\n- **✓**: at least one path is defined for that capability.\n- **✗**: the agent is listed for that OS but has no paths for that capability.\n- **—**: that agent is not included for that OS.\n- **Skills** Skills can be ignored by using `--no-skills`\n\n| Agent | macOS MCP | macOS Skills | Linux MCP | Linux Skills | Windows MCP | Windows Skills |\n| --- | :---: | :---: | :---: | :---: | :---: | :---: |\n| Windsurf | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| Cursor | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| VS Code | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| Claude Desktop | ✓ | ✗ | — | — | ✓ | ✗ |\n| Claude Code | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| Gemini CLI | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |\n| OpenClaw | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ |\n| Amp | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ |\n| Kiro | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ |\n| OpenCode | ✗ | ✗ | ✗ | ✗ | ✗ | ✗ |\n| Antigravity | ✓ | ✗ | ✓ | ✗ | ✓ | ✗ |\n| Codex | ✗ | ✓ | ✗ | ✓ | — | — |\n| Amazon Q | ✓ | ✗ | ✓ | ✗ | ✓ (WSL) | ✗ |\n\n## Quick Start\n\nTo get started:\n\n1. **Sign up at [Snyk](https:\u002F\u002Fsnyk.io)** and get an API token from [https:\u002F\u002Fapp.snyk.io\u002Faccount](https:\u002F\u002Fapp.snyk.io\u002Faccount) (API Token → KEY → click to show).\n2. **Set the token as an environment variable** before running any scan:\n   ```bash\n   export SNYK_TOKEN=your-api-token-here\n   ```\n3. Have [uv](https:\u002F\u002Fdocs.astral.sh\u002Fuv\u002Fgetting-started\u002Finstallation\u002F) installed on your system.\n\n### Scanning\n\nTo run a full scan of your machine (auto-discovers agents, MCP servers, skills), run:\n\n```bash\nuvx snyk-agent-scan@latest\n```\n\n\nThis will scan for security vulnerabilities in MCP servers, tools, prompts, and resources. It will automatically discover a variety of agent configurations, including Claude Code\u002FDesktop, Cursor, Gemini CLI, and Windsurf.\n\n```bash\nuvx snyk-agent-scan@latest\n```\n\nYou can also scan particular MCP configuration files or skills:\n\n```bash\n# scan a specific mcp configuration\nuvx snyk-agent-scan@latest ~\u002F.vscode\u002Fmcp.json\n# scan a single agent skill\nuvx snyk-agent-scan@latest ~\u002Fpath\u002Fto\u002Fmy\u002FSKILL.md\n# scan all claude skills\nuvx snyk-agent-scan@latest ~\u002F.claude\u002Fskills\n```\n\n#### Example Run\n\n[![Agent Scan security vulnerabilities demo](demo.svg)](https:\u002F\u002Fasciinema.org\u002Fa\u002F716858)\n\n## Scanner Capabilities\n\nAgent Scan is a security scanning tool to both scan and inspect the supply chain of agent components on your machine. It scans for common security vulnerabilities like prompt injections, tool poisoning, toxic flows, or vulnerabilities in agent skills.\n\nAgent Scan operates in two main modes which can be used jointly or separately:\n\n1. **Scan Mode**: The CLI command `snyk-agent-scan` scans the current machine for agents and agent components such as skills and MCP servers. Upon completion, it will output a comprehensive report for the user to review.\n\n2. **Background Mode** (MDM, Crowdstrike). Agent Scan scans the machine in regular intervals in the background, and reports the results to a [Snyk Evo](https:\u002F\u002Fevo.ai.snyk.io) instance. This can be used by security teams to monitor the company-wide agent supply chain in a central location. To set this up, please [contact us](https:\u002F\u002Fevo.ai.snyk.io\u002F#contact-us).\n\n## How It Works\n\n### Scanning\n\nAgent Scan searches through your local agent's configuration files to find agents, skills, and MCP servers. For MCP, it connects to servers and retrieves tool descriptions.\n\n#### Interactive Consent for MCP Servers\n\n> **⚠️ Security Note**: Scanning an MCP config executes the commands defined in it. Always review what will be executed before approving.\n\nBy default, Agent Scan prompts for user consent before starting each stdio MCP server during interactive runs. This consent flow:\n\n- Shows the server name, command, and environment variables (redacted) that will be executed\n- Allows you to approve or decline each server individually\n- Prevents potentially untrusted servers from running without your explicit permission\n- Records declined servers with a `user_declined` error (they are never started)\n\n**Best Practices:**\n- Review the command and arguments carefully before approving\n- When scanning untrusted or third-party MCP configs, run Agent Scan inside a sandbox (Docker, VM, or disposable environment)\n- Decline any servers with unfamiliar or suspicious commands\n\nFor non-interactive environments (e.g., CI\u002FCD pipelines), you must use the `--dangerously-run-mcp-servers` flag to bypass the consent prompt and start all servers automatically. **Only use this flag in trusted environments where all MCP server commands have been verified.**\n\n#### Analysis and Validation\n\nAgent Scan validates the components, both with local checks and by invoking the Agent Scan API. For this, skills, agent applications, tool names, and descriptions are shared with Snyk. By using Agent Scan, you agree to the Snyk [terms of use for Agent Scan](.\u002FTERMS.md).\n\nAgent Scan does not store or log any usage data, i.e. the contents and results of your MCP tool calls.\n\n## CLI Parameters\n\nAgent Scan provides the following commands:\n\n```\nsnyk-agent-scan - Security scanner for agents, MCP servers, and skills\n```\n\n### Common Options\n\nThese options are available for all commands:\n\n```\n--storage-file FILE    Path to store scan results and scanner state (default: ~\u002F.mcp-scan)\n--base-url URL         Base URL for the verification server\n--verbose              Enable detailed logging output\n--print-errors         Show error details and tracebacks\n--json                 Output results in JSON format instead of rich text\n```\n\n### Commands\n\n#### scan (default)\n\nScan MCP configurations for security vulnerabilities in tools, prompts, and resources.\n\n```\nsnyk-agent-scan scan [CONFIG_FILE...]\n```\n\nOptions:\n\n```\n--checks-per-server NUM           Number of checks to perform on each server (default: 1)\n--server-timeout SECONDS          Seconds to wait before timing out server connections (default: 10)\n--suppress-mcpserver-io BOOL      Suppress stderr from stdio MCP servers (stdout carries the JSON-RPC protocol\n                                  and is never shown). Default: False for interactive runs (stderr is streamed\n                                  with a [server-name] prefix), True otherwise.\n--dangerously-run-mcp-servers     ⚠️ DANGER: Skip the interactive consent prompt and automatically start every\n                                  stdio MCP server listed in the scanned configs. Only use in trusted\n                                  environments where you've verified all MCP server commands.\n--no-skills                       Skip analysis on skills.\n```\n\n#### inspect\n\nPrint descriptions of tools, prompts, and resources without verification.\n\n```\nsnyk-agent-scan inspect [CONFIG_FILE...]\n```\n\nOptions:\n\n```\n--server-timeout SECONDS          Seconds to wait before timing out server connections (default: 10)\n--suppress-mcpserver-io BOOL      Suppress stderr from stdio MCP servers (stdout carries the JSON-RPC protocol\n                                  and is never shown). Default: False for interactive runs (stderr is streamed\n                                  with a [server-name] prefix), True otherwise.\n--dangerously-run-mcp-servers     ⚠️ DANGER: Skip the interactive consent prompt and automatically start every\n                                  stdio MCP server listed in the scanned configs. Only use in trusted\n                                  environments where you've verified all MCP server commands.\n```\n\n#### help\n\nDisplay detailed help information and examples.\n\n```bash\nsnyk-agent-scan help\n```\n\n### Examples\n\n```bash\n# Scan all known MCP configs and agent skills\nsnyk-agent-scan\n\n# Scan a specific config file\nsnyk-agent-scan ~\u002Fcustom\u002Fconfig.json\n\n# Scan a specific skill file\nsnyk-agent-scan ~\u002Fpath\u002Fto\u002Fmy\u002FSKILL.md\n\n# Scan a directory for skills\nsnyk-agent-scan ~\u002F.claude\u002Fskills\n\n# Just inspect tools without verification\nsnyk-agent-scan inspect\n\n# Skip consent prompts and run all servers (ONLY for CI\u002FCD or fully trusted environments)\nsnyk-agent-scan --dangerously-run-mcp-servers\n\n# Suppress MCP server stderr output during scanning\nsnyk-agent-scan --suppress-mcpserver-io=true\n\n# CI mode (requires --dangerously-run-mcp-servers in non-interactive environments)\nsnyk-agent-scan --ci --dangerously-run-mcp-servers\n```\n\n## Demo\n\nThis repository includes a vulnerable MCP server that can demonstrate Model Context Protocol security issues that Agent Scan finds.\n\nHow to demo MCP security issues?\n\n1. Clone this repository\n2. Create an `mcp.json` config file in the cloned git repository root directory with the following contents:\n\n```jsonc\n{\n  \"mcpServers\": {\n    \"Demo MCP Server\": {\n      \"type\": \"stdio\",\n      \"command\": \"uv\",\n      \"args\": [\"run\", \"mcp\", \"run\", \"demoserver\u002Fserver.py\"],\n    },\n  },\n}\n```\n\n3. Run Agent Scan: `uvx --python 3.13 snyk-agent-scan@latest scan --full-toxic-flows mcp.json`\n\nNote: if you place the `mcp.json` configuration filepath elsewhere then adjust the `args` path inside the MCP server configuration to reflect the path to the MCP Server (`demoserver\u002Fserver.py`) as well as the `uvx` command that runs Agent Scan with the correct filepath to `mcp.json`.\n\n## Agent Scan is closed to contributions\n\nAgent Scan does not accept external contributions at this time.\n\nWe welcome suggestions, bug reports, or feature requests as GitHub issues.\n\n## Development Setup\n\nTo run Agent Scan from source, follow these steps:\n\n```bash\nuv run pip install -e .\nuv run -m src.agent_scan.cli\n```\n\n## Including Agent Scan results in your own project \u002F registry\n\nIf you want to include Agent Scan results in your own project or registry, please [reach out](https:\u002F\u002Fevo.ai.snyk.io\u002F#contact-us). There are designated APIs for this purpose. Using the standard Agent Scan API for large scale scanning is considered abuse and will result in your account being blocked.\n\n## Documentation\n\n- [Scanning](docs\u002Fscanning.md) — How scanning works, CLI parameters, and usage examples.\n- [Issue Codes](docs\u002Fissue-codes.md) — Reference for all security issues detected by Agent Scan.\n\n## Further Reading\n\n- [Introducing MCP-Scan](https:\u002F\u002Finvariantlabs.ai\u002Fblog\u002Fintroducing-mcp-scan)\n- [MCP Security Notification Tool Poisoning Attacks](https:\u002F\u002Finvariantlabs.ai\u002Fblog\u002Fmcp-security-notification-tool-poisoning-attacks)\n- [WhatsApp MCP Exploited](https:\u002F\u002Finvariantlabs.ai\u002Fblog\u002Fwhatsapp-mcp-exploited)\n- [MCP Prompt Injection](https:\u002F\u002Fsimonwillison.net\u002F2025\u002FApr\u002F9\u002Fmcp-prompt-injection\u002F)\n- [Toxic Flow Analysis](https:\u002F\u002Finvariantlabs.ai\u002Fblog\u002Ftoxic-flow-analysis)\n- [Skills Report](.github\u002Freports\u002Fskills-report.pdf)\n\n## Changelog\n\nSee [CHANGELOG.md](CHANGELOG.md).\n","Snyk Agent Scan 是一个用于AI代理、MCP服务器及代理技能的安全扫描工具。它能够自动发现并分析系统中的所有相关组件，检测包括提示注入、敏感数据处理不当以及隐藏在自然语言中的恶意负载等15种以上的安全风险。该工具支持Claude, Cursor, Windsurf, Gemini CLI, Amp, Amazon Q等多种主流AI代理的扫描，并且具备对MCP配置文件执行命令前要求用户确认的功能以增强安全性。适用于需要定期检查和维护其AI应用生态安全性的开发者或组织，在测试不信任来源的MCP配置时推荐使用沙盒环境。",2,"2026-06-11 03:42:16","high_star"]