Is Agent Scan safe to use?

Agent Scan has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.

How do I install Agent Scan?

Agent Scan supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.

What AI clients work with Agent Scan?

Agent Scan is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.

Is Agent Scan actively maintained?

Agent Scan is actively maintained — last commit was 1 day ago. It has 2,948 GitHub stars.

Agent Scan

Name: Agent Scan
Author: snyk

Official

snyk-agent-scan · by snyk

Security scanner for AI agents, MCP servers and agent skills.

2.9k GitHub PyPI

No known CVEs

Apache-2.0 license

Actively maintained

Last commit 1d ago

Works with most clients

Transport: stdio, sse, http

0 tools

Grade F

MCPpedia last refreshed this data 1h ago

Edit this pageView history

Agent Scan is an MCP server that security scanner for AI agents, MCP servers and agent skills. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 63/100 on MCPpedia's security, maintenance and efficiency rubric.

Security

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "agent-scan": {
      "args": [
        "snyk-agent-scan"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/agent-scan)](https://mcppedia.org/s/agent-scan)

Read me

What Agent Scan does

Discover and scan agent components on your machine for prompt injections and vulnerabilities (including agents, MCP servers, skills).

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'snyk-agent-scan' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

63/100across 5 weighted dimensions

How we score →

0255075100

−37

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked snyk-agent-scan against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Agent Scan safe to use?: Agent Scan has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.
How do I install Agent Scan?: Agent Scan supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with Agent Scan?: Agent Scan is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is Agent Scan actively maintained?: Agent Scan is actively maintained — last commit was 1 day ago. It has 2,948 GitHub stars.

Similar servers

Others in security

View all →

Ida Pro Mcp92

AI-powered reverse engineering assistant that bridges IDA Pro with language models through MCP.

11.5k 3

io.github.wyre-technology/rocketcyber-mcp92

MCP server for RocketCyber Managed SOC — incidents, alerts, agents, and customer telemetry.

Bridgeguard MCP Server92

BridgeGuard MCP Server - Cross-chain bridge security audit tools for AI coding agents. Scan bri...

io.github.KryptosAI/mcp-observatory91

Regression testing for MCP servers. Checks capabilities, invokes tools, detects schema drift.

174 4

MCP Security Weekly

Get CVE alerts and security updates for Agent Scan and similar servers.

Community

Discussion

Start a conversation

Ask a question, share a tip, or report an issue.

Has anyone used this with Cursor?How do you handle auth?Any alternatives?

Edit this pageView history

Security

Step 1

Install in your client

Config is the same across clients — only the file and path differ.

Supported in Claude Desktopstdio, sse, http · Node 18+

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json

{
  "mcpServers": {
    "agent-scan": {
      "args": [
        "snyk-agent-scan"
      ],
      "command": "uvx"
    }
  }
}

Are you the author?

Add this badge to your README to show your security score and help users find safe servers.

Embed in your READMEAbout badges →

[![MCPpedia Score](https://mcppedia.org/api/badge/agent-scan)](https://mcppedia.org/s/agent-scan)

Read me

What Agent Scan does

Discover and scan agent components on your machine for prompt injections and vulnerabilities (including agents, MCP servers, skills).

Test This Server

Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.

uvx 'snyk-agent-scan' 2>&1 | head -1 && echo "✓ Server started successfully"

After testing, let us know if it worked:

README

Snyk Agent Scan

Discover and scan agent components on your machine for prompt injections
and vulnerabilities (including agents, MCP servers, skills).

Note: CLI output is experimental and subject to change

Agent Scan v0.5.x (planned for deprecation)

The raw output of this CLI — including issue codes, field names, severity labels, and response structure — is experimental and may change without notice between releases. We do not recommend building production workflows that depend on specific CLI output fields or issue codes.

Agent Scan v0.6 and later

The raw output of this CLI — including risk indicator names, scores, field names, and response structure — is experimental and may change without notice between releases. We do not recommend building production workflows that depend on specific CLI output fields or risk names.

If you are an enterprise customer using Snyk to manage agent security risk at scale, the CLI output may not reflect what is sent to and shown in the Evo platform. The underlying integration, discovery, and risk assessment that powers enterprise deployments is stable and supported — any changes will be communicated in line with standard Snyk product practices. Contact your account team for deployment guidance.

NEW Read our technical report on the emerging threats of the agent skill eco-system published together with Agent Scan 0.4, which adds support for scanning agent skills.

Agent Scan v0.5.x output

[!WARNING] Agent Scan v0.5.x uses issue-code output. This CLI line is planned for deprecation.

Agent Scan v0.6 and later output

Agent Scan helps you discover all your installed agent components (harnesses, MCP servers, and skills) and scans them for common threats like prompt injections, sensitive data handling, or malware payloads hidden in natural language. Ignore analysis on skills by using --no-skills.

Security Warning

⚠️ IMPORTANT: Scanning MCP configurations will execute the commands defined in them.

When Agent Scan scans an MCP configuration file, it starts the stdio MCP servers by executing the commands and arguments specified in the config. This is necessary to retrieve tool descriptions and perform security analysis.

Recommendations:

Run scans inside a sandbox (Docker container, VM, or disposable environment) when evaluating untrusted or third-party MCP configs

Review the consent prompt carefully during interactive scans, it shows the exact command and arguments that will be executed for each server

Use --dangerously-run-mcp-servers only in trusted environments where you've verified all MCP server commands

By default, Agent Scan requires explicit user consent (y/n) before starting each stdio MCP server during interactive runs. This gives you control over what gets executed on your system.

Quick Start

Choose one of two ways to run Agent Scan:

Run the Python package with uvx using the instructions below.
**Download a standalone

... View full README on GitHub

Loading README…

Scored, not listed

Why this score

Five weighted categories — click any category to see the underlying evidence.

Score breakdown

63/100across 5 weighted dimensions

How we score →

0255075100

−37

Security

Maintenance

Efficiency

Documentation

Compatibility

Categoriesclick a row to see evidence

Security

OSV.dev

No known CVEs.

Checked snyk-agent-scan against OSV.dev.

Community

Reviews

Be the first to review

Have you used this server?

Share your experience — it helps other developers decide.

How easy was setup?Did it work reliably?How was the documentation?

Frequently Asked Questions

Is Agent Scan safe to use?: Agent Scan has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments. Licensed under Apache-2.0.
How do I install Agent Scan?: Agent Scan supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
What AI clients work with Agent Scan?: Agent Scan is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
Is Agent Scan actively maintained?: Agent Scan is actively maintained — last commit was 1 day ago. It has 2,948 GitHub stars.