MCP-Scan: An MCP Security Scanner
About
Security scanner for AI agents, MCP servers and agent skills.
Explore
Agent Scan auto-discovers agents and their capabilities (MCP servers or skills) when their install paths exist. The table below shows on which operating systems each agent is scanned.
- ✓: at least one path is defined for that capability.
- ✗: the agent is listed for that OS but has no paths for that capability.
- —: that agent is not included for that OS.
- Skills Skills can be ignored by using --no-skills
| Agent | macOS MCP | macOS Skills | Linux MCP | Linux Skills | Windows MCP | Windows Skills |
| --- | :---: | :---: | :---: | :---: | :---: | :---: |
| Windsurf | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Cursor | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| VS Code | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Claude Desktop | ✓ | ✗ | — | — | ✓ | ✗ |
| Claude Code | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Gemini CLI | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| OpenClaw | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ |
| Amp | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ |
| Kiro | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| OpenCode | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Antigravity | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Codex | ✓ | ✓ | ✓ | ✓ | — | — |
| Amazon Q | ✓ | ✗ | ✓ | ✗ | ✓ (WSL) | ✗ |
Agent Scan is a security scanning tool to both scan and inspect the supply chain of agent components on your machine. It scans for common security vulnerabilities like prompt injections, tool poisoning, toxic flows, or vulnerabilities in agent skills.
Agent Scan operates in two main modes which can be used jointly or separately:
1. Scan Mode: The CLI command snyk-agent-scan scans the current machine for agents and agent components such as skills and MCP servers. Upon completion, it will output a comprehensive report for the user to review.
2. Background Mode (MDM, Crowdstrike). Agent Scan scans the machine in regular intervals in the background, and reports the results to a Snyk Evo instance. This can be used by security teams to monitor the company-wide agent supply chain in a central location. To set this up, please contact us.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
MCP-Scan: An MCP Security ScannerCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
To get started:
1. Sign up at Snyk and get an API token from https://app.snyk.io/account (API Token → KEY → click to show).
2. Set the token as an environment variable before running any scan:
export SNYK_TOKEN=your-api-token-here
3. Have uv installed on your system.
uvx snyk-agent-scan@latest ~/.vscode/mcp.json
snyk-agent-scan
snyk-agent-scan ~/custom/config.json
snyk-agent-scan --dangerously-run-mcp-servers
snyk-agent-scan --ci --dangerously-run-mcp-servers
To run Agent Scan from source, follow these steps:
uv run pip install -e .
uv run -m src.agent_scan.cli
```
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"mcp-scan: an mcp security scanner": {
"mcp-scan": {
"command": "uvx",
"args": [
"snyk-agent-scan@latest"
]
}
}
}
}McpServers
{
"mcp-scan": {
"command": "uvx",
"args": [
"snyk-agent-scan@latest"
]
}
}<p align="center">
<h1 align="center">
Snyk Agent Scan
</h1>
</p>
<p align="center">
Discover and scan agent components on your machine for prompt injections<br/>
and vulnerabilities (including agents, MCP servers, skills).
</p>
> Note: CLI output is experimental and subject to change
>
> The raw output of this CLI — including issue codes, field names, severity labels, and response structure — is experimental and may change without notice between releases. We do not recommend building production workflows that depend on specific CLI output fields or issue codes.
>
> If you are an enterprise customer using Snyk to manage agent security risk at scale, the CLI output may not reflect what is sent to and shown in the Evo platform. The underlying integration, discovery, and risk assessment that powers enterprise deployments is stable and supported — any changes will be communicated in line with standard Snyk product practices. Contact your account team for deployment guidance.
> NEW Read our technical report on the emerging threats of the agent skill eco-system published together with Agent Scan 0.4, which adds support for scanning agent skills.
<p align="center">
<a href="https://pypi.python.org/pypi/snyk-agent-scan">
</a>
<a href="https://pypi.python.org/pypi/snyk-agent-scan">
</a>
<a href="https://pypi.python.org/pypi/snyk-agent-scan">
</a>
</p>
<div align="center">
</div>
<br>
Agent Scan helps you keep an inventory of all your installed agent components (harnesses, MCP servers, and skills) and scans them for common threats like prompt injections, sensitive data handling, or malware payloads hidden in natural language. Ignore analysis on skills by using --no-skills.
Security Warning
> ⚠️ IMPORTANT: Scanning MCP configurations will execute the commands defined in them.
>
> When Agent Scan scans an MCP configuration file, it starts the stdio MCP servers by executing the commands and arguments specified in the config. This is necessary to retrieve tool descriptions and perform security analysis.
>
> Recommendations:
> - Run scans inside a sandbox (Docker container, VM, or disposable environment) when evaluating untrusted or third-party MCP configs
> - Review the consent prompt carefully during interactive scans, it shows the exact command and arguments that will be executed for each server
> - Use --dangerously-run-mcp-servers only in trusted environments where you've verified all MCP server commands
>
> By default, Agent Scan requires explicit user consent (y/n) before starting each stdio MCP server during interactive runs. This gives you control over what gets executed on your system.
Highlights
- Auto-discover MCP configurations, agent tools, skills
- Scanning of Claude, Cursor, Windsurf, Gemini CLI, Amp, Amazon Q, and other agents.
- Detects 15+ distinct security risks across MCP servers and agent skills:
- MCP: Prompt Injection, Tool Poisoning, Tool Shadowing, Toxic Flows
- Skills: Prompt Injection, Malware Payloads, Untrusted Content, Credential Handling, Hardcoded Secrets
Supported agents and capabilities
Agent Scan auto-discovers agents and their capabilities (MCP servers or skills) when their install paths exist. The table below shows on which operating systems each agent is scanned.
- ✓: at least one path is defined for that capability.
- ✗: the agent is listed for that OS but has no paths for that capability.
- —: that agent is not included for that OS.
- Skills Skills can be ignored by using --no-skills
| Agent | macOS MCP | macOS Skills | Linux MCP | Linux Skills | Windows MCP | Windows Skills |
| --- | :---: | :---: | :---: | :---: | :---: | :---: |
| Windsurf | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Cursor | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| VS Code | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Claude Desktop | ✓ | ✗ | — | — | ✓ | ✗ |
| Claude Code | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Gemini CLI | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| OpenClaw | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ |
| Amp | ✗ | ✓ | ✗ | ✓ | ✗ | ✓ |
| Kiro | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| OpenCode | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Antigravity | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Codex | ✓ | ✓ | ✓ | ✓ | — | — |
| Amazon Q | ✓ | ✗ | ✓ | ✗ | ✓ (WSL) | ✗ |
Detection coverage by scope
The matrix above shows on which operating systems each agent is scanned. This one breaks detection down by configuration scope and component type (skills vs MCP servers), combined across operating systems. "Servers" means MCP servers.
The four scopes:
- System — machine-wide / admin-managed / enterprise config that applies to all users (e.g. managed-mcp.json, files under /etc, /Library/Application Support, or ProgramData).
- User — the user's home-directory config (applies across all their projects).
- Project / workspace — config scoped to an opened project or workspace.
- Extension / plugin — components bundled inside installed extensions or plugins.
Legend: ✓ detected · ✗ the agent supports this but Agent Scan does not scan it yet · N/A the agent has no such component at this scope.
| Agent | System<br>skills | System<br>servers | User<br>skills | User<br>servers | Project / WS<br>skills | Project / WS<br>servers | Ext / plugin<br>skills | Ext / plugin<br>servers |
| --- | :---: | :---: | :---: | :---: | :---: | :---: | :---: | :---: |
| Windsurf | ✓ | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Cursor | N/A | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| VS Code | N/A | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Claude Desktop | N/A | N/A | ✗ | ✓ | N/A | N/A | N/A | ✗ |
| Claude Code | ✗ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Gemini CLI | N/A | ✗ | ✓ | ✓ | ✗ | ✗ | ✗ | ✗ |
| OpenClaw | N/A | N/A | ✓ | ✗ | ✓ † | N/A | ✗ | ✗ |
| Amp | N/A | ✗ | ✓ | ✗ | ✗ ‡ | ✗ | ✗ | ✗ |
| Kiro | N/A | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| OpenCode | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | N/A | N/A |
| Antigravity | N/A | N/A | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Codex | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ |
| Amazon Q | N/A | N/A | N/A | ✓ | N/A | ✗ | N/A | N/A |
† OpenClaw has no opened-project enumeration: its project/workspace skills are found only at the fixed ~/.openclaw/workspace/skills
‡ Amp stores project/workspace skills at .agents/skills (and the .claude/skills compatibility path); only the user-scope ~/.config/agents/skills is detected today, so project-scope skills are supported but not yet scanned.
Quick Start
To get started:
1. Sign up at Snyk and get an API token from https://app.snyk.io/account (API Token → KEY → click to show).
2. Set the token as an environment variable before running any scan:
export SNYK_TOKEN=your-api-token-here
3. Have uv installed on your system.
Scanning
To run a full scan of your machine (auto-discovers agents, MCP servers, skills), run:
uvx snyk-agent-scan@latest
This will scan for security vulnerabilities in MCP servers, tools, prompts, and resources. It will automatically discover a variety of agent configurations, including Claude Code/Desktop, Cursor, Gemini CLI, and Windsurf.
uvx snyk-agent-scan@latest
…
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
