Atlas / MCP servers / invariantlabs-ai / MCP Scan

MCP ScanBLOCK

Name: MCP Scan
Author: invariantlabs-ai

mcp/invariantlabs-ai/mcp-scan

MCP server by invariantlabs-ai · agent · ai · mcp · Audited 2026-09-24

⚑ Report / re-scan Source ↗

Security scanner for AI agents, MCP servers and agent skills.

Verdict

BLOCK

Grade

Trust score

61 /100

Exposed tools

19 14r · 4w · 1d

Transport

stdio · streamable-http

License

Apache-2.0

Stars

3,080

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Snyk Agent Scan

Discover and scan agent components on your machine for prompt injections and vulnerabilities (including agents, MCP servers, skills).

Note: We don't publish an npm package for Agent Scan. Install it via uvx or as a standalone binary.

Note: CLI output is experimental and subject to change Agent Scan v0.5.x (planned for deprecation) The raw output of this CLI — including issue codes, field names, severity labels, and response structure — is experimental and may change without notice between releases. We do not recommend building production workflows that depend on specific CLI output fields or issue codes. Agent Scan v0.6 and later The raw output of this CLI — including risk indicator names, scores, field names, and response structure — is experimental and may change without notice between releases. We do not recommend building production workflows that depend on specific CLI output fields or risk names. If you are an enterprise customer using Snyk to manage agent security risk at scale, the CLI output may not reflect what is sent to and shown in the Evo platform. The underlying integration, discovery, and risk assessment that powers enterprise deployments is stable and supported — any changes will be communicated in line with standard Snyk product practices. Contact your account team for deployment guidance.

NEW Read our technical report on the emerging threats of the agent skill eco-system published together with Agent Scan 0.4, which adds support for scanning agent skills.

Read from source at commit d97a3951b409OBSERVED · 2026-09-24

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add snyk-agent-scan --env PUSH_KEY=${PUSH_KEY} --env SNYK_TOKEN=${SNYK_TOKEN} -- uvx snyk-agent-scan

claude-desktop

{
  "mcpServers": {
    "snyk-agent-scan": {
      "command": "uvx",
      "args": [
        "snyk-agent-scan"
      ],
      "env": {
        "PUSH_KEY": "${PUSH_KEY}",
        "SNYK_TOKEN": "${SNYK_TOKEN}"
      }
    }
  }
}

Exposed tools (19)

14 read · 4 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`add`	write	return a + b
`browser_close`	read	Close the page
`create_pull_request`	write	d
`delete_file`	destructive
`divide`	read	Divide two numbers.
`gcd`	read	Calculate the greatest common divisor (GCD) of two integers.
`get_api_key`	read
`get_comments`	read
`get_connections`	read	return [
`get_current_time`	read
`get_train_info`	read	Get information about a train.
`is_prime`	read	Return True if n is a prime number, False otherwise.
`lcm`	read	Calculate the least common multiple (LCM) of two integers.
`multiply`	read
`send_email`	write
`store_value`	read	Store here all important values!
`subtract`	read	Subtract two numbers.
`sum`	write	Add two numbers together.
`weather`	read	Get current weather for a location.

Trust audit

BLOCKgrade D · trust 61/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (11 observation(s))
Network: declared (8 observation(s))
Shell: none-observed
Dependencies: not all pinned
Secrets in source: found