SSnyk CLI MCP (official)

Tested npm snyk 1.1308.4 (Apache-2.0 per npm; repo snyk/cli, 5,707 GitHub stars when checked) through `snyk mcp -t stdio`, the command Snyk's docs give. With install scripts off, the npm wrapper downloaded the native Snyk CLI binary on first run (it printed a matching SHA-256 check) before the server started. Initialize and tools/list worked (14 tools; scans for open source, code, IaC, containers, secrets and SBOMs, plus auth tools). snyk_version (self-check) returned 1.1308.4. The one read call, snyk_package_health_check for npm lodash 4.17.20, answered that the user is not authenticated: scans and lookups need a Snyk account sign-in (snyk_auth), which we don't do. Core tools not tested. snyk_auth, snyk_logout, snyk_trust and snyk_send_feedback were not called.
Tool-call test (2026-11-11, direct MCP stdio client, no LLM): fail. 0 of 1 function call passed (plus 1 self-check); every scan and lookup needs a Snyk sign-in. Core tools not tested. Evidence: local test run, Nov 11, 2026.

Transport (tested 2026-11-11): stdio

Score 70/100 · Tools 14 · Token cost approx. 6,580 tokens · Compare · Last tested 2026-11-11 · Version tested 1.1308.4 · Package snyk · Repo snyk/cli

Summary: Snyk CLI MCP (official) completed an MCP handshake without credentials and exposed 14 tools.

Evidence summary

Handshake

pass

Tools listed

14

Context cost

approx. 6580 tokens, cl100k estimate (14 tools, measured 2026-11-11, version 1.1308.4; an estimate) ranking · add up your servers' context cost

API key

Connects without a key; tool calls need one

Tested

2026-11-11

Test results

Local-model readiness

Token cost (estimate): approx. 6580 tokens, cl100k estimate for 14 tools · about 80% of an 8k context. This is an estimate from our testing (counted with cl100k_base).

Small-model friendly (schema heuristic, not a model result): unknown.

What we tested and what we didn't

Methodology: how we test. A high score means it installs and responds, not that giving it access to your data carries no risk.

{
  "name": "snyk",
  "version": "1.1308.4",
  "registry": "npm",
  "status": "working",
  "tested": "2026-11-11",
  "tools_count": 14,
  "deprecated": false,
  "archived": false,
  "tests": {
    "install": [
      "pass",
      20,
      "`npm install snyk` (Node 20, Linux) succeeded in 1s."
    ],
    "handshake": [
      "pass",
      30,
      "MCP `initialize` + `tools/list` over stdio succeeded with no credentials; 14 tools listed in 4.3s."
    ],
    "maintenance": [
      "pass",
      25,
      "Repo pushed 0 days before test; 5,707 GitHub stars."
    ],
    "docs": [
      "partial",
      10,
      "README over 3,000 chars; install instructions present. Check of the package's own README (README shipped in npm package)."
    ],
    "license": [
      "pass",
      10,
      "Apache-2.0 (OSI-approved)."
    ]
  }
}

Install

npx -y snyk mcp -t stdioCopy

Pin the version we tested

npx -y snyk@1.1308.4 mcp -t stdioCopy

tested 2026-11-11. Newer versions may differ and were not tested by us.

{
  "mcpServers": {
    "snyk-cli-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "snyk@1.1308.4",
        "mcp",
        "-t",
        "stdio"
      ]
    }
  }
}

Tools listed

snyk_aibom, snyk_auth, snyk_breakability_check, snyk_code_scan, snyk_container_scan, snyk_iac_scan, snyk_logout, snyk_package_health_check, snyk_sbom_scan, snyk_sca_scan, snyk_secret_scan, snyk_send_feedback, snyk_trust, snyk_version

Tool history: captured Nov 11, 2026. All tool history.

Quick config

{
  "mcpServers": {
    "snyk-cli-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "snyk",
        "mcp",
        "-t",
        "stdio"
      ]
    }
  }
}

Add to config Opens the config generator with this server selected.

{
  "mcpServers": {
    "snyk-cli-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "snyk",
        "mcp",
        "-t",
        "stdio"
      ]
    }
  }
}

Related: Troubleshooting: Protocol version mismatch (HTTP 400)

FAQ

Is Snyk CLI MCP deprecated?

No. snyk was not deprecated or archived when we last tested it on 2026-11-11.

What replaces Snyk CLI MCP?

Nothing; Snyk CLI MCP (official) is not deprecated as of 2026-11-11.

Does Snyk CLI MCP need an API key?

It connects and lists 14 tools without a key, but its tool calls need one.

Embed the badge

Every tested server gets a free embeddable badge. It shows the current score and test date and expires after 90 days. Testing is free; payment never changes a score.

Copy HTML

Copy Markdown Claim this listing · Report an issue