SIGN UPLOG IN
X (Twitter)LinkedInGitHubDiscordYouTube

Snyk MCP server for AI agents and assistants

Securely connect your AI agents and chatbots (Claude, ChatGPT, Cursor, etc) with Snyk MCP or direct API to inspect projects, find vulnerabilities, prioritize security issues, and track remediation through natural language.

Get started for freeGet a demo
Snyk logoSnyk
Oauth2

Snyk is a developer security platform for finding issues in code, dependencies, containers, and cloud infrastructure. It helps teams prioritize vulnerabilities and fix them before they reach production.

71 Tools

Try Snyk now

Type what you want done — sign in and watch it run live in the Tool Router playground.

TOOL ROUTER PLAYGROUND
Snyk
Try asking
TOOLS

Supported Tools

Every Snyk action and event your agent gets out of the box.

Add Projects To Collection

Add up to 100 projects to a Snyk collection.

Bulk Delete Projects

Permanently delete up to 100 Snyk projects.

Bulk Update Inventory Assets

Transactionally update attributes for up to 100 inventory assets in a Snyk organization.

Bulk Update Projects

Update 1-20 distinct Snyk projects using individual typed patches or one shared patch.

Create Collection

Create a collection in a Snyk organization.

Create Export

Start an asynchronous organization export and return the export ID and polling link.

Create Ignore Policy

Create an organization-level ignore policy for a specific Snyk Code finding.

Create Repository Aliases

Link one or more alternate repository URLs to canonical repository assets in a Snyk organization.

Create SBOM Test

Start asynchronous vulnerability analysis of a CycloneDX 1.

Delete Collection

Permanently delete a Snyk collection.

Delete Ignore Policy

Permanently delete an organization-level Snyk ignore policy.

Delete Project

Permanently delete one Snyk project from an organization.

Delete Repository Aliases

Detach 1-100 aliased URLs from their canonical repository assets in a Snyk organization.

Delete Target

Permanently delete a Snyk target and all projects associated with it.

Download Findings Document

Download the raw bytes of a completed findings document and return an offloaded file reference.

Download Project SBOM

Download a Snyk project's software bill of materials as CycloneDX JSON/XML or SPDX JSON and return an offloaded file reference.

Get Collection

Retrieve a collection from a Snyk organization.

Get Container Image

Retrieve a container image by its SHA-256 digest from a Snyk organization.

Get Export

Retrieve completed export results from a Snyk organization.

Get Export Job Status

Get the current status of a Snyk organization export job.

Get IAC Settings

Retrieve Infrastructure as Code settings for a Snyk organization.

Get Ignore Policy

Retrieve an organization-level ignore policy by ID.

Get Inventory Asset

Retrieve one inventory asset by ID from a Snyk organization, optionally using sparse fieldsets.

Get Inventory Asset Search Results

Retrieve one page of results from a previously started asynchronous Snyk inventory asset search.

Get Open Source Broker Setting

Retrieve whether the Open Source Broker setting is enabled for a Snyk organization.

Get Open Source Ecosystem Broker Settings

Retrieve all Broker settings for a specific Open Source ecosystem in a Snyk organization.

Get Open Source Private Registry Settings

Retrieve publicly accessible private registry settings for a specific Open Source ecosystem in a Snyk organization.

Get Organization

Retrieve the full details of a Snyk organization.

Get Organization Issue

Retrieve one Snyk issue by its organization and issue IDs, optionally including data flows for Snyk Code issues.

Get Package Test

Retrieve a Snyk package test by ID, including its execution state, outcome, component facts, and finding summaries.

Get Project

Retrieve a Snyk project by ID, including its settings and relationships.

Get SAST Settings

Retrieve the SAST settings for a Snyk organization.

Get SBOM Test Result

Retrieve one page of affected packages from a finished Snyk SBOM test, together with the test result resource.

Get SBOM Test Status

Poll the status of an asynchronous Snyk SBOM test job.

Get Target

Retrieve a target by ID from a Snyk organization.

List Broker Connections

List one page of Broker connections integrated with a Snyk organization.

List Collection Projects

List one page of projects in a Snyk collection, with issue counts and owning targets.

List Collections

List one page of a Snyk organization's collections, including project and issue counts.

List Component Findings

List one page of unsuppressed findings for a component in a completed Snyk package test.

List Container Images

List one page of container images in a Snyk organization, optionally filtered by image digest, platform, or registry name.

List Container Image Target Refs

List one page of target references associated with a container image in a Snyk organization.

List Ignore Policies

List one page of organization-level Snyk Code Consistent Ignore policies, with optional search, review, expiry, and sorting filters.

List Ignore Policy Events

List one page of event history for a Snyk organization ignore policy.

List Inventory Asset Projects

List one page of Snyk projects linked to an inventory asset, including project attributes and issue counts.

List Inventory Assets

List one page of a Snyk organization's inventory assets, with optional RSQL filtering, sorting, sparse fieldsets, and total count.

List Inventory Asset Targets

List one page of Snyk targets linked to an inventory asset, including each target's origin, reference, manifest file, integration, and import time.

List Inventory Filter Fields

List one page of fields available for filtering a Snyk organization's inventory assets with RSQL.

List Inventory Filter Values

List one page of distinct values for a Snyk inventory filter field for autocomplete.

List Inventory Group Fields

List one page of fields available for grouping inventory assets in a Snyk organization, optionally filtered by asset type.

List Inventory Group Values

List one page of aggregated values for a Snyk inventory group field.

List Issues For Package

List one offset page of direct vulnerabilities for a versioned Package URL.

List Issues For Packages

List direct vulnerabilities for a batch of versioned Package URLs.

List Language Settings

Get one page of language and package-manager settings for a Snyk organization.

List Organization Issues

List one page of issues for a Snyk organization, with filters for scan item, issue type, timestamps, effective severity, status, ignored state, and Code data flows.

List Organizations

List one page of Snyk organizations accessible to the connected account, with group, personal-organization, slug, name, and relationship-expansion filters.

List Projects

List one page of a Snyk organization's projects.

List Targets

List one page of a Snyk organization's targets.

List Test Findings

List one page of non-threshold-violating, policy-unsuppressed findings from a Snyk package test.

Lookup Inventory Asset

Look up one inventory asset in a Snyk organization by natural key or alias.

Remove Projects From Collection

Remove up to 100 projects from a Snyk collection.

Update Collection

Rename a Snyk collection.

Update IAC Settings

Update Infrastructure as Code custom-rule inheritance, enablement, or OCI registry URL and tag for a Snyk organization.

Update Ignore Policy

Update an organization-level ignore policy.

Update Inventory Asset

Partially update the classification, labels, or tags of one Snyk inventory asset.

Update Language Settings

Update package-manager settings for one programming language in a Snyk organization.

Update Open Source Ecosystem Broker Settings

Update selected Broker integrations for a specific Open Source ecosystem in a Snyk organization.

Update Open Source Private Registry Settings

Add, update, or remove private registry integrations for one Open Source ecosystem in a Snyk organization.

Update Organization

Update the display name of a Snyk organization.

Update Org Secrets Settings

Update the Early Access Secrets settings for a Snyk organization.

Update Project

Update a Snyk project's classifications, tags, test frequency, or owner.

Update SAST Settings

Enable or disable Snyk Code SAST for an organization.

SETUP GUIDE

Connect Snyk MCP Tool with your Agent

1

Install Composio

typescript
npm install @composio/core ai @ai-sdk/mcp @ai-sdk/openai
Install the Composio SDK and your agent framework
2

Create a session with MCP enabled

typescript
import { Composio } from "@composio/core";

const composio = new Composio();
const { mcp } = await composio.create("your-user-id", {
  toolkits: ["snyk"],
  mcp: true,
});
Create a session scoped to Snyk and read its MCP URL and headers
3

Connect your agent to the MCP server

typescript
import { createMCPClient } from "@ai-sdk/mcp";
import { openai } from "@ai-sdk/openai";
import { generateText, stepCountIs } from "ai";

const client = await createMCPClient({
  transport: { type: "http", url: mcp.url, headers: mcp.headers },
});

const { text } = await generateText({
  model: openai("gpt-5.6-sol"),
  tools: await client.tools(),
  prompt: "List all open security issues in my Snyk projects",
  stopWhen: stepCountIs(10),
});

console.log(text);
await client.close();
Pass the session's MCP URL and headers to your agent and run a Snyk request
SETUP GUIDE

Connect Snyk API Tool with your Agent

1

Install Composio

typescript
npm install @composio/core @composio/openai openai
Install the Composio SDK, the OpenAI provider, and the OpenAI SDK
2

Create a Composio session

typescript
import OpenAI from "openai";
import { Composio } from "@composio/core";
import { OpenAIResponsesProvider } from "@composio/openai";

const composio = new Composio({ provider: new OpenAIResponsesProvider() });
const client = new OpenAI();

const session = await composio.create("your-user-id", { toolkits: ["snyk"] });
const tools = await session.tools();
Initialize Composio with the OpenAI Responses provider and create a session scoped to Snyk
3

Run Snyk tools with your agent

typescript
let response = await client.responses.create({
  model: "gpt-5.6-sol",
  tools,
  input: [{ role: "user", content: "List all open security issues in my Snyk projects" }],
});

while (response.output.some((o) => o.type === "function_call")) {
  const outputs = await composio.provider.handleToolCalls(session, response.output);
  response = await client.responses.create({
    model: "gpt-5.6-sol",
    tools,
    previous_response_id: response.id,
    input: outputs,
  });
}

console.log(response.output_text);
Send a request, execute the Snyk tool calls through the session, and print the final answer

Why Use Composio?

AI Native Snyk Integration

  • Supports both Snyk MCP and direct API based integrations
  • Structured, LLM-friendly schemas for reliable tool execution
  • Rich coverage for reading, writing, and querying your Snyk data

Managed Auth

  • Built-in OAuth handling with automatic token refresh and rotation
  • Central place to manage, scope, and revoke Snyk access
  • Per user and per environment credentials instead of hard-coded keys

Agent Optimized Design

  • Tools are tuned using real error and success rates to improve reliability over time
  • Comprehensive execution logs so you always know what ran, when, and on whose behalf

Enterprise Grade Security

  • Fine-grained RBAC so you control which agents and users can access Snyk
  • Scoped, least privilege access to Snyk resources
  • Full audit trail of agent actions to support review and compliance
FRAMEWORKS

Use Snyk with any AI Agent Framework

Choose a Framework you want to connect Snyk with

ChatGPT logo

ChatGPT

Use Snyk MCP with ChatGPT

Claude Cowork logo

Claude Cowork

Use Snyk MCP with Claude Cowork

Hermes logo

Hermes

Use Snyk MCP with Hermes

Atomic Agent logo

Atomic Agent

Use Snyk MCP with Atomic Agent

Rolling this out across your team?

Give your team centralized access control across every framework with Composio’s MCP Gateway.

EXPLORE MCP GATEWAY
FAQ

Frequently asked questions

Snyk requires connections to go through your own OAuth app. You register it once with Snyk, add its client ID and secret in the Composio dashboard, and from then on everyone connects by signing in to Snyk as usual. Composio handles the rest of the flow and the token refresh.

Yes! Composio's Tool Router enables agents to use multiple toolkits. Learn more.

Yes. Composio is SOC 2 Type II compliant and is built to keep your Snyk connection and credentials secure. OAuth tokens and API keys are encrypted, and sensitive customer data is protected at rest and in transit.

Composio also undergoes independent security testing and continuously monitors its systems for security threats. You can review the latest reports and policies in the Composio Trust Center.

Composio maintains and updates all toolkit integrations automatically, so your agents always work with the latest API versions.

When you connect a Snyk account through Composio, every action runs under that account, so anything the agent creates, sends, or changes shows up in Snyk as done by you. Keep an approval step in your prompt for actions with side effects, such as sending or deleting, and have the agent draft first.

Exactly the ones Snyk lists on its consent screen when you connect. Review that screen before approving. If you connect a work account, your Snyk administrator may need to approve the app first, and you can revoke the access inside Snyk whenever you want.

Yes. Composio supports multiple connected accounts for the same app, and that works in Claude, ChatGPT, or any other assistant you connect through Composio. Give each Snyk connection a name such as work or personal, and the assistant uses the one you mention in the request. Each account keeps its own credentials and nothing is merged.

Composio refreshes Snyk tokens automatically, so day to day you do nothing. If you revoke access inside Snyk, or Snyk invalidates the session, the connection shows as expired in Composio and the agent stops acting on that account until you reconnect it, which is a single sign-in.

Composio's free Hobby plan includes 100,000 tool calls per month with no credit card, which covers most personal Snyk use. Paid plans add higher limits and team features. Your Snyk plan and its API limits still apply as usual.

Built-in connectors usually give one AI access to a limited set of apps. Many people use Composio because it lets their AI connect to more apps than it normally supports, or connect to multiple accounts for the same app (e.g. connect Claude to multiple Snyk accounts).

With Composio, you connect Snyk once and then use it across different AI assistants without setting it up separately in each one. Connect your apps to Composio once, then connect Composio to whichever AI you use, whether that's Claude, ChatGPT, Hermes, or your own custom assistant.

Start with Snyk.It takes 30 seconds.

Managed auth, hosted MCP servers, and every Snyk tool your agent needs.Free to start.

Start building