How to integrate Snyk MCP with Atomic Agent

Connect Atomic Agent to Snyk MCP. List open vulnerabilities in your snyk projects, prioritize critical snyk issues by project, and more using natural language, with authentication handled for you.

Snyk logoSnyk
Oauth2

Snyk is a developer security platform for finding issues in code, dependencies, containers, and cloud infrastructure. It helps teams prioritize vulnerabilities and fix them before they reach production.

71 Tools

Introduction

Atomic Agent is an open-source AI agent that runs on your machine and supports local models through llama.cpp. Connect it to 1,500+ apps through Composio, including Snyk.

This guide uses Atomic Agent's built-in Composio integration. You need Atomic Agent v0.5.6 or later, your own Composio API key, and a Snyk account. See the Atomic Agent documentation for installation instructions.

Also integrate Snyk with

How Atomic Agent connects to Snyk

Atomic Agent connects to Composio's Tool Router over Streamable HTTP MCP. It discovers the tools needed for your request, and Composio handles account authentication.

Execution and account-connection tools follow Atomic Agent's configured approval policy. Review any approval prompt before allowing an action on your connected account.

Connect Snyk to Atomic Agent

  1. Sign up or sign in to the Composio dashboard. Copy your API key.
  2. In Atomic Agent, open the Integrations tab and select Composio. Select API key, press e, paste the key, and press Enter. The tools become available immediately, without a restart.
  3. Ask Atomic Agent to do something in Snyk. It searches Composio for the right tool.
  4. On first use, open the sign-in link returned in the chat. Connect your Snyk account, then return to Atomic Agent to continue.

Headless setup

Add the following line to ~/.atomic-agent/.env, replacing YOUR_COMPOSIO_API_KEY with your key. Start Atomic Agent after saving the file.

bash
COMPOSIO_API_KEY=YOUR_COMPOSIO_API_KEY

What is the Snyk MCP server, and what's possible with it?

The Snyk MCP server is an implementation of the Model Context Protocol that connects your AI agent and assistants like Claude, Cursor, etc directly to your Snyk account. It provides structured and secure access to your projects, security findings, container images, SBOM tests, collections, and organization settings, so your agent can review vulnerabilities, inspect projects and images, analyze software bills of materials, organize projects, and update security settings on your behalf.

  • Security issue investigation: Have your agent retrieve organization issues, inspect individual findings, review data flows for Snyk Code issues, and list unsuppressed component findings from completed package tests.
  • Project and container management: Let the agent find project details, list container images, inspect a specific image, update project attributes, or remove projects and targets when needed.
  • SBOM analysis: Direct your agent to start vulnerability analysis for a CycloneDX or SPDX SBOM, check the test status, review affected packages, and download a project SBOM.
  • Project organization: Instruct your agent to create and manage collections, add projects to collections, list collection projects, and review project and issue counts.
  • Organization security settings: Have your agent review Snyk Code and Infrastructure as Code settings, inspect Open Source Broker and private registry settings, manage ignore policies, and check Broker connections.

Use Snyk from Atomic Agent

With your account connected, ask Atomic Agent to work with Snyk in natural language. You can connect more apps through the same Composio integration as you need them.

Visit the Atomic Agent website or inspect the Atomic Agent source code.

Troubleshooting

Why is my API key rejected?

Copy the key directly from the Composio dashboard. Atomic Agent requires ASCII characters because it sends the key in an HTTP header. Remove any extra characters introduced when copying.

Why are Composio tools unavailable after saving a key?

Check that you use Atomic Agent v0.5.6 or later and that Composio is enabled in your configuration. A "composio": { "enabled": false } setting disables the integration while keeping the saved key on disk.

Does Composio have a free plan?

The Hobby plan includes 100,000 tool calls per month. Composio-managed OAuth apps have a lower included allowance. See Composio pricing for the current limits that apply to your connection.

TOOLS

Supported Tools

Every Snyk action and event your agent gets out of the box.

Add Projects To Collection

Add up to 100 projects to a Snyk collection.

Bulk Delete Projects

Permanently delete up to 100 Snyk projects.

Bulk Update Inventory Assets

Transactionally update attributes for up to 100 inventory assets in a Snyk organization.

Bulk Update Projects

Update 1-20 distinct Snyk projects using individual typed patches or one shared patch.

Create Collection

Create a collection in a Snyk organization.

Create Export

Start an asynchronous organization export and return the export ID and polling link.

Create Ignore Policy

Create an organization-level ignore policy for a specific Snyk Code finding.

Create Repository Aliases

Link one or more alternate repository URLs to canonical repository assets in a Snyk organization.

Create SBOM Test

Start asynchronous vulnerability analysis of a CycloneDX 1.

Delete Collection

Permanently delete a Snyk collection.

Delete Ignore Policy

Permanently delete an organization-level Snyk ignore policy.

Delete Project

Permanently delete one Snyk project from an organization.

Delete Repository Aliases

Detach 1-100 aliased URLs from their canonical repository assets in a Snyk organization.

Delete Target

Permanently delete a Snyk target and all projects associated with it.

Download Findings Document

Download the raw bytes of a completed findings document and return an offloaded file reference.

Download Project SBOM

Download a Snyk project's software bill of materials as CycloneDX JSON/XML or SPDX JSON and return an offloaded file reference.

Get Collection

Retrieve a collection from a Snyk organization.

Get Container Image

Retrieve a container image by its SHA-256 digest from a Snyk organization.

Get Export

Retrieve completed export results from a Snyk organization.

Get Export Job Status

Get the current status of a Snyk organization export job.

Get IAC Settings

Retrieve Infrastructure as Code settings for a Snyk organization.

Get Ignore Policy

Retrieve an organization-level ignore policy by ID.

Get Inventory Asset

Retrieve one inventory asset by ID from a Snyk organization, optionally using sparse fieldsets.

Get Inventory Asset Search Results

Retrieve one page of results from a previously started asynchronous Snyk inventory asset search.

Get Open Source Broker Setting

Retrieve whether the Open Source Broker setting is enabled for a Snyk organization.

Get Open Source Ecosystem Broker Settings

Retrieve all Broker settings for a specific Open Source ecosystem in a Snyk organization.

Get Open Source Private Registry Settings

Retrieve publicly accessible private registry settings for a specific Open Source ecosystem in a Snyk organization.

Get Organization

Retrieve the full details of a Snyk organization.

Get Organization Issue

Retrieve one Snyk issue by its organization and issue IDs, optionally including data flows for Snyk Code issues.

Get Package Test

Retrieve a Snyk package test by ID, including its execution state, outcome, component facts, and finding summaries.

Get Project

Retrieve a Snyk project by ID, including its settings and relationships.

Get SAST Settings

Retrieve the SAST settings for a Snyk organization.

Get SBOM Test Result

Retrieve one page of affected packages from a finished Snyk SBOM test, together with the test result resource.

Get SBOM Test Status

Poll the status of an asynchronous Snyk SBOM test job.

Get Target

Retrieve a target by ID from a Snyk organization.

List Broker Connections

List one page of Broker connections integrated with a Snyk organization.

List Collection Projects

List one page of projects in a Snyk collection, with issue counts and owning targets.

List Collections

List one page of a Snyk organization's collections, including project and issue counts.

List Component Findings

List one page of unsuppressed findings for a component in a completed Snyk package test.

List Container Images

List one page of container images in a Snyk organization, optionally filtered by image digest, platform, or registry name.

List Container Image Target Refs

List one page of target references associated with a container image in a Snyk organization.

List Ignore Policies

List one page of organization-level Snyk Code Consistent Ignore policies, with optional search, review, expiry, and sorting filters.

List Ignore Policy Events

List one page of event history for a Snyk organization ignore policy.

List Inventory Asset Projects

List one page of Snyk projects linked to an inventory asset, including project attributes and issue counts.

List Inventory Assets

List one page of a Snyk organization's inventory assets, with optional RSQL filtering, sorting, sparse fieldsets, and total count.

List Inventory Asset Targets

List one page of Snyk targets linked to an inventory asset, including each target's origin, reference, manifest file, integration, and import time.

List Inventory Filter Fields

List one page of fields available for filtering a Snyk organization's inventory assets with RSQL.

List Inventory Filter Values

List one page of distinct values for a Snyk inventory filter field for autocomplete.

List Inventory Group Fields

List one page of fields available for grouping inventory assets in a Snyk organization, optionally filtered by asset type.

List Inventory Group Values

List one page of aggregated values for a Snyk inventory group field.

List Issues For Package

List one offset page of direct vulnerabilities for a versioned Package URL.

List Issues For Packages

List direct vulnerabilities for a batch of versioned Package URLs.

List Language Settings

Get one page of language and package-manager settings for a Snyk organization.

List Organization Issues

List one page of issues for a Snyk organization, with filters for scan item, issue type, timestamps, effective severity, status, ignored state, and Code data flows.

List Organizations

List one page of Snyk organizations accessible to the connected account, with group, personal-organization, slug, name, and relationship-expansion filters.

List Projects

List one page of a Snyk organization's projects.

List Targets

List one page of a Snyk organization's targets.

List Test Findings

List one page of non-threshold-violating, policy-unsuppressed findings from a Snyk package test.

Lookup Inventory Asset

Look up one inventory asset in a Snyk organization by natural key or alias.

Remove Projects From Collection

Remove up to 100 projects from a Snyk collection.

Update Collection

Rename a Snyk collection.

Update IAC Settings

Update Infrastructure as Code custom-rule inheritance, enablement, or OCI registry URL and tag for a Snyk organization.

Update Ignore Policy

Update an organization-level ignore policy.

Update Inventory Asset

Partially update the classification, labels, or tags of one Snyk inventory asset.

Update Language Settings

Update package-manager settings for one programming language in a Snyk organization.

Update Open Source Ecosystem Broker Settings

Update selected Broker integrations for a specific Open Source ecosystem in a Snyk organization.

Update Open Source Private Registry Settings

Add, update, or remove private registry integrations for one Open Source ecosystem in a Snyk organization.

Update Organization

Update the display name of a Snyk organization.

Update Org Secrets Settings

Update the Early Access Secrets settings for a Snyk organization.

Update Project

Update a Snyk project's classifications, tags, test frequency, or owner.

Update SAST Settings

Enable or disable Snyk Code SAST for an organization.

FAQ

Frequently asked questions

With a standalone Snyk MCP server, the agents and LLMs can only access a fixed set of Snyk tools tied to that server. However, with the Composio Tool Router, agents can dynamically load tools from Snyk and many other apps based on the task at hand, all through a single MCP endpoint.

Yes, you can. Atomic Agent fully supports MCP integration. You get structured tool calling, message history handling, and model orchestration while Tool Router takes care of discovering and serving the right Snyk tools.

Yes, absolutely. You can configure which Snyk scopes and actions are allowed when connecting your account to Composio. You can also bring your own OAuth credentials or API configuration so you keep full control over what the agent can do.

All sensitive data such as tokens, keys, and configuration is fully encrypted at rest and in transit. Composio is SOC 2 Type 2 compliant and follows strict security practices so your Snyk data and credentials are handled as safely as possible.

Start with Snyk.It takes 30 seconds.

Managed auth, hosted MCP servers, and every Snyk tool your agent needs.Free to start.

Start building