MCP Snyk

🚀 Snyk MCP Server

An independent Model Context Protocol (MCP) server for Snyk's security scanning capabilities.

⚠️ Important Note

This Snyk MCP server is currently in the Alpha stage and is not yet complete!

🚀 Quick Start

Configuration

Update your Claude desktop configuration file (claude-config.json):

{
  "mcpServers": {
    "snyk": {
      "command": "npx",
      "args": [
        "-y",
        "github:sammcj/mcp-snyk"
      ],
      "env": {
        "SNYK_API_KEY": "your_snyk_token",
        "SNYK_ORG_ID": "your_default_org_id"  // Optional: Configure the default organization ID
      }
    }
  }
}

Replace the token with your actual Snyk API token. The organization ID can be configured in the following ways:

1. Through the SNYK_ORG_ID environment variable in the MCP settings (as shown above).
2. Using the Snyk CLI command: snyk config set org=your-org-id.
3. Provided directly in the command.

The server will attempt to obtain the organization ID in the above order until a valid configuration is found.

Configuration Verification

You can verify if your Snyk token configuration is correct by having Claude run the verification token command:

Verify my Snyk token configuration

This will check the validity of the token and display your Snyk user information. If you have installed the Snyk CLI and configured it, it will also display the organization ID configured in the CLI.

✨ Features

• Scan security vulnerabilities in repositories using GitHub/GitLab URLs.
• Scan Snyk projects.
• Integrate with Claude desktop.
• Token verification.
• Multiple options for configuring the organization ID.
• Integrate with the Snyk CLI to obtain the organization ID.

💻 Usage Examples

Basic Usage

To scan a repository, you must provide its GitHub or GitLab URL:

Scan the security vulnerabilities of the repository https://github.com/owner/repo

⚠️ Important Note

The repository scanning command requires an actual repository URL (e.g., https://github.com/owner/repo). Do not use local file paths - always use the actual URL of the repository on GitHub or GitLab.

For Snyk projects:

Scan the Snyk project project-id-here

Organization ID Configuration

The server will look for the organization ID in the following order:

1. Command parameters (if provided).
2. The environment variable SNYK_ORG_ID in the MCP settings.
3. The Snyk CLI configuration (snyk config get org).

You only need to specify the organization ID in the command if you want to override the configured value.

Scan the repository https://github.com/owner/repo in the organization org-id-here

Snyk CLI Integration

If the Snyk CLI is installed (npm install -g snyk), the server can use it to:

• Obtain the default organization ID.
• Fall back to the CLI configuration when the MCP settings do not provide it.
• Display the CLI configuration details in the token verification output.

This integration allows you to use the same organization ID between the CLI and the MCP server, which is more convenient.