AI Defense Stack

Agent & MCP security

MCP-Scan (Snyk Agent Scan): MCP server and agent skill security scanner

MCP-Scan is an MCP server and agent skill security scanner from Snyk (Invariant Labs). It is open source under the Apache-2.0 license and is offered as: CLI, SaaS. The vendor's page now calls it Snyk Agent Scan.

  • Last reviewed
Visit MCP-Scan (opens in a new tab) Documentation (opens in a new tab) Source code (opens in a new tab)
Open sourceApache-2.0 Now Snyk Agent Scan Layer 7: Agent and tool access

Best for

Developers who want to check the MCP servers and agent skills installed in their coding agents before they trust them

Ownership

Snyk announced on June 24, 2025 that it has acquired Invariant Labs, the company that published MCP-Scan. Source, checked October 21, 2026: labs.snyk.io (opens in a new tab)

Consider instead if

  • You want a scanner with YARA and LLM analyzers that can also inspect MCP server source code and packages. See Cisco MCP Scanner.

What MCP-Scan does

Snyk Agent Scan, first published as MCP-Scan by Invariant Labs, is a command-line scanner for the components an AI agent relies on. It discovers agent configurations for clients such as Claude Code, Cursor, VS Code and Windsurf, then checks the MCP servers and agent skills they use for prompt injection, tool poisoning and related risks. You run it locally with uvx or a standalone binary. Analysis goes through Snyk's Agent Scan API, so the scan command needs a Snyk API token unless a push key is configured, and the README says scan details are sent to that API with secrets redacted. The code is Apache-2.0. The README also describes a scheduled background mode that reports to Snyk Evo.

This summary is our own wording of the sourced facts on this page.

Key facts

Each value links to the page that states it, with the date we checked it.

Vendor
Snyk (Invariant Labs) Source, checked October 21, 2026: labs.snyk.io (opens in a new tab)
Status
Renamed Source, checked October 21, 2026: github.com (opens in a new tab)
Current name
Snyk Agent Scan Source, checked October 21, 2026: github.com (opens in a new tab)
Ownership
Snyk announced on June 24, 2025 that it has acquired Invariant Labs, the company that published MCP-Scan. Source, checked October 21, 2026: labs.snyk.io (opens in a new tab)
Open source
Yes: Apache-2.0 Source, checked October 21, 2026: github.com (opens in a new tab)
Repository
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
GitHub stars
3,161 as of October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest push
October 21, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Latest release
October 20, 2026 Source, checked October 21, 2026: api.github.com (opens in a new tab)
Deployment
CLI, SaaS Source, checked October 21, 2026: github.com (opens in a new tab)
Pricing model
Not published in the sources we checked Source, checked October 21, 2026: github.com (opens in a new tab)
Website
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Documentation
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
API reference
Not documented in the sources we checked
Quickstart
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
First release
2025-04 Source, checked October 21, 2026: invariantlabs.ai (opens in a new tab)
Security page
github.com Source, checked October 21, 2026: github.com (opens in a new tab)
Attestations or disclosure
SECURITY.md points reporters to Snyk's documented process for reporting security issues Source, checked October 21, 2026: github.com (opens in a new tab)

Capabilities

As documented by the vendor or project. The tag is our label from a controlled vocabulary.

Integrations

Where MCP-Scan fits in our AI security layers

Our analysis

Our editorial model, not a standard. The primary layer follows the category, except for tools whose main documented job is detection and response; other layers rest on a capability the sources document. How the model works.

AI security layers that MCP-Scan covers, with the role, how each applies and what it rests on
LayerRoleHow it appliesBased on
L7 Agent access Agent and tool access Primary Limit which tools, MCP servers, data and credentials an agent can use, and require approval for risky actions. Follows its category, Agent & MCP security
L3 Supply chain Model and supply chain Also covers Documents scanning of MCP servers and skills for tool poisoning, with tool pinning. Scans MCP servers, including their tools, prompts and resources; Looks for tool poisoning and tool shadowing in MCP tool definitions; Launch post describes tool pinning that tracks changes to tool descriptions through hashing; Risk indicators for MCP servers include private data exposure and destructive capabilities (v0.6 and later)
L2 Discovery Discovery and posture Also covers Documents automatic discovery of agent configurations. Auto-discovers agent configurations for Claude Code, Cursor, VS Code, GitHub Copilot, Windsurf and Gemini CLI

OWASP LLM Top 10 mapping

Our analysis

The risk list is OWASP's (Top 10 for LLM Applications, 2025). The mapping is our analysis, and each row rests on a capability the sources document.

OWASP LLM risks mapped to MCP-Scan, with the capabilities each mapping rests on
RiskHow it appliesBased on
LLM01 Prompt Injection Looks for prompt injection and hidden instructions in MCP tool definitions and agent skills. Looks for tool poisoning and tool shadowing in MCP tool definitions; Flags prompt injection in the MCP servers and agent skills it scans; Launch post describes tool pinning that tracks changes to tool descriptions through hashing
LLM06 Excessive Agency Reports a destructive capabilities risk indicator for the MCP servers an agent can call. Scans MCP servers, including their tools, prompts and resources; Risk indicators for MCP servers include private data exposure and destructive capabilities (v0.6 and later)

Not mapped in our analysis: LLM02, LLM05, LLM07. These are risks we expect tools in this category to cover; the sources we checked do not document a matching capability.

Alternatives and related tools

More in Agent & MCP security, ranked within the category by Coverage Score.

Cisco DefenseClaw

Cisco

Open sourceApache-2.0
  • CLI
  • Self-hosted

Scans skills and MCP servers, inspects agent tool calls and keeps an audit trail around AI coding agents.

Best for: Security teams that want scanning, guardrails and an audit trail around the coding agents developers already run, starting in observe mode before anything is blocked

Coverage Score 76 out of 100
  • LLM01 Prompt Injection
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

Docker MCP Gateway

Docker

Open sourceMIT
  • CLI
  • Self-hosted

Proxies AI clients to MCP servers it runs as isolated Docker containers, with tool filters and call logs.

Best for: Developers and platform teams that already use Docker and want MCP servers to run in containers behind one gateway with per-server tool selection

Coverage Score 72 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

agentgateway

agentgateway (a Series of LF Projects, LLC)

Open sourceApache-2.0
  • CLI
  • Self-hosted
  • Cloud-native

Open-source proxy that applies auth, CEL policy and guardrails to LLM, MCP and agent-to-agent traffic.

Best for: Platform teams that want one open-source gateway in front of MCP servers and LLM providers, with token validation, CEL rules per MCP method and pluggable guardrails

Coverage Score 69 out of 100
  • LLM02 Sensitive Information Disclosure
  • LLM06 Excessive Agency

Reviewed

MCP-Scan FAQ

Is MCP-Scan the same as Snyk Agent Scan?

Yes. The project is now published as Snyk Agent Scan. The old GitHub repository name invariantlabs-ai/mcp-scan resolves to snyk/agent-scan, and Snyk announced its acquisition of Invariant Labs on June 24, 2025.

Is it open source?

The code is Apache-2.0 licensed on GitHub. The scan command needs a Snyk API token unless a push key is configured, and the analysis runs through Snyk's Agent Scan API.

What does it scan?

MCP servers with their tools, prompts and resources, agent skills, and the agent configurations it discovers for clients such as Claude Code, Cursor, VS Code, GitHub Copilot, Windsurf and Gemini CLI.

Key facts you can cite

We have no commercial relationship with Snyk (Invariant Labs).

Sources & last reviewed

Last reviewed . We compile from the vendors' own public pages and repositories and we do not run the products. Source links open in a new tab. Found a mistake? Report a correction.