Snyk MCP Scan CLI Extension

Overview

This module implements the Snyk CLI Extension to scan your MCP tools.

Local development

This extension is compiled into the Snyk CLI and, at runtime, downloads the agent-scan binary from GitHub Releases and verifies its SHA-256 checksum before running it. To develop against local changes in both this extension and the agent-scan binary, wire the pieces together as follows.

Prerequisites

• The repositories checked out as siblings, because the CLI's replace directive resolves this extension via a relative path (../../cli-extension-agent-scan):

  <workspace>/
  ├── cli/                        # github.com/snyk/cli
  ├── cli-extension-agent-scan/   # this repo
  └── agent-scan/                 # github.com/snyk/agent-scan
  

1. Build a local agent-scan binary

From the agent-scan repo, build the standalone binary (output: dist/agent-scan):

cd ../agent-scan
make binary

2. Point the Snyk CLI at your local extension

Clone snyk/cli as a sibling directory, then in cliv2/go.mod uncomment the local replace directive so the CLI builds against your working copy instead of a published version:

replace github.com/snyk/cli-extension-agent-scan => ../../cli-extension-agent-scan

Then sync and build the CLI:

cd ../cli/
make clean
make build

The last line should be something like: -- Installing ( <Some-path>/cli/binary-releases/snyk-macos-arm64 )

This is the built Snyk CLI binary.

3. Point the extension at your local agent-scan binary

Set SNYK_AGENT_SCAN_BINARY_PATH to the binary from step 1. When set, the extension uses that binary directly and skips the download, cache, and checksum verification. This is for local development only and must never be relied on in production.

export SNYK_AGENT_SCAN_BINARY_PATH="$(pwd)/../../agent-scan/dist/agent-scan"

4. Run

Invoke the locally built CLI binary produced by step 2 (the exact path is platform-specific, e.g. cliv2/bin/snyk_darwin_arm64).

<Some-path>/cli/binary-releases/snyk-macos-arm64 agent-scan --experimental

Useful options

If the Snyk CLI is already authenticated, you do not need to provide a push key. The extension will find your tenant (or ask you to choose one) and request a push key automatically.

You can also provide the push key yourself using --client-id. The name is kept for compatibility; in this context, the client ID is the Agent Scan push key:

<Some-path>/cli/binary-releases/snyk-macos-arm64 agent-scan \
  --experimental \
  --client-id=<push-key>

Starting with Agent Scan 0.5.17, the analysis backend can process scans asynchronously. That is useful when you only need to submit the scan, but it means the command might finish before the analysis results are available. Add --show-analysis-results when you want to wait for analysis and see the results in the terminal:

<Some-path>/cli/binary-releases/snyk-macos-arm64 agent-scan \
  --experimental \
  --show-analysis-results

When using --json without supplying --client-id, also provide --tenant-id. JSON mode cannot show the interactive tenant picker that is used when several tenants are available:

<Some-path>/cli/binary-releases/snyk-macos-arm64 agent-scan \
  --experimental \
  --tenant-id=<tenant-id> \
  --show-analysis-results \
  --json

To return to the normal download-and-verify behavior, unset SNYK_AGENT_SCAN_BINARY_PATH.

Contributing

This repository is closed to public contributions.