snyk/agent-scan

Review signals: 91 known vulnerability. 5 static matches retained as context.

OSV reports a known vulnerability in this dependency version. 5 distinct locations. 91 findings.

5 hardcoded secret matches retained as context; full list in the evidence.

OSV scanned supported lockfiles; unpinned dependencies and unsupported formats are outside this check.

A short run cannot establish that code is safe.

Connections show IP addresses; proxies can hide the final hostname.

Tracing covers dispatched commands and their children, not the whole OS; guest root can interfere with tracing.

Full safety evidence →

[
  {
    "status": "PASS",
    "details": {
      "working": false,
      "argv": [
        "<guest-path>",
        "--python",
        "3.13",
        "snyk-agent-scan@latest",
        "scan",
        "/tmp/scan-work/mcp.json",
        "--dangerously-run-mcp-servers",
        "--no-skills"
      ],
      "kind": "cli",
      "returncode": 1,
      "stdout": "Snyk Agent Scan v0.6.9\n\n--dangerously-run-mcp-servers is set: contacting every MCP server listed in the \nscanned configs without prompting. This starts stdio subprocesses and connects \nto remote URLs.\nTip: set --suppress-mcpserver-io=true to hide server stderr output.\n\n[Demo MCP Server] [10/23/26 15:39:56] INFO     Processing request of type       \nserver.py:733\n[Demo MCP Server]                              ListPromptsRequest               \n[Demo MCP Server]                     INFO     Processing request of type       \nserver.py:733\n[excerpt truncated]",
      "stderr": "",
      "needs_credentials": true,
      "needs_browser": false,
      "scope": "partial: missing credentials"
    },
    "check": "credentials_error",
    "optional": false
  }
]

• inspect lists the tools of configured MCP servers without analysis: Real input produced the expected result: get_current_time

  Source: Inspect components without analysis

  Input: /tmp/scan-work/mcp.json pointing at the demo MCP server

  Expected: tool names such as get_current_time are printed

  Command: <guest-path> --python 3.13 snyk-agent-scan@latest inspect /tmp/scan-work/mcp.json --dangerously-run-mcp-servers --suppress-mcpserver-io=true

  Observed: get_current_time ├── tool sum ├── tool multiply ├── tool get_comments ├── tool get_api_key ├── tool send_email └── tool delete_file

• the bundled demo MCP server exposes tools that Agent Scan reports: Real input produced the expected result: delete_file

  Source: This repository includes a vulnerable MCP server that demonstrates Model Context Protocol security findings that Agent Scan reports.

  Input: /tmp/scan-work/mcp.json pointing at demoserver/server.py

  Expected: the delete_file tool is listed

  Command: <guest-path> --python 3.13 snyk-agent-scan@latest inspect /tmp/scan-work/mcp.json --dangerously-run-mcp-servers --suppress-mcpserver-io=true

  Observed: delete_file

• token-based analysis needs a Snyk API token: scan needs SNYK_TOKEN from a Snyk account (app.snyk.io); no credential is available in this guest. Scan without the token was run and exits 1 asking for SNYK_TOKEN; see probe.json credentials_error check

  Source: Set the token as an environment variable

  Observed: scan needs SNYK_TOKEN from a Snyk account (app.snyk.io); no credential is available in this guest. Scan without the token was run and exits 1 asking for SNYK_TOKEN; see probe.json credentials_error check

Examples

• inspect without security analysis on a machine with no agent configs: command completed successfully

  Source: README.md Examples: # Inspect without security analysis

  Input: no arguments

  Expected: reports that no MCP client configurations were found

  Command: <guest-path> --python 3.13 snyk-agent-scan@latest inspect

  Observed: Snyk Agent Scan v0.6.9 No MCP client configurations found on this machine.

• inspect the demo MCP server from the README demo config: command completed successfully

  Source: README.md Demo: step 2 mcp.json and step 3

  Input: demo config at /tmp/scan-work/mcp.json, absolute uv and repo paths

  Expected: lists the demo tools including delete_file

  Command: <guest-path> --python 3.13 snyk-agent-scan@latest inspect /tmp/scan-work/mcp.json --dangerously-run-mcp-servers --suppress-mcpserver-io=true

  Observed: Snyk Agent Scan v0.6.9 --dangerously-run-mcp-servers is set: contacting every MCP server listed in the scanned configs without prompting. This starts stdio subprocesses and connects to remote URLs. ● Scanning /tmp/scan-work/mcp.json found 1 mcp server │ └── Demo MCP Server ├── tool get_current_time ├── tool sum ├── tool multiply ├── tool get_comments ├── tool get_api_key ├── tool send_email └── tool delete_file

Local or hosted: both

Snyk Agent Scan CLI (snyk-agent-scan v0.6.9 from PyPI): inspect the demo MCP server's tools, and scan MCP configs for risks

cd <guest-path> && pwd && ls -la && git status 2>&1 | head -3; id -u; python3 --version; cat /etc/os-release | head -2; ls /inputs 2>&1
cd <guest-path> && cat README.md 2>/dev/null | head -300
cd <guest-path> && sed -n 300,400p README.md; echo ----; cat .python-version; echo ----; grep -n -i "install\|uv \|pip" CONTRIBUTING.md Makefile | head -40; ls .coldpass; which uv uvx curl; env | grep -i -E "proxy|snyk" | sed 's/=.*/=<set>/'
cd <guest-path> && git init -q && git remote add origin https://github.com/snyk/agent-scan && git fetch --depth 1 origin a8c8c5879a008edacb2a50d1a9fe0a40ee91d205 2>&1 | tail -3; git reset --mixed FETCH_HEAD 2>&1 | tail -2; git log --oneline -1 2>&1; git status --short | head -5
curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh 2>&1; echo rc=$?; ls -la /tmp/uv-install.sh 2>&1; (env NODE_USE_ENV_PROXY=1 sh /tmp/uv-install.sh 2>&1 | tail -5); echo rc=$?; ls ~/.local/bin 2>/dev/null
cd /tmp && export PATH=$HOME/.local/bin:$PATH && uv --version && uvx --python 3.13 [email protected] --version 2>&1 | tail -5; echo rc=$?; uvx --python 3.13 snyk-agent-scan@latest --help 2>&1 | head -60
cd <guest-path> && ls demoserver && sed -n 1,80p demoserver/server.py | head -80; echo ----; grep -n "dependencies" -A12 pyproject.toml | head -30; echo; ls docs help | head; cat .coldpass/* 2>/dev/null | head -5; ls -la .coldpass
mkdir -p /tmp/scan-work && cat > /tmp/scan-work/mcp.json <<'EOF'
{
  "mcpServers": {
    "Demo MCP Server": {
      "type": "stdio",
      "command": "<host-path>",
      "args": ["run", "--directory", "<guest-path>", "mcp", "run", "demoserver/server.py"]
    }
  }
}
EOF
cd /tmp && export PATH=$HOME/.local/bin:$PATH; echo HOME=$HOME; ls -la <host-path> 2>&1; timeout 600 uvx --python 3.13 snyk-agent-scan@latest inspect /tmp/scan-work/mcp.json --dangerously-run-mcp-servers --print-errors 2>&1 | tail -60; echo rc=${PIPESTATUS[0]}
cd /tmp && export PATH=$HOME/.local/bin:$PATH; U=$(command -v uv); echo $U; sed -i "s#<host-path>" /tmp/scan-work/mcp.json && cat /tmp/scan-work/mcp.json && timeout 900 uvx --python 3.13 snyk-agent-scan@latest inspect /tmp/scan-work/mcp.json --dangerously-run-mcp-servers --suppress-mcpserver-io=true 2>&1 | tail -80; echo rc=${PIPESTATUS[0]}
cd /tmp && export PATH=$HOME/.local/bin:$PATH; env -u SNYK_TOKEN timeout 900 uvx --python 3.13 snyk-agent-scan@latest scan /tmp/scan-work/mcp.json --dangerously-run-mcp-servers --suppress-mcpserver-io=true --no-skills 2>&1 | tail -30; echo rc=${PIPESTATUS[0]}
ls -la <guest-path> 2>&1; ls <guest-path>; cd <guest-path> && grep -rn -i "interval\|cron\|schedul\|while True\|--once\|--now\|background" src --include=*.py | grep -v test | head -30; echo ---; grep -n "^def \|add_argument(\"--" src/agent_scan/run.py | head -60
cd <guest-path> && grep -n "expected_returncode\|credentials_error\|\"checks\"\|'checks'\|testable\|\"reason\"\|deferred\|stays_running\|expected_file" check.py | head -60; grep -n "def main\|argparse\|add_argument" check.py | head
cd <guest-path> && sed -n 696,712p check.py; sed -n 1128,1140p check.py; sed -n 1273,1300p check.py
cd /tmp && U=<guest-path>; timeout 900 $U --python 3.13 snyk-agent-scan@latest inspect </dev/null 2>&1 | tail -15; echo rc=${PIPESTATUS[0]}; cd <guest-path> && grep -c "Inspect components without analysis" README.md; grep -n "This repository includes a vulnerable MCP server that demonstrates Model Context Protocol security findings that Agent Scan reports." README.md | cut -c1-20; grep -n "snyk-agent-scan inspect \[CONFIG_FILE...\]    Inspect components without analysis" README.md | cut -c1-30
cd <guest-path> && U=<guest-path> && cat > probe.json <<EOF
{"checks":[
 {"check":"operation","kind":"cli","argv":["$U","--python","3.13","snyk-agent-scan@latest","inspect","/tmp/scan-work/mcp.json","--dangerously-run-mcp-servers","--suppress-mcpserver-io=true"],"cwd":"/tmp","expected_text":"get_current_time"},
 {"check":"credentials_error","kind":"cli","argv":["$U","--python","3.13","snyk-agent-scan@latest","scan","/tmp/scan-work/mcp.json","--dangerously-run-mcp-servers","--no-skills"],"cwd":"/tmp","expected_returncode":1}
]}
EOF
cat > claims.json <<EOF
[
 {"kind":"claim","claim":"inspect lists the tools of configured MCP servers without analysis","source":"Inspect components without analysis","input":"/tmp/scan-work/mcp.json pointing at the demo MCP server","expected":"tool names such as get_current_time are printed","probe_kind":"cli","argv":["$U","--python","3.13","snyk-agent-scan@latest","inspect","/tmp/scan-work/mcp.json","--dangerously-run-mcp-servers","--suppress-mcpserver-io=true"],"cwd":"/tmp","expected_text":"get_current_time"},
 {"kind":"claim","claim":"the bundled demo MCP server exposes tools that Agent Scan reports","source":"This repository includes a vulnerable MCP server that demonstrates Model Context Protocol security findings that Agent Scan reports.","input":"/tmp/scan-work/mcp.json pointing at demoserver/server.py","expected":"the delete_file tool is listed","probe_kind":"cli","argv":["$U","--python","3.13","snyk-agent-scan@latest","inspect","/tmp/scan-work/mcp.json","--dangerously-run-mcp-servers","--suppress-mcpserver-io=true"],"cwd":"/tmp","expected_text":"delete_file"},
 {"kind":"claim","claim":"token-based analysis needs a Snyk API token","source":"Set the token as an environment variable","testable":false,"reason":"scan needs SNYK_TOKEN from a Snyk account (app.snyk.io); no credential is available in this guest. Scan without the token was run and exits 1 asking for SNYK_TOKEN; see probe.json credentials_error check"}
]
EOF
cat > examples.json <<EOF
[
 {"kind":"example","claim":"inspect without security analysis on a machine with no agent configs","source":"README.md Examples: # Inspect without security analysis","input":"no arguments","expected":"reports that no MCP client configurations were found","argv":["$U","--python","3.13","snyk-agent-scan@latest","inspect"],"cwd":"/tmp","stdin":"","expected_text":"No MCP client configurations found on this machine."},
 {"kind":"example","claim":"inspect the demo MCP server from the README demo config","source":"README.md Demo: step 2 mcp.json and step 3","input":"demo config at /tmp/scan-work/mcp.json, absolute uv and repo paths","expected":"lists the demo tools including delete_file","argv":["$U","--python","3.13","snyk-agent-scan@latest","inspect","/tmp/scan-work/mcp.json","--dangerously-run-mcp-servers","--suppress-mcpserver-io=true"],"cwd":"/tmp","stdin":"","expected_text":"delete_file"}
]
EOF
cat > cycles.json <<'EOF'
{"detected":false,"reason":"Entry points inspected: src/agent_scan/run.py and cli.py are one-shot commands (scan, inspect, help, evo, guard). The only loop-like code is in traffic_capture.py and agents/base.py, which are not schedulers. README 'Background Mode (MDM)' scans on a schedule but reports to an external Snyk Evo service that is not in this repository and needs a Snyk account; no local cron, --once, or --now trigger exists in the product. Nothing was run as a cycle.","checks":[]}
EOF
for f in probe claims examples cycles; do python3 -m json.tool $f.json >/dev/null && echo "$f ok"; done; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -m json.tool | head -150
pgrep -fa "demoserver|snyk-agent-scan|mcp run" || echo "no leftover processes"; mkdir -p <guest-path> && cat > <guest-path> <<'EOF'
{"outcome":"needs_credentials",
 "fault_owner":"prerequisite",
 "operation":"Snyk Agent Scan CLI (snyk-agent-scan v0.6.9 from PyPI): inspect the demo MCP server's tools, and scan MCP configs for risks",
 "operation_scope":"Working without a Snyk account: the inspect command lists the tools of the bundled demo MCP server. The full scan (risk analysis through the Snyk API) needs a SNYK_TOKEN from app.snyk.io, which was not available in this guest. Background Mode (Snyk Evo) is outside this repository.",
 "steps":[
  "git init; git remote add origin https://github.com/snyk/agent-scan; git fetch --depth 1 origin a8c8c5879a008edacb2a50d1a9fe0a40ee91d205; git reset --mixed FETCH_HEAD",
  "curl -LsSf https://astral.sh/uv/install.sh -o /tmp/uv-install.sh; env NODE_USE_ENV_PROXY=1 sh /tmp/uv-install.sh (uv 0.13.5 installed to <guest-path>)",
  "uvx --python 3.13 snyk-agent-scan@latest inspect /tmp/scan-work/mcp.json --dangerously-run-mcp-servers --suppress-mcpserver-io=true (run from /tmp; lists 7 demo tools)",
  "uvx --python 3.13 snyk-agent-scan@latest inspect (README Examples; reports no MCP configs on this machine)",
  "uvx --python 3.13 snyk-agent-scan@latest scan /tmp/scan-work/mcp.json --dangerously-run-mcp-servers --no-skills (exit 1: needs SNYK_TOKEN)"],
 "deviations":[
  "Guest python3 is 3.12.3; README requires Python 3.13 for uvx. Installed uv and let uvx fetch Python 3.13 (uvx --python 3.13). System Python was not changed.",
  "uv was installed by downloading the astral.sh installer to a file and running it, instead of piping curl into sh.",
  "README demo config runs `uv run mcp run demoserver/server.py` relative to the repo root. The config lives in /tmp/scan-work (outside the checkout), so it uses an absolute uv path and `uv run --directory <guest-path>",
  "Probes run with cwd /tmp instead of the checkout, because snyk-agent-scan is a published package (same rule as npx).",
  "The full `scan` needs SNYK_TOKEN, which is not provided. Recorded as a credentials_error check in probe.json and as a blocked claim. `--dangerously-run-mcp-servers` was used only on the bundled demo server in this disposable guest.",
  "Demo server writes /tmp/.small-mcp-server as a side effect (product source behavior)."],
 "stuck_step":"uvx --python 3.13 snyk-agent-scan@latest scan ... (requires SNYK_TOKEN)",
 "main_blocker":"The scan command needs a Snyk API token (SNYK_TOKEN). No token is available in this guest.",
 "plain_failure":"The tool runs and can list the tools of an MCP server without a login. The actual security scan will not run without a Snyk account token, and the tool asks for one and exits with an error.",
 "suggested_fix":"Provide a SNYK_TOKEN from a Snyk account to test the full scan. The inspect path already works and was verified with the bundled demo server."}
EOF
python3 -m json.tool <guest-path> >/dev/null && echo report ok; cd <guest-path> && <env-var>=<guest-path> python3 -I <guest-path> --validate --replay 2>&1 | python3 -c "import json,sys; d=json.load(sys.stdin); print('valid',d['valid'],'problems',d['problems'],'replay',d['replay']['status'])"