mcp-snyk

# Snyk MCP Server A standalone Model Context Protocol server for Snyk security scanning functionality. **WARNING: THIS MCP SERVER IS CURRENTLY IN ALPHA AND IS NOT YET FINISHED!** ## Configuration Update your Claude desktop config (`claude-config.json`): ```json { "mcpServers": { "snyk": { "command": "npx", "args": [ "-y", "github:sammcj/mcp-snyk" ], "env": { "SNYK_API_KEY": "your_snyk_token", "SNYK_ORG_ID": "your_default_org_id" // Optional: Configure a default organisation ID } } } } ``` Replace the token with your actual Snyk API token. The organisation ID can be configured in multiple ways: 1. In the MCP settings via `SNYK_ORG_ID` (as shown above) 2. Using the Snyk CLI: `snyk config set org=your-org-id` 3. Providing it directly in commands The server will try these methods in order until it finds a valid organisation ID. ### Verifying Configuration You can verify your Snyk token is configured correctly by asking Claude to run the verify_token command: ``` Verify my Snyk token configuration ``` This will check if your token is valid and show your Snyk user information. If you have the Snyk CLI installed and configured, it will also show your CLI-configured organization ID. ## Features - Repository security scanning using GitHub/GitLab URLs - Snyk project scanning - Integration with Claude desktop - Token verification - Multiple organization ID configuration options - Snyk CLI integration for organization ID lookup ## Usage To scan a repository, you must provide its GitHub or GitLab URL: ``` Scan repository https://github.com/owner/repo for security vulnerabilities ``` IMPORTANT: The scan_repository command requires the actual repository URL (e.g., https://github.com/owner/repo). Do not use local file paths - always use the repository's URL on GitHub or GitLab. For Snyk projects: ``` Scan Snyk project project-id-here ``` ### Organization ID Configuration The server will look for the organization ID in this order: 1. Command argument (if provided) 2. MCP settings environment variable (`SNYK_ORG_ID`) 3. Snyk CLI configuration (`snyk config get org`) You only need to specify the organization ID in your command if you want to override the configured values: ``` Scan repository https://github.com/owner/repo in organisation org-id-here ``` ### Snyk CLI Integration If you have the Snyk CLI installed (`npm install -g snyk`), the server can use it to: - Get your default organisation ID - Fall back to CLI configuration when MCP settings are not provided - Show CLI configuration details in token verification output This integration makes it easier to use the same organisation ID across both CLI and MCP server usage.