Skip to content

agent-scan: check MCP servers and skills before installing

AI tools · Security
Not studied

Added 2026-10-29.

Problem

An MCP server or a skill from a catalog gets access to the agent's files, tokens and commands. A tool description can hide an instruction for the model; a skill can hide a malicious script.

Solution

Snyk Agent Scan (formerly invariantlabs-ai/mcp-scan) is built to "discover and scan agent components on your machine for prompt injections and vulnerabilities (including agents, MCP servers, skills)". It finds prompt injection in tool descriptions, hidden payloads in skills and toxic flows, and discovers Claude Code/Desktop, Cursor and Gemini CLI configurations on its own. Run every component through it before installing.

Example

export SNYK_TOKEN=<Snyk token>
uvx snyk-agent-scan@0.6.9                       # discover and scan everything installed
uvx snyk-agent-scan@0.6.9 ~/.claude/skills      # scan skills
uvx snyk-agent-scan@0.6.9 ./new-skill/SKILL.md  # scan a single skill before installing

The scanner starts MCP servers

To get the list of tools, the scanner connects to the server, and a stdio server has to be started for that — that is, its code gets executed. In interactive mode the scanner asks for consent for each server. Check unfamiliar configurations in a container or a throwaway VM.

Limitations

A Snyk account is required; component descriptions are sent to an external API for analysis — don't scan internal tools without approval. The result is a risk assessment, not a guarantee.

Source

How to apply it yourself

  1. Pin the CLI version.
  2. Run it against the skills and MCP servers already installed.
  3. Check every new component before installing, unfamiliar ones in a container.
  4. Mark it "Studied" once the check is a mandatory step.