Snyk Agent Scan is a security scanner that discovers and scans AI agent components on your machine for prompt injections and vulnerabilities.
The tool addresses the emerging security risks in agent ecosystems by identifying installed agent harnesses, Model Context Protocol servers, and agent skills, then analyzing them for threats including prompt injections, sensitive data handling issues, and malware payloads embedded in natural language. It performs local discovery and scanning without requiring external dependencies or cloud connectivity for the core scanning functionality.
The tool suits organizations deploying AI agents and MCP servers who need to audit their local agent infrastructure for security risks. It works for teams integrating multiple agent components and wanting visibility into potential vulnerabilities before they reach production. The README notes that enterprise customers using Snyk for agent security management at scale should contact their account team, as the underlying integration and risk assessment powering enterprise deployments differs from the CLI output. The tool can optionally skip skill scanning using a command-line flag for users who only need to assess agents and servers.
Development activity shows active iteration on the output format and risk assessment model. The project has undergone significant structural changes between versions, moving from issue-code-based reporting to risk-indicator scoring, with the README explicitly warning that CLI output remains experimental and subject to change. The maintainers have published a technical report on emerging threats in the agent skill ecosystem alongside a major release. The tool is distributed via PyPI and as standalone binaries rather than through npm, indicating a deliberate choice about distribution channels for this Python-based security scanner.
