agent-scan

Why we included this project

As teams wire more agents and MCP servers into their workflows, the attack surface those components introduce rarely gets checked. Agent Scan, a CLI from Snyk, builds an inventory of the agent components installed on a machine, covering Claude Code, Cursor, VS Code, Gemini CLI, Windsurf, and similar tools, then scans their configs and skills for prompt injections, tool poisoning, hardcoded secrets, and malware payloads hidden in natural language. It auto-discovers components across system, user, project, and extension scopes, which helps you see what is actually present before adopting a third-party skill or sharing an MCP config. One caveat: scanning an MCP configuration executes the server commands it defines, so run scans in a sandbox or read the consent prompt carefully when evaluating untrusted configs. For engineers responsible for securing agent deployments, that gives an audit-style view of exposure that manual code review does not easily provide.