invariantlabs-ai

mcp-scan (Invariant Labs)

Name: mcp-scan (Invariant Labs)
Author: invariantlabs-ai

Security community intermediate

SOURCE https://github.com/snyk/agent-scan

Description

- Auto-discover MCP configurations, agent tools, skills - Scanning of Claude, Cursor, Windsurf, Gemini CLI, and other agents. - Detects [15+ distinct security risks](docs/issue-codes.md) across MCP servers and agent skills:

Installation

This entry records only its repository, not the path inside it, so there is no exact command to give. Open the source below and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

Repository README

This is the README for snyk/agent-scan, shared by 2 entries in this directory. It describes the repository, not this entry specifically.

Snyk Agent Scan

Discover and scan agent components on your machine for prompt injections

and vulnerabilities (including agents, MCP servers, skills).

**NEW** Read our [technical report on the emerging threats of the agent skill eco-system](.github/reports/skills-report.pdf) published together with Agent Scan 0.4, which adds support for scanning agent skills.

Agent Scan helps you keep an inventory of all your installed agent components (harnesses, MCP servers, and skills) and scans them for common threats like prompt injections, sensitive data handling, or malware payloads hidden in natural language. **By default** it focuses on MCP servers; add `--skills` to autodiscover and scan agent skills.

Highlights

Auto-discover MCP configurations, agent tools, skills
Scanning of Claude, Cursor, Windsurf, Gemini CLI, and other agents.
Detects 15+ distinct security risks across MCP servers and agent skills:
- MCP: Prompt Injection, Tool Poisoning, Tool Shadowing, Toxic Flows
- Skills: Prompt Injection, Malware Payloads, Untrusted Content, Credential Handling, Hardcoded Secrets

Supported agents and capabilities

Agent Scan auto-discovers agents and their capabilities (MCP servers or skills) when their install paths exist. The table reflects [well-known agent definitions](src/agent_scan/well_known_clients.py).

✓: at least one path is defined for that capability.
✗: the agent is listed for that OS but has no paths for that capability.
—: that agent is not included for that OS.

...