Snyk just dropped agent-scan, a dedicated security scanner built specifically for AI agents, MCP (Model Context Protocol) servers, and the agent skills that power modern autonomous workflows. The tool showed up on GitHub at github.com/snyk/agent-scan/, and it's already getting traction among developers who are tired of pretending traditional SAST tools can handle the novel attack surfaces that LLM-powered systems introduce.

What This Actually Scans

Unlike your standard vulnerability scanner, agent-scan targets three distinct layers of the AI agent ecosystem. First, there's the agents themselves—checking for prompt injection vectors, insecure tool-calling patterns, and overly permissive permissions. Then MCP servers, which handle context delivery between models and external systems—if these get compromised, attackers have a direct line into what the agent knows. Finally, agent skills: the modular capabilities that let agents do things like send emails, query databases, or execute code. Each skill is a potential entry point if it trusts unvalidated inputs.

The Attack Surface Nobody's Talking About

Here's the uncomfortable truth nobody in enterprise AI wants to discuss out loud: most organizations deploying AI agents today have zero visibility into what's actually running inside them. Agent skills pull in third-party code. MCP servers expose internal APIs. And the agents themselves? They're making decisions based on prompts that might've been tampered with mid-conversation. Traditional scanners can't see any of this because they weren't built for it. Snyk's taking a swing at fixing that gap, and honestly, it's about time someone did.

Why MCP Servers Are the Real Risk

The MCP angle is particularly interesting. Model Context Protocol servers are relatively new infrastructure—Google pushed them hard as part of their agent ecosystem push—and they're essentially middleware that lets AI models interact with external tools and data sources. If an attacker can compromise an MCP server, they don't just get one system's data; they potentially get access to everything the connected agent has visibility into. Snyk scanning these specifically suggests they've done their threat modeling homework.

Key Takeaways

  • Agent-scan targets three distinct layers: AI agents themselves, MCP servers, and modular agent skills—each with unique vulnerability profiles that traditional SAST tools miss entirely.
  • Prompt injection, insecure tool-calling patterns, and overly permissive permissions are the primary attack vectors for AI agents that Snyk is now scanning for explicitly.
  • MCP server compromise gives attackers direct access to everything a connected agent can see, making these middleware components a high-value target in enterprise deployments.

The Bottom Line

Snyk's agent-scan is a necessary step forward in AI security tooling—acknowledging that agents, MCP servers, and skills have distinct vulnerabilities that won't get caught by legacy scanners. Whether it actually delivers on that promise depends on how fast the community stress-tests it against real-world agent architectures.