snyk/agent-scan is a security scanner that inspects AI agents, MCP servers, and agent skills. The latest release is v0.6.9, and the changelog bundled with this version is not summarized in the provided material. The implementation language is Python, and the license is Apache-2.0. The repository was created on April 7, 2025, and the contents are published in the github.com/snyk/agent-scan repository.
Its inspection targets are the agent components already installed on the computer. It automatically locates harnesses, MCP servers, and skills, and checks for threats such as prompt injection (an attack that slips instructions in to change an agent's behavior), sensitive information handling, and malicious payloads hidden in natural language. The scope covers MCP server tools, prompts and resources, plus skills, and it can be run via uvx or a standalone binary. The star count is 3155.
That said, there are no figures in the material to gauge inspection performance. No detection rate or false positive rate benchmarks and no actual run results are presented; the record holds only a momentum score of 3.0, with no freshness, technology, or quality scores. Star count alone is also a poor way to judge quality. There is further the limitation that the inspection applies only to components installed on the computer. It seems suited to use as an auditing tool for looking over the installed components yourself, and it does not appear to be at the stage where its results should be taken at face value.