Scanning AI agents means executing them first

What it does Snyk Agent Scan is a CLI tool that auto-discovers AI agent components living on your machine—MCP servers, skills, and harnesses—and audits them for security flaws. It flags over 15 distinct issue types, including prompt injection, tool poisoning, toxic flows, and hardcoded secrets, across popular tools like Claude, Cursor, Windsurf, and Gemini CLI. The scanner works interactively or can run in the background as a fleet monitor via MDM or Crowdstrike.

The interesting bit To analyze an MCP server, the scanner must execute it to retrieve tool descriptions, which means it runs the very code it is trying to vet. It handles this by demanding interactive consent for each server and displaying the exact command and redacted environment variables before launch, but the core premise remains: trust the binary long enough to scan it.

Key highlights

• Auto-discovers agent configurations across macOS, Linux, and Windows for more than a dozen agents.
• Detects 15+ security risks, from prompt injection and tool shadowing to malware payloads hidden in natural-language skills.
• Interactive consent flow forces per-server approval before executing MCP commands during scans.
• Background mode integrates with Snyk Evo for centralized fleet monitoring.
• Analysis is hybrid: local checks are augmented by sending component metadata to Snyk’s API.

Caveats

• Scanning an MCP config inherently executes the commands defined inside it; non-interactive use requires a --dangerously-run-mcp-servers flag.
• When configured with a Snyk-managed control server, the tool sends a detailed host fingerprint—including hostname, username, home directories, and shell details—as a bootstrap payload on startup.
• It is not a fully offline scanner; skills, tool names, and descriptions are transmitted to Snyk for validation.

Verdict Worth a look if you’re running multiple AI agents and want to inventory your local supply chain. Skip it if you need an air-gapped scanner or are uncomfortable with a security tool that executes the binaries it audits.