---
title: "snyk"
description: "Scan code, dependencies, containers and IaC with Snyk's first-party MCP server (shipped inside the pinned Snyk CLI), with the snyk-security-scan workflow skill bundled."
canonical: https://agentpluginsdirectory.com/plugins/snyk
last-updated: 2026-09-13
---

# snyk
Scan code, dependencies, containers and IaC with Snyk's first-party MCP server (shipped inside the pinned Snyk CLI), with the snyk-security-scan workflow skill bundled.
- Slug: snyk
- Publisher: Nous Research
- Repository: https://github.com/NousResearch/hermes-plugin-snyk
- Manifest: plugin.json
- Version: 1.0.0
- License: MIT
- Category (editorial): other
- Skills: 1 (snyk-security-scan)
- MCP servers: 1 (sn)
- Stars: 2
- Repository created: 2026-09-12
- Repository last pushed: 2026-09-12
- Publisher type: Organization
- Listing: https://agentpluginsdirectory.com/plugins/snyk
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json

## What snyk does, in the publisher's words

Scan code, dependencies, container images, IaC and SBOMs from Hermes Agent through Snyk's first-party MCP server. Snyk ships the server inside the Snyk CLI (snyk mcp is a vendor subcommand, not a community wrapper), so this plugin is a pinned npx stdio launch plus a workflow skill.

This is a portable Agent Plugins v1 package. One install ships:

- mcp.json: the Snyk MCP server entry (sn), registered for every new session while the plugin is enabled. No mcp_servers edits in config.yaml.
- skills/snyk-security-scan/: the workflow skill: when to use which scanner, the auth/trust/scan/fix loop, pitfalls, and a full per-tool argument reference generated from the live server.

From the project README, punctuation lightly normalized. Full text: https://raw.githubusercontent.com/NousResearch/hermes-plugin-snyk/HEAD/README.md

## Skills

- snyk-security-scan: Scan code, dependencies, containers, IaC and SBOMs with Snyk via its first-party MCP server: authenticate, trust a folder, run the right scanner, read the findings, fix and re-scan. Includes package-health checks before adding a dependency.

Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.

## MCP servers

- sn: transport: stdio; command: npx -y snyk@1.1306.0 mcp -t stdio --profile full --DISABLE_ANALYTICS; env: SNYK_DISABLE_ANALYTICS

Read from the plugin's own mcp.json. Environment variable names only, never values.