Server data from the Official MCP Registry
MCP server for Snyk API & Web — DAST scanning, findings management, and vulnerability triage
MCP server for Snyk API & Web — DAST scanning, findings management, and vulnerability triage
The Snyk API & Web MCP server is a well-structured tool for managing security scanning targets. Authentication is properly enforced via API keys loaded from environment variables or config files. However, there are several moderate-severity concerns: credentials can be passed inline in some tool parameters (creating exfiltration risk if logs are captured), the server accepts and forwards user-provided credentials without explicit warnings about secure storage, and there is insufficient validation/sanitization on some user inputs (URLs, field names). Additionally, the tool's broad network access and ability to configure authentication on behalf of users requires careful permission scoping. No malicious patterns or hardcoded secrets were detected. Supply chain analysis found 8 known vulnerabilities in dependencies (1 critical, 3 high severity). Package verification found 1 issue.
4 files analyzed · 17 issues found
Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.
This plugin requests these system permissions. Most are normal for its category.
Set these up before or after installing:
Environment variable: MCP_SAW_API_KEY
Add this to your MCP configuration file:
{
"mcpServers": {
"io-github-snyk-saw-mcp": {
"env": {
"MCP_SAW_API_KEY": "your-mcp-saw-api-key-here"
},
"args": [
"snyk-apiweb-mcp"
],
"command": "uvx"
}
}
}From the project's GitHub README.

Connect your AI coding assistant to Snyk API & Web so it can onboard scan targets, configure authentication, run DAST scans, and triage findings — all through natural language.
Built on FastMCP 2.0, works with Cursor, Claude Code, Devin, Windsurf, and any MCP-compatible client.
Naming note: Snyk API & Web was formerly known as Probely. The API endpoints (
api.probely.com), web console (plus.probely.app), and MCP tool names (probely_*) still use the legacy domain and prefix. Environment variables and config sections use the newSAW/sawnaming.
See USER_GUIDE.md for usage, examples, and tool reference.
This repository is closed to public contributions. We appreciate community interest, but we do not accept pull requests, issues, or other contributions from external contributors at this time. If you have found a security issue, please see SECURITY.md.
Go to https://plus.probely.app/api-keys and create an API key.
Important
Use a custom role, limited-scope API key for the Snyk API & Web MCP Server. Create the key only with the permissions required for the intended actions. Do not use a highly privileged or global API key, as this can affect your entire account and its resources.
Install directly from the Cursor Marketplace:
export MCP_SAW_API_KEY="your-api-key"
The plugin installs the MCP server, rules, and skills automatically.
uvx --from git+https://github.com/snyk/saw-mcp.git saw-mcp
Or add to your MCP client configuration:
{
"mcpServers": {
"SAW": {
"command": "uvx",
"args": ["--from", "git+https://github.com/snyk/saw-mcp.git", "saw-mcp"],
"env": {
"MCP_SAW_API_KEY": "your-api-key"
}
}
}
}
Install from release tarball
tar -xzvf SnykAPIWeb-<version>.tgz
cd SnykAPIWeb
python -m venv venv
source venv/bin/activate # On Windows: venv\Scripts\activate
pip install -r requirements.txt
Download from Releases and replace <version> with the actual version number (e.g., 1.0.0).
Clone from source
git clone https://github.com/snyk/saw-mcp.git
cd saw-mcp
python -m venv venv
source venv/bin/activate # On Windows: venv\Scripts\activate
pip install -r requirements.txt
The server reads your API key from (in order of precedence): environment variable MCP_SAW_API_KEY → .env file → config/config.yaml.
Option A: Environment variable (recommended for Marketplace / uvx installs)
export MCP_SAW_API_KEY="your-api-key"
Option B: .env file (recommended for source installs)
Run the setup script (prompts securely, no key in shell history):
./scripts/setup-env.sh
Or pipe from a secret manager: op read 'op://vault/item/key' | ./scripts/setup-env.sh
This writes a .env file in the project root (gitignored). The server loads it automatically at startup.
If you installed from the Cursor Marketplace, configuration is automatic. For other clients, add to your MCP client configuration:
{
"mcpServers": {
"SAW": {
"command": "uvx",
"args": ["--from", "git+https://github.com/snyk/saw-mcp.git", "saw-mcp"],
"env": {
"MCP_SAW_API_KEY": "your-api-key"
}
}
}
}
For host-specific setup see the Installation Guides.
"MCP_SAW_BASE_URL": "https://your-instance-url" to the env block."MCP_SAW_CONFIG_PATH": "/path/to/config.yaml" instead."MCP_SAW_LOG_LEVEL": "DEBUG" (options: DEBUG, INFO, WARNING, ERROR, CRITICAL; default: INFO).Ask your AI assistant to:
See prompts.md for a full catalog of example prompts — from simple one-liners to complex multi-target workflows.
Detailed per-host guides live in docs/installation-guides/:
| Host | Guide |
|---|---|
| Cursor | install-cursor.md |
| Windsurf | install-windsurf.md |
| Claude Desktop | install-claude.md |
| Devin / Other IDEs | install-devin.md |
bash scripts/package.sh
Creates dist/SnykAPIWeb-<version>.tgz (version from snyk_apiweb/__init__.py).
Running the server directly starts it and waits for an MCP client connection. This is mainly useful for development and debugging:
./venv/bin/python -m snyk_apiweb.server
For active development with automatic reload on file changes:
./scripts/dev.sh
This project is licensed under the Apache License 2.0.
Be the first to review this server!
by Toleno · Developer Tools
Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.
by mcp-marketplace · Developer Tools
Create, build, and publish Python MCP servers to PyPI — conversationally.
by Microsoft · Content & Media
Convert files (PDF, Word, Excel, images, audio) to Markdown for LLM consumption