Snyk Agent Scan

Evo by Snyk is a security and governance platform for AI-native applications, agentic development, and AI systems. It provides continuous visibility, governance, testing, and real-time control across the AI software lifecycle. Its Agentic Development Security capability discovers models, agents, MCP servers, datasets, plugins, tools, and services used by agents across repositories; generates an AI bill of materials; applies policy and guardrails to agent actions; and validates AI-generated code before it reaches repositories, pipelines, or production. Its Continuous Offensive Security capability autonomously stress-tests applications and AI systems like an adversary, with agents coordinating reconnaissance, vulnerability hunting, exploit validation, remediation, and reporting, and an independent validation model intended to confirm exploitability before reporting findings. Testing is intended to run on code changes and pull requests.

SkillSpector is an open-source security scanner for AI agent skills, developed by NVIDIA. It scans Git repositories, URLs, ZIP archives, directories, and individual skill files before installation, looking for prompt injection, data exfiltration, privilege escalation, supply-chain issues, dangerous code, MCP permission problems, tool poisoning, and other malicious patterns. Its two-stage pipeline combines static analysis—including regex, Python AST, taint tracking, YARA signatures, and OSV.dev dependency lookups—with optional LLM-based semantic evaluation. It produces terminal, JSON, Markdown, or SARIF reports containing findings, severity labels, a 0–100 risk score, and installation recommendations. Baselines can suppress accepted findings, and the CLI can be used in CI or install gates through exit codes and machine-readable output. SkillSpector can also run as an MCP server callable by compatible agents. It does not execute scanned skills or sandbox them; optional LLM analysis sends eligible file contents to the configured provider, while dependency checks query OSV.dev. The project is distributed under the Apache License 2.0 and is part of NVIDIA's Verified Skills pipeline.

Snyk is a security company and developer and application security platform that secures AI-generated code, development agents, and AI-native applications from development through production. Its platform provides continuous validation and integrates with IDEs, CI/CD pipelines, and AI coding assistants, while addressing automated AI attacks, untrusted agentic development, and ungoverned AI applications. Snyk also presents continuous offensive security and AI-powered penetration testing as part of its approach to finding and validating vulnerabilities as code changes.

AgentGuard is a web-based scanner for AI-agent Skills, including SKILL.md instructions. It combines deterministic pattern checks with AI-assisted analysis to identify capabilities and risks such as shell-command execution, file-system access, environment-variable and credential access, network requests, external downloads, suspicious URLs, obfuscated instructions, prompt-injection patterns, and destructive operations. It produces a trust report with security and quality scores, a risk rating, detected capabilities, findings, explanations, and recommendations. The scanner is free to use, requires no account, accepts up to 80,000 characters of Skill text, and is designed for analysis before installation.

MCP Inspector is a testing tool for MCP servers. It runs via npx, connects to a local MCP server in a browser, and lets users list and invoke the server's tools.