Snyk MCP Server

A Model Context Protocol (MCP) server that integrates Snyk security scanning with Claude Code and other MCP clients.

Features

• 🔍 List all Snyk projects in your organization

• 🐛 Query security issues by severity (critical, high, medium, low)

• 🎯 Filter issues by project name or ID

• 🔧 Scope filtering (Frontend/Backend)

• 📊 Get normalized issue data with CVEs, dependencies, and fix information

Related MCP server: Snyk MCP REST

Prerequisites

• Node.js 18+

• A Snyk account with API access

• Snyk organization ID

Installation

1. Clone the repository:

git clone https://github.com/ozturkaburak/snyk-mcp-server.git
cd snyk-mcp-server

2. Install dependencies:

npm install

3. Create .env file from template:

cp .env.example .env

4. Configure your Snyk credentials in .env:

SNYK_TOKEN=your_snyk_token_here
SNYK_ORG_ID=your-org-id_here

Usage

Build the project

npm run build

Run in production mode

npm start

Run in development mode

npm run dev

MCP Tools

This server provides three MCP tools:

1. list_snyk_projects

Lists all projects in your Snyk organization.

Parameters: None

Example:

list_snyk_projects()

2. get_project_issues

Get all issues for a specific project.

Parameters:

• projectId (required): The Snyk project ID

• severity (optional): Filter by severity - "critical", "high", "medium", or "low"

Example:

get_project_issues({
  projectId: "abc-123-def-456",
  severity: "critical"
})

3. get_snyk_issues

Get issues across multiple projects with advanced filtering.

Parameters:

• projectIds (optional): Array of project IDs

• projectNames (optional): Array of project names (fuzzy matching)

• severity (optional): Filter by severity

• scope (optional): "FE" (Frontend), "BE" (Backend), or "UNKNOWN"

Examples:

// Get all critical backend issues across multiple microservices
get_snyk_issues({
  projectNames: [
    "api-gateway",
    "auth-service",
    "payment-service",
    "user-service",
    "notification-service"
  ],
  severity: "critical",
  scope: "BE"
})

// Get high severity frontend issues
get_snyk_issues({
  projectNames: ["web-app", "mobile-app"],
  severity: "high",
  scope: "FE"
})

// Get all critical issues without filtering by project
get_snyk_issues({
  severity: "critical"
})

Integration with Claude Code

Add this to your Claude Code MCP settings (.claude/mcp_settings.json):

{
  "mcpServers": {
    "snyk-local": {
      "command": "node",
      "args": ["/path/to/snyk-mcp-server/dist/index.js"],
      "env": {
        "SNYK_TOKEN": "your-snyk-token",
        "SNYK_ORG_ID": "your-org-id"
      }
    }
  }
}

Configuration

The server uses environment variables for configuration:

Getting Your Credentials

1. SNYK_TOKEN: Get from Snyk Account Settings

2. SNYK_ORG_ID: Find in your org settings URL: https://app.snyk.io/org/your-org-id/manage/settings

Project Structure

snyk-mcp-server/
├── src/
│   ├── index.ts      # MCP server implementation
│   ├── snyk.ts       # Snyk API client
│   └── types.ts      # TypeScript type definitions
├── dist/             # Compiled JavaScript
├── .env.example      # Environment template
└── package.json

Development

TypeScript Development

npm run dev

Building

npm run build

API Documentation

See API_DOCUMENTATION.md for detailed Snyk REST API documentation.

Troubleshooting

Common Issues

"SNYK_TOKEN not set"

• Make sure you created .env file with your token

"No projects found"

• Verify your SNYK_ORG_ID is correct

• Check your token has access to the organization

"Critical issues not showing"

• Some issues may not be synced to REST API yet

• Check the issue in Snyk UI to verify it exists

• See FINDINGS_REPORT.md for analysis

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

License

MIT License - see the LICENSE file for details.

Related Resources

• Snyk REST API Documentation

• Model Context Protocol

• Claude Code

Author

Built with ❤️ for secure software development