Snyk MCP Server

License: MIT TypeScript MCP

A Model Context Protocol (MCP) server that integrates Snyk security scanning with Claude Code and other MCP clients.

Features

🔍 List all Snyk projects in your organization
🐛 Query security issues by severity (critical, high, medium, low)
🎯 Filter issues by project name or ID
🔧 Scope filtering (Frontend/Backend)
📊 Get normalized issue data with CVEs, dependencies, and fix information

Prerequisites

Node.js 18+
A Snyk account with API access
Snyk organization ID

Installation

Clone the repository:

git clone https://github.com/ozturkaburak/snyk-mcp-server.git
cd snyk-mcp-server

Install dependencies:

npm install

Create .env file from template:

cp .env.example .env

Configure your Snyk credentials in .env:

SNYK_TOKEN=your_snyk_token_here
SNYK_ORG_ID=your-org-id_here

Usage

Build the project

npm run build

Run in production mode

npm start

Run in development mode

npm run dev

MCP Tools

This server provides three MCP tools:

1. `list_snyk_projects`

Lists all projects in your Snyk organization.

Parameters: None

Example:

list_snyk_projects()

2. `get_project_issues`

Get all issues for a specific project.

Parameters:

projectId (required): The Snyk project ID
severity (optional): Filter by severity - "critical", "high", "medium", or "low"

Example:

get_project_issues({
  projectId: "abc-123-def-456",
  severity: "critical"
})

3. `get_snyk_issues`

Get issues across multiple projects with advanced filtering.

Parameters:

projectIds (optional): Array of project IDs
projectNames (optional): Array of project names (fuzzy matching)
severity (optional): Filter by severity
scope (optional): "FE" (Frontend), "BE" (Backend), or "UNKNOWN"

Examples:

// Get all critical backend issues across multiple microservices
get_snyk_issues({
  projectNames: [
    "api-gateway",
    "auth-service",
    "payment-service",
    "user-service",
    "notification-service"
  ],
  severity: "critical",
  scope: "BE"
})

// Get high severity frontend issues
get_snyk_issues({
  projectNames: ["web-app", "mobile-app"],
  severity: "high",
  scope: "FE"
})

// Get all critical issues without filtering by project
get_snyk_issues({
  severity: "critical"
})

Integration with Claude Code

Add this to your Claude Code MCP settings (.claude/mcp_settings.json):

{
  "mcpServers": {
    "snyk-local": {
      "command": "node",
      "args": ["/path/to/snyk-mcp-server/dist/index.js"],
      "env": {
        "SNYK_TOKEN": "your-snyk-token",
        "SNYK_ORG_ID": "your-org-id"
      }
    }
  }
}

Configuration

The server uses environment variables for configuration:

Variable	Description	Required
`SNYK_TOKEN`	Your Snyk API token	Yes
`SNYK_ORG_ID`	Your Snyk organization ID	Yes

Getting Your Credentials

SNYK_TOKEN: Get from Snyk Account Settings
SNYK_ORG_ID: Find in your org settings URL: https://app.snyk.io/org/your-org-id/manage/settings

Project Structure

snyk-mcp-server/
├── src/
│   ├── index.ts      # MCP server implementation
│   ├── snyk.ts       # Snyk API client
│   └── types.ts      # TypeScript type definitions
├── dist/             # Compiled JavaScript
├── .env.example      # Environment template
└── package.json

Development

TypeScript Development

npm run dev

Building

npm run build

API Documentation

See API_DOCUMENTATION.md for detailed Snyk REST API documentation.

Troubleshooting

Common Issues

"SNYK_TOKEN not set"

Make sure you created .env file with your token

"No projects found"

Verify your SNYK_ORG_ID is correct
Check your token has access to the organization

"Critical issues not showing"

Some issues may not be synced to REST API yet
Check the issue in Snyk UI to verify it exists
See FINDINGS_REPORT.md for analysis

Contributing

Contributions are welcome! Please feel free to submit a Pull Request.

License

MIT License - see the LICENSE file for details.

Author

Built with ❤️ for secure software development