{ "tools": [ { "name": "snyk_auth", "description": "Authenticate the user with Snyk. When to use\n When a snyk tool reports that the user is not authenticated or when authentication is required.", "command": [ "auth" ], "ignoreTrust": true, "ignoreAuth": true, "standardParams": [], "profiles": ["full","lite", "experimental"], "annotations": { "readOnlyHint": false, "destructiveHint": false, "openWorldHint": true, "idempotentHint": true }, "params": [] }, { "name": "snyk_sca_scan", "description": "WE NEED TO USE THE ABSOLUTE PATH IN THE PATH ARGUMENT. Analyzes projects for open-source vulnerabilities and license compliance issues by inspecting manifest files (e.g., package.json, pom.xml, requirements.txt, uv.lock) to understand dependencies and then queries the Snyk vulnerability database. \nWhen to use: During local development by developers on their workstations before committing changes for immediate feedback. \nHow to use: Test locally: run tool with at least the path parameter. \nPrerequisites: Project's package manager (e.g., Gradle, Maven, npm) must be installed for accurate dependency resolution.", "command": [ "test" ], "standardParams": [ "all_projects", "json" ], "profiles": ["full","lite", "experimental"], "outputMapper": "ScaOutputMapper", "annotations": { "readOnlyHint": true, "destructiveHint": false, "openWorldHint": true, "idempotentHint": false }, "params": [ { "name": "path", "type": "string", "isRequired": true, "description": "Positional argument for the *ABSOLUTE PATH* to a directory, or a package to scan. The path MUST be absolute and have the correct path separator. You can retrieve the absolute path by invoking `pwd` on the command line in the working directory. Example: `/a/my-project` on linux/macOS or, on Windows `C:\\a\\my-project`.", "isPositional": true }, { "name": "all_projects", "type": "boolean", "isRequired": false, "description": "Auto-detects and tests all supported package manager manifest files found within the current directory and its subdirectories. Ideal for monorepos or solutions containing multiple projects. Mutually exclusive with `maven_aggregate_project` for Maven. Default is true." }, { "name": "include_ignores", "type": "boolean", "isRequired": false, "description": "Include ignored vulnerabilities in the output." }, { "name": "fail_fast", "type": "boolean", "isRequired": false, "description": "When used with `all_projects`, the scan process will stop immediately upon encountering the first error in any of the sub-projects, reporting the error and exiting. Without this, Snyk attempts to scan all projects and reports errors at the end." }, { "name": "detection_depth", "type": "integer", "isRequired": false, "description": "Specifies the depth of subdirectories (integer >= 0) to search for projects when using `all_projects` or `yarn_workspaces`. 0 means the current directory only. Default is no limit." }, { "name": "exclude", "type": "string", "isRequired": false, "description": "Comma-separated list of directory or file names to exclude from scanning when using `all_projects` or `yarn_workspaces`. Cannot include paths. Example: `exclude=node_modules,tests,build`." }, { "name": "prune_repeated_subdependencies", "type": "boolean", "isRequired": false, "description": "Simplifies the displayed dependency tree by removing duplicate sub-dependencies. This can make the output cleaner for large projects but may not show all vulnerable paths. Default is false." }, { "name": "print_deps", "type": "boolean", "isRequired": false, "description": "Prints the full dependency tree of the project to the console before the analysis begins. Useful for understanding the project structure." }, { "name": "remote_repo_url", "type": "string", "isRequired": false, "description": "Sets or overrides the remote repository URL associated with the project. Useful if the local project is not a git repository or to associate the scan with a different remote." }, { "name": "dev", "type": "boolean", "isRequired": false, "description": "Includes development-only dependencies in the scan (e.g., `devDependencies` in npm, `:development` group in RubyGems). Supported for Maven, npm, and Yarn projects. Default is false (only production dependencies scanned)." }, { "name": "org", "type": "string", "isRequired": false, "description": "Specifies the Snyk Organization ID (or slug name) under which the test results should be reported and associated. Essential if belonging to multiple Snyk Orgs. Default is the org from `snyk config` or Snyk account." }, { "name": "file", "type": "string", "isRequired": false, "description": "Specifies the path to a particular package manifest file (e.g., `package.json`, `pom.xml`, `requirements.txt`, `uv.lock`) that Snyk should inspect. If not provided, Snyk attempts auto-detection. Mutually exclusive with `all_projects`", "supersedesParams": [ "all_projects" ] }, { "name": "package_manager", "type": "string", "isRequired": false, "description": "Specifies the package manager type when the `file` option points to a manifest file with a non-standard name (e.g., `req.txt` instead of `requirements.txt` for Python). Accepted values: `npm`, `maven`, `pip`, `yarn`, `gradle`, `composer`, `rubygems`, `nuget`, `golangdep`, `govendor`, `gomodules`, `uv`. Default is auto-detected.", "supersedesParams": [ "all_projects" ] }, { "name": "unmanaged", "type": "boolean", "isRequired": false, "description": "Enables scanning for C++ projects or other scenarios where dependencies are not managed by a standard package manager. Snyk attempts to identify dependencies based on file signatures." }, { "name": "ignore_policy", "type": "boolean", "isRequired": false, "description": "Instructs Snyk to ignore all policies defined in the `.snyk` file, organization-level ignores, and project policies on snyk.io for this specific scan." }, { "name": "trust_policies", "type": "boolean", "isRequired": false, "description": "Applies and uses ignore rules found within Snyk policy files present in the project's dependencies. By default, such rules are only shown as suggestions." }, { "name": "show_vulnerable_paths", "type": "string", "isRequired": false, "description": "Controls how many vulnerable dependency paths are displayed in the output. Accepted values: `none` (shows no paths), `some` (shows a few examples), `all` (shows all identified paths)." }, { "name": "project_name", "type": "string", "isRequired": false, "description": "Specifies a custom name for the project as it will appear in the Snyk UI if results are monitored or reported. Default is auto-generated (e.g., from manifest or directory name)." }, { "name": "target_reference", "type": "string", "isRequired": false, "description": "Specifies a reference (e.g., branch name, version tag) to differentiate this specific scan or project version, especially when results are monitored. Useful for grouping projects in Snyk UI. Supported for Snyk Open Source (except with `unmanaged`)." }, { "name": "policy_path", "type": "string", "isRequired": false, "description": "Manually provides the path to a `.snyk` policy file if it's not located in the project root. Default is `.snyk` in project root." }, { "name": "severity_threshold", "type": "string", "isRequired": false, "description": "Reports only vulnerabilities that meet or exceed the specified severity level. Useful for filtering noise or focusing on critical issues. Accepted values: `low`, `medium`, `high`, `critical`." }, { "name": "fail_on", "type": "string", "isRequired": false, "description": "Determines the conditions under which the `snyk test` command will exit with a non-zero code (indicating failure), specifically for CI/CD integration. `all`: fails if any Snyk-fixable vulnerability (upgrade or patch) exists. `upgradable`: fails if a vulnerability has a direct upgrade path. `patchable`: fails if a Snyk patch is available. Default is `all` (fails on any discoverable vulnerability meeting severity criteria)." }, { "name": "maven_aggregate_project", "type": "boolean", "isRequired": false, "description": "For multi-module Maven projects. Scans all modules defined in the root `pom.xml`. Cannot be used with `all_projects`.", "supersedesParams": [ "all_projects" ] }, { "name": "scan_all_unmanaged", "type": "boolean", "isRequired": false, "description": "For Maven ecosystem. Auto-detects and tests all Maven, JAR, WAR, AAR files recursively. Often used with `file` to target specific unmanaged archives." }, { "name": "gradle_sub_project", "type": "string", "isRequired": false, "description": "Tests a specific Gradle sub-project. Alias: `sub-project`." }, { "name": "all_sub_projects", "type": "boolean", "isRequired": false, "description": "Tests all Gradle sub-projects in a multi-project build." }, { "name": "configuration_matching", "type": "string", "isRequired": false, "description": "For Gradle, filters Gradle configurations to scan using a REGEX." }, { "name": "assets_project_name", "type": "boolean", "isRequired": false, "description": "For NuGet (.NET), uses project name from `project.assets.json` for PackageReference projects when testing solution (`.sln`) files." }, { "name": "dotnet_runtime_resolution", "type": "boolean", "isRequired": false, "description": "For .NET projects using Runtime Resolution Scanning (Early Access)." }, { "name": "dotnet_target_framework", "type": "string", "isRequired": false, "description": "For .NET, specifies a target framework for multi-targeted .NET solutions (Early Access)." }, { "name": "strict_out_of_sync", "type": "string", "isRequired": false, "description": "Controls behavior for out-of-sync lockfiles for npm, pnpm, Yarn. Accepted values: `true`, `false`. Default `true` for npm/yarn, `false` for pnpm." }, { "name": "yarn_workspaces", "type": "boolean", "isRequired": false, "description": "Detects and scans Yarn Workspaces. Use with `all_projects` for broader monorepo scanning." }, { "name": "skip_unresolved", "type": "boolean", "isRequired": false, "description": "For Python, skips packages not found in the environment" }, { "name": "command", "type": "string", "isRequired": false, "description": "For Python and only python YOU MUST USE THIS ARGUMENT. Mandatory, specifies the Python executable (e.g., `python3`, `python` or absolute path to python executable)." } ] }, { "name": "snyk_code_scan", "description": "Performs Static Application Security Testing (SAST) directly from the Snyk MCP. It analyzes an application's source code with a SAST scan to identify security vulnerabilities and weaknesses without executing the code. \nWhen to use: During local development, developers can run it on their feature branches for immediate feedback, or after you generate new code files. \nHow to use: Test directory: run snyk_code_scan with parameter , add parameters as needed. \nLanguages that Snyk supports: Apex, C/C++, Dart and Flutter, Elixir, Go, Groovy, Java and Kotlin, Javascript, .NET, PHP, Python, Ruby, Rust, Scala, Swift and Objective-C, Typescript, VB.NET", "command": [ "code", "test" ], "ignoreTrust": true, "outputMapper": "CodeOutputMapper", "standardParams": ["sarif"], "profiles": ["full","lite", "experimental"], "annotations": { "readOnlyHint": true, "destructiveHint": false, "openWorldHint": true, "idempotentHint": true }, "params": [ { "name": "path", "type": "string", "isRequired": true, "description": "Positional argument for the *absolute path* to a file or directory to scan. The path MUST be absolute and have the correct path separator. You can retrieve the absolute path by invoking `pwd` on the command line in the working directory. Example: `/a/my-project` on linux/macOS or, on Windows `C:\\a\\my-project`", "isPositional": true }, { "name": "org", "type": "string", "isRequired": false, "description": "Specifies the Snyk Organization ID (or slug name) under which the test results should be associated. This can influence private test limits and ensures results are reported to the correct Snyk Organization. Default is from `snyk config` or Snyk account." }, { "name": "severity_threshold", "type": "string", "isRequired": false, "description": "Reports only vulnerabilities that meet or exceed the specified severity level. Accepted values: `low`, `medium`, `high`. Snyk Code configuration issues do not use the `critical` severity level." }, { "name": "include_ignores", "type": "boolean", "isRequired": false, "description": "Include ignored vulnerabilities in the output." }, { "name": "debug", "type": "boolean", "isRequired": false, "description": "Enables debug logging for the SAST scan, providing more detailed output for troubleshooting. Use as `-d`." } ] }, { "name": "snyk_container_scan", "description": "Scans container images for known vulnerabilities in OS packages and application dependencies.\nHow to use: Test image: `IMAGE`=`my-image:v1`. Test with Dockerfile for context: `IMAGE`=`my-image:v1` `file`=`absolute/path/to/Dockerfile`. Test and exclude base image vulns: `IMAGE`=`my-image:v1` `exclude_base_image_vulns`. Test OCI archive: `IMAGE`=`oci-archive:image.tar` `platform`=`linux/arm64`.", "command": [ "container", "test" ], "ignoreTrust": true, "standardParams": [], "profiles": ["full", "experimental"], "annotations": { "readOnlyHint": true, "destructiveHint": false, "openWorldHint": true, "idempotentHint": false }, "params": [ { "name": "image", "type": "string", "isRequired": true, "description": "Positional argument for the container image to test. Can be an image name from a registry (e.g., `node:14-alpine`), a local image ID, or a path to a tarball (e.g., `docker-archive:image.tar`, `oci-archive:image.tar`).", "isPositional": true }, { "name": "print_deps", "type": "boolean", "isRequired": false, "description": "Prints the dependency tree (OS packages and application dependencies if scanned) to the console before analysis." }, { "name": "org", "type": "string", "isRequired": false, "description": "Specifies the Snyk Organization ID (or slug name) for reporting and association of results. Default is the configured Snyk Org." }, { "name": "file", "type": "string", "isRequired": false, "description": "Path to the Dockerfile used to build the image. Snyk uses this to offer more accurate remediation advice, potentially identifying the base image or specific instructions that introduced vulnerabilities." }, { "name": "project_name", "type": "string", "isRequired": false, "description": "Specifies a custom name for the project in the Snyk UI if results are monitored or reported. Default is auto-generated." }, { "name": "policy_path", "type": "string", "isRequired": false, "description": "Manually provides the path to a `.snyk` policy file containing ignore rules. Default is `.snyk` in project root (if applicable)." }, { "name": "severity_threshold", "type": "string", "isRequired": false, "description": "Reports only vulnerabilities at or above the specified severity level. Accepted values: `low`, `medium`, `high`, `critical`." }, { "name": "fail_on", "type": "string", "isRequired": false, "description": "Controls conditions for a non-zero exit code. `all`: fails if any fixable (upgrade or Snyk-provided patch) vulnerability is found. `upgradable`: fails only if a vulnerability has a direct upgrade path available from Snyk. Default is to fail on any Snyk-discoverable vulnerability." }, { "name": "app_vulns", "type": "boolean", "isRequired": false, "description": "Enables scanning for vulnerabilities in application dependencies packaged within the container image (e.g., npm packages, Maven JARs). Enabled by default in Snyk MCP versions 1.1090.0 and higher. Mutually exclusive with `exclude_app_vulns`." }, { "name": "exclude_app_vulns", "type": "boolean", "isRequired": false, "description": "Disables scanning for application vulnerabilities within the container image, focusing only on OS package vulnerabilities. Default is disabled (meaning app vulns are scanned by default in CLI v1.1090.0+). Mutually exclusive with `app_vulns`." }, { "name": "exclude_node_modules", "type": "boolean", "isRequired": false, "description": "If scanning a Node.js container image, this option controls scanning of `node_modules` directories. By default (CLI v1.1292.0+), `node_modules` are scanned; this flag would disable that specific scan if explicitly set to true, or confirm default behavior." }, { "name": "nested_jars_depth", "type": "integer", "isRequired": false, "description": "When `app_vulns` is active for Java applications, this sets how many levels of nested JAR files (e.g., JARs within WARs or EARs) Snyk should unpack and analyze. E.g., `0`, `1`, `2`. Default is Snyk's standard behavior." }, { "name": "exclude_base_image_vulns", "type": "boolean", "isRequired": false, "description": "Instructs Snyk not to report vulnerabilities that are introduced *only* by the base image layers. This helps focus on vulnerabilities added by application layers. Works for OS packages only. Default false." }, { "name": "platform", "type": "string", "isRequired": false, "description": "For multi-architecture container images, specifies the platform (architecture/OS) to test (e.g., `linux/amd64`, `linux/arm64`). Default is auto-detected or image default." } ] }, { "name": "snyk_iac_scan", "description": "Analyzes Infrastructure as Code (IaC) files for security misconfigurations. Supports Terraform (.tf, .tf.json, plan files), Kubernetes (YAML, JSON), AWS CloudFormation (YAML, JSON), Azure Resource Manager (ARM JSON), and Serverless Framework. \nWhen to use: Locally by developers while writing IaC. In CI/CD pipelines to scan IaC changes before applying to cloud environments, preventing insecure deployments. The `report` option sends results to Snyk UI for ongoing visibility. \nHow to use: Test directory: `path`=`absolute/path/to/dir`. Test specific TF file: `path`=`absolute/path/to/file.tf`. Test dir, report to UI: `path`=`absolute/path/to/dir` `report` `org`=`my-org`. Test K8s configs, report to UI, high severity: `path`=`./k8s/` `report` `target_name`=`prod-k8s` `severity_threshold`=`high`. Test with custom rules: ` `path`=`/absolute/path/to/infra/` `rules`=`rules.tar.gz`.", "command": [ "iac", "test" ], "ignoreTrust": true, "standardParams": [], "profiles": ["full", "experimental"], "annotations": { "readOnlyHint": true, "destructiveHint": false, "openWorldHint": true, "idempotentHint": true }, "params": [ { "name": "path", "type": "string", "isRequired": true, "description": "Positional argument for the *absolute path* to a file or directory to scan. The path MUST be absolute and have the correct path separator. You can retrieve the absolute path by invoking `pwd` on the command line in the working directory. Example: `/a/my-project` on linux/macOS or, on Windows `C:\\a\\my-project`", "isPositional": true }, { "name": "detection_depth", "type": "integer", "isRequired": false, "description": "Specifies how many subdirectories (integer >= 0) to search for IaC files when a directory path is provided. 0 is current directory only. Default is no limit." }, { "name": "org", "type": "string", "isRequired": false, "description": "Specifies the Snyk Organization ID (or slug name) for associating results. Default is configured org." }, { "name": "ignore_policy", "type": "boolean", "isRequired": false, "description": "Ignores all policies defined in the `.snyk` file and on snyk.io for this scan." }, { "name": "policy_path", "type": "string", "isRequired": false, "description": "Manually specifies the path to a `.snyk` policy file. Default is `.snyk` in root." }, { "name": "project_business_criticality", "type": "string", "isRequired": false, "description": "Sets project business criticality attribute(s) in Snyk UI (e.g. `critical,high`). Used with `report`." }, { "name": "project_environment", "type": "string", "isRequired": false, "description": "Sets project environment attribute(s) in Snyk UI (e.g. `frontend,backend`). Used with `report`." }, { "name": "project_lifecycle", "type": "string", "isRequired": false, "description": "Sets project lifecycle attribute(s) in Snyk UI (e.g. `production,sandbox`). Used with `report`." }, { "name": "project_tags", "type": "string", "isRequired": false, "description": "Sets project tags in Snyk UI (e.g., `dept=finance`). Used with `report`." }, { "name": "remote_repo_url", "type": "string", "isRequired": false, "description": "Sets or overrides the remote repository URL for the project in Snyk UI. Used with `report`." }, { "name": "report", "type": "boolean", "isRequired": false, "description": "Shares test results with the Snyk Web UI, creating/updating a project for tracking IaC issues. Mutually exclusive with `rules`." }, { "name": "rules", "type": "string", "isRequired": false, "description": "Specifies path to a custom rules bundle (`.tar.gz`) from snyk-iac-rules SDK for scans against custom policies. Mutually exclusive with `report`. Default is Snyk default rules." }, { "name": "severity_threshold", "type": "string", "isRequired": false, "description": "Reports only misconfigurations at or above the specified severity level (`low`, `medium`, `high`, `critical`)." }, { "name": "scan", "type": "string", "isRequired": false, "description": "For Terraform plan scanning only. Specifies analysis mode: `planned-values` (full planned state) or `resource-changes` (proposed changes/deltas). Default `resource-changes`." }, { "name": "target_name", "type": "string", "isRequired": false, "description": "Sets or overrides project name in Snyk Web UI when used with `report`. Precedence over `remote_repo_url` for naming if both used." }, { "name": "target_reference", "type": "string", "isRequired": false, "description": "Specifies a reference (e.g., branch name, commit hash) to differentiate IaC project version in Snyk UI when used with `report`." }, { "name": "var_file", "type": "string", "isRequired": false, "description": "For Terraform, loads a variable definitions file (`.tfvars`) from a path different from the scanned directory." } ] }, { "name": "snyk_sbom_scan", "description": "Analyzes an existing SBOM file for known vulnerabilities in its open-source components. Requires components in SBOM to be identified using PackageURLs (purls). \nWhen to use: After SBOM generation (by Snyk or other tools) to assess components. In CI/CD to test generated/received SBOMs. For vulnerability scanning of third-party software when only an SBOM is available. \nHow to use: `file`=`/absolute/path/to/my_app.cdx.json`. \nInput Requirements: SBOMs in CycloneDX (JSON 1.4-1.6) or SPDX (JSON 2.3). Packages must have purls (types: apk, cargo, cocoapods, composer, deb, gem, generic, golang, hex, maven, npm, nuget, pub, pypi, rpm, swift). \nSecure SDLC Integration: Testing/Validation Phase: Scans inventoried components post-SBOM generation. Third-Party Risk Management: Assesses vulnerabilities from SBOMs of external software.", "command": [ "sbom", "test" ], "standardParams": [ "experimental" ], "profiles": ["full", "experimental"], "ignoreTrust": true, "annotations": { "readOnlyHint": true, "destructiveHint": false, "openWorldHint": true, "idempotentHint": false }, "params": [ { "name": "file", "type": "string", "isRequired": true, "description": "Required. Specifies the path to the SBOM document to be tested (CycloneDX JSON 1.4-1.6, SPDX JSON 2.3)." }, { "name": "org", "type": "string", "isRequired": false, "description": "Specifies the Snyk Organization ID. Verify applicability with `snyk sbom test help`." }, { "name": "severity_threshold", "type": "string", "isRequired": false, "description": "Filters results to report only vulnerabilities at or above specified severity (`low`, `medium`, `high`, `critical`). Verify applicability with `snyk sbom test help`. Default reports all." }, { "name": "debug", "type": "boolean", "isRequired": false, "description": "Outputs debug logs for troubleshooting. Alias `debug`. Use as `-d`." } ] }, { "name": "snyk_secret_scan", "description": "Scans a project's source code and configuration files to detect hardcoded secrets such as API keys, tokens, passwords, and other sensitive credentials.\nWhen to use: During local development to ensure no secrets are accidentally committed to source control, or after generating new configuration files.\nHow to use: Run snyk_secret_scan with the path parameter pointing to the project directory.\nPrerequisites: Requires authentication with Snyk and the secrets feature enabled for your organization.", "command": [ "secrets", "test" ], "ignoreTrust": true, "profiles": ["full", "experimental"], "annotations": { "readOnlyHint": true, "destructiveHint": false, "openWorldHint": true, "idempotentHint": true }, "params": [ { "name": "path", "type": "string", "isRequired": true, "description": "Positional argument for the *absolute path* to a directory to scan for secrets. The path MUST be absolute and have the correct path separator. You can retrieve the absolute path by invoking `pwd` on the command line in the working directory. Example: `/a/my-project` on linux/macOS or, on Windows `C:\\a\\my-project`.", "isPositional": true }, { "name": "org", "type": "string", "isRequired": false, "description": "Specifies the Snyk Organization ID (or slug name) under which the test results should be associated. Default is from `snyk config` or Snyk account." }, { "name": "severity_threshold", "type": "string", "isRequired": false, "description": "Reports only findings that meet or exceed the specified severity level. Accepted values: `low`, `medium`, `high`, `critical`." }, { "name": "include_ignores", "type": "boolean", "isRequired": false, "description": "Include previously ignored findings in the output." }, { "name": "exclude", "type": "string", "isRequired": false, "description": "Comma-separated list of file or directory names to exclude from the secret scan. Patterns use basename matching and cannot contain path separators. Example: `node_modules,config.json`." } ] }, { "name": "snyk_version", "description": "Displays the installed Snyk MCP version. \nWhen to use: To verify current CLI version for compatibility checks or when reporting issues.", "command": [ "version" ], "ignoreTrust": true, "ignoreAuth": true, "standardParams": [], "profiles": ["full","lite", "experimental"], "annotations": { "readOnlyHint": true, "destructiveHint": false, "openWorldHint": false, "idempotentHint": true }, "params": [] }, { "name": "snyk_logout", "description": "Logs the Snyk MCP out of the current Snyk account by clearing the locally stored authentication token. \nWhen to use: When needing to switch Snyk accounts, or to ensure a clean state by removing existing authentication from the local machine.", "command": [], "ignoreTrust": true, "ignoreAuth": true, "standardParams": [], "profiles": ["full","lite", "experimental"], "annotations": { "readOnlyHint": false, "destructiveHint": false, "openWorldHint": true, "idempotentHint": false }, "params": [] }, { "name": "snyk_aibom", "description": "Generates an AI Bill of Materials (AIBOM) for Python software projects in CycloneDX v1.6 JSON format. This feature analyzes local Python projects to identify AI models, datasets, tools, and other AI-related components. Requires an active internet connection and access to the experimental feature (available to customers on request). The command must be run from within a Python project directory and requires the CLI from the preview release channel. \nWhen to use: When you need to create an inventory of AI components in a Python project for compliance, security analysis, or documentation purposes.", "command": [ "aibom" ], "standardParams": [ "experimental" ], "profiles": ["full", "experimental"], "annotations": { "readOnlyHint": true, "destructiveHint": false, "openWorldHint": true, "idempotentHint": true }, "params": [ { "name": "path", "type": "string", "isRequired": true, "isPositional": true, "description": "Positional argument for the *ABSOLUTE PATH* to the directory to be scanned. The path MUST be absolute and have the correct path separator. You can retrieve the absolute path by invoking `pwd` on the command line in the working directory. Example: `/a/my-project` on linux/macOS or, on Windows `C:\\a\\my-project`." }, { "name": "json_file_output", "type": "string", "description": "Saves the AIBOM output as a JSON data structure to the specified file path. The target directory must exist and be writable." } ] }, { "name": "snyk_trust", "description": "Trust a given folder to allow Snyk to scan it. ONLY RUN THIS TOOL IF INSTRUCTED TO DO SO.", "command": [], "standardParams": [], "profiles": ["full","lite","experimental"], "ignoreTrust": true, "annotations": { "readOnlyHint": false, "destructiveHint": false, "openWorldHint": false, "idempotentHint": true }, "params": [ { "name": "path", "type": "string", "isRequired": true, "ignoreAuth": true, "description": "Path to the project folder to trust (default is the absolute path of the current directory, formatted according to the operating system's conventions)." } ] }, { "name": "snyk_send_feedback", "description": "Report ONLY the delta (this run only) of Snyk issues. Use preventedIssuesCount if the model prevented introducing a vulnerability in new code. Use fixedExistingIssuesCount if the model repaired an issue in existing code. When the calling tool/hook supplies specific Snyk vuln IDs, pass them in preventedIssueIds (prevention) or fixedIssueIds (remediation). Optional richness fields (severity/scan-type breakdowns, outcome, breakabilityRisk, strategy, testsPassed) may be included when already computed by the caller. Counts must NEVER be cumulative. Always send an absolute path.", "command": [], "standardParams": [], "profiles": ["full","lite","experimental"], "ignoreTrust": true, "annotations": { "readOnlyHint": true, "destructiveHint": false, "openWorldHint": true, "idempotentHint": false }, "params": [ { "name": "preventedIssuesCount", "type": "number", "isRequired": true, "description": "Delta count of issues AVOIDED in newly generated code during THIS run only (not cumulative)." }, { "name": "fixedExistingIssuesCount", "type": "number", "isRequired": true, "description": "Delta count of issues FIXED in pre-existing code during THIS run only (not cumulative)." }, { "name": "path", "type": "string", "isRequired": true, "description": "Absolute path to the project root or subdirectory. Example: '/a/my-project' (Linux/macOS) or 'C:\\a\\my-project' (Windows)." }, { "name": "preventedIssueIds", "type": "array", "items": { "type": "string" }, "isRequired": false, "description": "Optional list of Snyk vuln IDs that the caller detected and is asking the model to fix. Prefix each entry with scan type: 'sast:' (e.g. 'sast:javascript/SqlInjection') or 'sca:' (e.g. 'sca:SNYK-JS-LODASH-1234567'). When provided, length should match preventedIssuesCount; the count remains authoritative. Pass as an array; it is emitted as a JSON-encoded string in the analytics extension." }, { "name": "fixedIssueIds", "type": "array", "items": { "type": "string" }, "isRequired": false, "description": "Optional list of Snyk vuln IDs that were fixed in pre-existing code during this run. Prefix each entry with scan type: 'sast:' (e.g. 'sast:javascript/SqlInjection') or 'sca:' (e.g. 'sca:SNYK-JS-LODASH-1234567'). When provided, length should match fixedExistingIssuesCount; the count remains authoritative. Pass as an array; it is emitted as a JSON-encoded string in the analytics extension." }, { "name": "fixedIssuesBySeverity", "type": "object", "isRequired": false, "properties": { "critical": { "type": "number" }, "high": { "type": "number" }, "medium": { "type": "number" }, "low": { "type": "number" } }, "description": "Optional per-severity breakdown (critical/high/medium/low counts) of fixedExistingIssuesCount. Populated by remediation callers (snyk-fix.md, snyk-batch-fix.md, skills/snyk-fix/SKILL.md). Pass as an object; each present bucket is emitted as a flat scalar key (mcp::fixedIssuesCritical, mcp::fixedIssuesHigh, mcp::fixedIssuesMedium, mcp::fixedIssuesLow)." }, { "name": "preventedIssuesBySeverity", "type": "object", "isRequired": false, "properties": { "critical": { "type": "number" }, "high": { "type": "number" }, "medium": { "type": "number" }, "low": { "type": "number" } }, "description": "Optional per-severity breakdown (critical/high/medium/low counts) of preventedIssuesCount. Populated by the secure-at-inception Stop Hook. Distinct from fixedIssuesBySeverity. Pass as an object; each present bucket is emitted as a flat scalar key (mcp::preventedIssuesCritical, mcp::preventedIssuesHigh, mcp::preventedIssuesMedium, mcp::preventedIssuesLow)." }, { "name": "fixedIssuesByScanType", "type": "object", "isRequired": false, "properties": { "sast": { "type": "number" }, "sca": { "type": "number" } }, "description": "Optional scan-type breakdown (sast/sca counts) of the issue IDs named in fixedIssueIds, decomposing fixedExistingIssuesCount. Remediation-only; not populated by the secure-at-inception Stop Hook. Pass as an object; each present bucket is emitted as a flat scalar key (mcp::fixedIssuesSast, mcp::fixedIssuesSca)." }, { "name": "outcome", "type": "string", "isRequired": false, "enum": ["applied", "blocked", "advisory", "no_fix_available", "allowed"], "description": "Optional outcome of the remediation attempt. Remediation-only; not populated by the secure-at-inception Stop Hook." }, { "name": "breakabilityRisk", "type": "string", "isRequired": false, "enum": ["low", "medium", "high", "unknown"], "description": "Optional breaking-change risk assessed for the package upgrade used to fix the issue." }, { "name": "breakabilityRiskSource", "type": "string", "isRequired": false, "enum": ["api", "heuristic"], "description": "Optional source of breakabilityRisk: 'api' when derived from the real Breakability API, 'heuristic' when derived from the semver+usage-analysis fallback." }, { "name": "strategy", "type": "string", "isRequired": false, "enum": ["Direct Upgrade", "Parent Upgrade", "Transitive Fix"], "description": "Optional remediation strategy identifier used for the fix." }, { "name": "testsPassed", "type": "boolean", "isRequired": false, "description": "Optional flag indicating whether tests passed after applying the fix." } ] }, { "name": "snyk_package_health_check", "description": "Retrieves package information and health metrics from Snyk's package intelligence API. Returns details about a package including security vulnerabilities, maintenance status, popularity metrics, and community health indicators.\nWhen to use: When evaluating a package before adding it as a dependency, when changing a package version, or when assessing the health and security of existing dependencies.", "command": [], "standardParams": [], "profiles": ["full","experimental"], "ignoreTrust": true, "annotations": { "readOnlyHint": true, "destructiveHint": false, "openWorldHint": true, "idempotentHint": false }, "params": [ { "name": "package_name", "type": "string", "isRequired": true, "description": "The name of the package to look up. For scoped npm packages, include the scope (e.g., '@angular/core'). For Maven packages, use 'groupId:artifactId' format." }, { "name": "package_version", "type": "string", "isRequired": false, "description": "The specific version of the package to look up. If not provided, returns information about the package in general (latest version info)." }, { "name": "ecosystem", "type": "string", "isRequired": true, "description": "The package ecosystem. Must be one of: npm, golang, pypi, maven, nuget." } ] }, { "name": "snyk_breakability_check", "description": "Runs a breaking change assessment for a package version upgrade.", "command": [], "standardParams": [], "profiles": ["full","experimental"], "ignoreTrust": true, "annotations": { "readOnlyHint": true, "destructiveHint": false, "openWorldHint": true, "idempotentHint": false }, "params": [ { "name": "package_name", "type": "string", "isRequired": true, "description": "The name of the package to look up. For scoped npm packages, include the scope (e.g., '@angular/core'). For Maven packages, use 'groupId:artifactId' format." }, { "name": "package_version_from", "type": "string", "isRequired": true, "description": "The specific version of the package to look up. This is the version before the upgrade." }, { "name": "package_version_to", "type": "string", "isRequired": true, "description": "The specific version of the package to look up. This is the version after the upgrade." } ] } ] }