Discover the toolingbehind modern intelligence
The operating system for AI infrastructure discovery. Search a live map of MCP servers, AI agents, LLM tools, automation systems, and developer infrastructure.
agent-scan
Security scanner for AI agents, MCP servers and agent skills.
2.5kstars
228forks
Python
agentaimcpmodelcontextprotocolsecurity
Quality signals
ActiveNo testsNo CIThin docsNo licensePopular
AI summary
Auto-generated overview of what this skill does and when to reach for it.
CLI tool that scans local AI agents, MCP servers, and skills for prompt injections, malware, and other security risks.
Use this when
- You installed a new MCP server and want to check for vulnerabilities
- Your AI agent keeps getting hijacked by prompt injections
- You need to inventory all agent skills on your machine
- You’re auditing third-party agent tools before deployment
- You suspect a skill contains hardcoded secrets or malware
Don't use when
- Scanning untrusted code in production environments
- Running on systems where you can’t review executed commands
- Checking systems without user consent for MCP server execution
Capabilities
- Detects prompt injection vulnerabilities in skills and MCP tools
- Scans for hardcoded secrets in agent configurations
- Identifies tool poisoning and shadowing risks in MCP servers
- Reports toxic flows and untrusted content in agent prompts
- Auto-discovers agent installations and MCP server paths
- Outputs detailed security reports with risk severity levels
InstallMCP + SKILLInstall as a Claude Code skill
Universal installANY TOOL
$ npx skillcity@latest snyk/agent-scanAuto-detects the skill or MCP server in this repo and installs it for Claude Code, Codex, Cursor or Cline.
Requires Node.js 18+ (ships with npx).
Or install manually
# Install into ~/.claude/skills/ mkdir -p ~/.claude/skills/agent-scan curl -fsSL https://raw.githubusercontent.com/snyk/agent-scan/main/SKILL.md -o ~/.claude/skills/agent-scan/SKILL.md
Readme
Loading README…