How to Connect Snyk to Cursor via MCP

💡 No install? Use cloud.anythingmcp.com directly. Sign in, click Connectors → Snyk, paste your credentials, mint an MCP API key and you're done. No Docker, no git clone, no local server.

Snyk + Cursor

Check Snyk from your AI agent: organizations, targets and projects, vulnerabilities and other issues across all products with fix details and dependency paths, SBOMs, dependencies, package checks by purl, members, ignores and policies, and tag projects, set their attributes and ignore issues after you confirm.

Prerequisites

See the full setup instructions baked into the connector (visible in the in-app store when you select the connector). The required environment variables for this connector are:

SNYK_API_URL, SNYK_TOKEN

Step 1 — Get credentials

Setting up takes about 3 minutes. API access needs a Snyk Enterprise plan: Free and Team tokens only work for the CLI and IDE and answer 401 or 403 here.

1. Create a token. For a shared connector a service account is best: Organization or Group settings, Service accounts, with the role Org Collaborator for reads or Org Admin for ignores and attributes. For yourself, use a personal access token from Account settings, Personal access tokens (it expires after at most 90 days), or the API token under Account settings.
2. Paste it into SNYK_TOKEN, without a prefix such as token or Bearer. It is sent as Authorization: token <key>.
3. Set SNYK_API_URL to the API of your region, without /rest or /v1: https://api.snyk.io (app.snyk.io), https://api.us.snyk.io (app.us.snyk.io), https://api.eu.snyk.io (app.eu.snyk.io), https://api.au.snyk.io (app.au.snyk.io) or https://api.snykgov.io (Snyk for Government). The address of your Snyk app tells you which one.
4. Install the connector and run snyk_get_self, then snyk_list_orgs for the organization ids.

The connector uses the Snyk REST API (version 2026-03-25) and, where REST has no equivalent, the v1 API.

Ids: every tool takes the organization id (a UUID from snyk_list_orgs), not its slug. REST issue ids from snyk_list_issues are UUIDs; the v1 tools (snyk_list_issue_paths, snyk_create_ignore, snyk_delete_ignore) take the v1 issue id such as SNYK-JS-LODASH-567746, which is the id in snyk_list_aggregated_issues and attributes.problems[].id in REST issues.

What it reads:

• Inventory: snyk_get_self, snyk_list_orgs, snyk_get_org, snyk_list_targets and snyk_get_target (repositories, container images, CLI uploads), snyk_list_projects and snyk_get_project with type, origin, tags, attributes and the latest issue counts by severity, snyk_list_integrations (GitHub, GitLab, Bitbucket Cloud, Azure Repos, Docker Hub, ECR and more) and snyk_list_org_members.
• Issues: snyk_list_issues across the organization or snyk_list_project_issues for one project, covering open source vulnerabilities and licenses, Code, IaC, container and secrets. Filter by type, effective_severity_level, status (open, resolved), ignored or dates; then snyk_get_issue for the affected package versions and remedies.
• Fixes: snyk_list_aggregated_issues for open source and container projects, with package and version, CVSS and priority score, exploit maturity, whether it is upgradable or patchable and the fixed-in versions, and snyk_list_issue_paths, every dependency path that pulls the vulnerable package into the project.
• Supply chain: snyk_get_project_sbom exports the SBOM of a project's latest scan in CycloneDX 1.4 to 1.6 (JSON or XML) or SPDX 2.3 JSON, snyk_list_dependencies shows where a package is used across projects, and snyk_list_package_issues checks a package version by purl (for example pkg:npm/[email protected]) before you add it.
• Ignores: snyk_list_project_ignores (v1, open source and container projects), and snyk_list_policies with snyk_get_policy for the organization-level consistent ignores used by Snyk Code and newer products.

What it changes, after you confirm: snyk_add_project_tag and snyk_remove_project_tag (a key and value such as team:payments), snyk_set_project_attributes (business criticality, environment and lifecycle; the lists passed replace the old ones) and snyk_create_ignore. An ignore hides a vulnerability from tests, reports and pull request checks, so the AI names the issue, project, reason type (not-vulnerable, wont-fix or temporary-ignore) and expiry, prefers a temporary ignore with an end date and calls only after your yes.

Switched off at install: snyk_delete_ignore. It removes all ignore rules of an issue in a project, with their reason and history, and cannot be undone, so a workspace admin turns it on when the team needs it.

Data formats: REST answers are JSON:API: the fields are under data[].attributes, related ids under relationships. Severities are critical, high, medium and low (info for some products); effective_severity_level includes any severity change your organization made. Dates are ISO 8601 in UTC. SBOMs of big projects are large.

Paging: REST lists take limit (default 20, up to 100) and return links.next; the AI calls again with starting_after set to the value in that link until links.next is missing. The v1 tools page with page and perPage.

Limits: Snyk allows about 1,620 REST requests per minute per token and 2,000 v1 requests per minute per user; 429 means wait a minute.

Common errors: 401 means the token is wrong, expired or revoked, belongs to another region (check SNYK_API_URL), or the plan has no API access. 403 means the token's role does not allow the call in that organization. 404 means a wrong id, or an organization slug where the id is needed. 400 or 422 name the parameter that is wrong.

The connector does not start tests or scans, does not import repositories, does not delete, deactivate or move projects and targets, and does not create organization-level policies. Group-level reports, audit logs, settings, integration setup, members and invites, service accounts, Snyk Apps and the cloud and AI-BOM endpoints are not covered.

Step 2 — Install the adapter

curl -fsSL https://raw.githubusercontent.com/HelpCode-ai/anythingmcp/main/docker-compose.quickstart.yml -o docker-compose.yml
printf 'JWT_SECRET=%s\nENCRYPTION_KEY=%s\n' "$(openssl rand -hex 32)" "$(openssl rand -hex 32)" > .env
docker compose up -d

Step 3 — Add the connector in Cursor

Your server URL: in AnythingMCP, open MCP Servers → the server this connector is on, and copy its URL (https://cloud.anythingmcp.com/mcp/…). Use it wherever this guide shows YOUR_SERVER_ID.

Cursor reads MCP servers from ~/.cursor/mcp.json. Add this entry:

{
  "mcpServers": {
    "anythingmcp": {
      "url": "https://cloud.anythingmcp.com/mcp/YOUR_SERVER_ID",
      "headers": { "X-API-Key": "YOUR_MCP_API_KEY" }
    }
  }
}

1. Create an MCP API key in AnythingMCP under MCP Servers → your server → API keys, and paste it in place of YOUR_MCP_API_KEY.
2. Save the file and restart Cursor.
3. Open Cursor → Settings → MCP and check that anythingmcp is listed and connected.
4. Start chatting: the agent can now call the Snyk tools.

Available tools

Example prompts

• "Which projects in our Snyk organization have open critical vulnerabilities right now?"
• "Is pkg:npm/[email protected] safe to use? If not, which version fixes the issues?"
• "For the api-server project, which high severity issues can be fixed with an upgrade, and through which dependency does each one come in?"
• "Export the SBOM of the checkout-service project in CycloneDX JSON."
• "Ignore SNYK-JS-LODASH-567746 in the web-frontend project as temporary-ignore until the end of the year, reason: not reachable from our code."

FAQ

Does Cursor support custom MCP servers on the free tier? Yes, MCP is available on Hobby, Pro and Business plans.

Next steps

• Connector landing page
• Connect to Claude
• Connect to ChatGPT
• Connect to Gemini
• Connect to Meta Muse
• Connect to Microsoft Copilot