Snyk

Snyk

This connector reads and manages Snyk through the REST API (<region>/rest, version 2026-03-25) and, where REST has no equivalent, the v1 API (<region>/v1): organizations, projects, targets, issues across all products, SBOMs, package checks, dependencies, members, ignores and policies. 25 tools: the AI reads all of these, and can tag projects, set their attributes and ignore issues after you confirm.

Setup (about 3 minutes)

1. API access needs a Snyk Enterprise plan. Free and Team tokens only work for the CLI and IDE and answer 401 or 403 here.
2. Create a token: a service account (Organization or Group settings > Service accounts, role Org Collaborator for reads, Org Admin for ignores and attributes) is best for a shared connector. For yourself, a personal access token from Account settings > Personal access tokens (it expires after at most 90 days) or the API token under Account settings. Paste it into SNYK_TOKEN; it is sent as Authorization: token <key>.
3. Set SNYK_API_URL to the API of your region: https://api.snyk.io (app.snyk.io, SNYK-US-01), https://api.us.snyk.io (app.us.snyk.io, SNYK-US-02), https://api.eu.snyk.io (app.eu.snyk.io, SNYK-EU-01), https://api.au.snyk.io (app.au.snyk.io, SNYK-AU-01) or https://api.snykgov.io (Snyk for Government). Look at the address of your Snyk app if unsure.
4. Check the setup with snyk_get_self, then snyk_list_orgs.

Ids: every tool takes the organization id (a UUID from snyk_list_orgs), not its slug. REST issue ids from snyk_list_issues are UUIDs; the v1 tools (snyk_list_issue_paths, snyk_create_ignore, snyk_delete_ignore) take the v1 issue id such as SNYK-JS-LODASH-567746, which is the id in snyk_list_aggregated_issues and attributes.problems[].id in REST issues.

How to work

• Inventory: snyk_get_self, snyk_list_orgs, snyk_get_org, snyk_list_targets and snyk_get_target (repositories, images), snyk_list_projects and snyk_get_project (with latest issue counts), snyk_list_integrations, snyk_list_org_members.
• What is wrong: snyk_list_issues across the organization or snyk_list_project_issues for one project (filter by type, effective_severity_level, status=open, ignored=false), then snyk_get_issue. For open source and container fixes use snyk_list_aggregated_issues (upgradable, fixed-in versions, priority score) and snyk_list_issue_paths (which dependency pulls it in).
• Supply chain: snyk_get_project_sbom (CycloneDX or SPDX), snyk_list_dependencies (where a package is used), snyk_list_package_issues (check a package version by purl before adding it).
• Ignores: snyk_list_project_ignores (v1, open source and container projects) and snyk_list_policies with snyk_get_policy (organization-level consistent ignores, used by Snyk Code).

Writes need the user's confirmation: snyk_add_project_tag, snyk_remove_project_tag, snyk_set_project_attributes and snyk_create_ignore. An ignore hides a vulnerability from tests, reports and pull request checks: say which issue, project, reason and expiry, prefer temporary-ignore with an expiry, and call only after the user agrees. snyk_set_project_attributes replaces the lists it is given.

Switched off at install: snyk_delete_ignore; it cannot be undone, so an admin switches it on when the team needs it.

Reading answers: REST answers are JSON:API: the fields are under data[].attributes, related ids under relationships. Severities are critical, high, medium, low (and info for some products); effective_severity_level includes any severity change your organization made. Dates are ISO 8601 in UTC.

Paging: REST lists return links.next; call again with starting_after set to the starting_after value in that link until links.next is missing. The v1 tools page with page and perPage.

Limits: Snyk allows about 1,620 REST requests per minute per token and 2,000 v1 requests per minute per user; 429 means wait a minute.

Errors: 401 means the token is wrong, expired or revoked, belongs to another region (check SNYK_API_URL), or the plan has no API access. 403 means the token's role does not allow the call in that organization. 404 means a wrong id, or an organization slug where the id is needed. 400 or 422 name the parameter that is wrong.

Official MCP server: Snyk's own MCP server runs locally through the Snyk CLI (npx -y snyk@latest mcp -t stdio) and scans local code; it is not a hosted server for this API.

Out of scope here: starting tests or scans and importing repositories, deleting or deactivating projects and targets, moving projects, creating organization-level policies, group-level reports, audit logs, settings, integrations setup, members and invites, service accounts, Snyk Apps, cloud and AI-BOM endpoints.