182  mcp-scan(1) - Kailash Tool Reference

182.1 mcp-scan

mcp-scan - mcp-scan — Invariant’s scanner: detects tool poisoning, prompt injection and tool-description drift in installed MCP servers.

Layer ATTACK
Category a-03-agentic-mcp-tool-use
Safety class safe
Licence Apache-2.0
Upstream github.com/invariantlabs-ai/mcp-scan

182.1.1 NAME

mcp-scan - mcp-scan — Invariant’s scanner: detects tool poisoning, prompt injection and tool-description drift in installed MCP servers.

182.1.2 SYNOPSIS & usage

Derived from the upstream README at generation time; verify against --help where the tool is installed.

   export SNYK_TOKEN=your-api-token-here
# Scan the whole machine
uvx snyk-agent-scan@0.5.17

# Scan a specific MCP configuration
uvx snyk-agent-scan@0.5.17 ~/.vscode/mcp.json

# Scan a single agent skill
uvx snyk-agent-scan@0.5.17 ~/path/to/my/SKILL.md

# Scan all Claude skills
uvx snyk-agent-scan@0.5.17 ~/.claude/skills

182.1.3 DESCRIPTION (upstream)

Snyk Agent Scan Discover and scan agent components on your machine for prompt injections
and vulnerabilities (including agents, MCP servers, skills). > Note: We don’t publish an npm package for Agent Scan. Install it via uvx or as a standalone binary. > Note: CLI output is experimental and subject to change > > Agent Scan v0.5.x (planned for deprecation) > > The raw output of this CLI — including issue codes, field names, severity labels, and response structure — is experimental and may change without notice between releases. We do not recommend building production workflows that depend on specific CLI output fields or issu

182.1.4 CONFIGURATION (detected)

Config-surface markers detected in the upstream README (4 matches, e.g. environment variable, workspace.yaml). A full config reference page for this tool is queued under the config-page policy — this line is the detection record, not the page.

182.1.5 SEE ALSO

ref: v0.6.8-unstable-2026-10-06 - verified 2026-10-14