Connect Claude to Snyk

Read organizations, projects, targets, security issues, SBOMs, and scan settings. Toolspoke puts 9 of its actions behind one MCP endpoint that Claude, Cursor, and Codex all speak.

Connect View pricing

Connection: Provider REST API
Authentication: API token
Actions exposed: 9
Cost per call (typical): 1 credit
Adapter: Maintained by Toolspoke

Connected in three steps

1
Install Snyk
Open the marketplace in your workspace, add Snyk to the project your agents work in, and it appears on the gateway immediately.
2
Connect the credential
Authenticate with api token. Where to get one, and what it has to be able to reach, is the next section.
3
Point your agent at the gateway
Give your client one address, https://toolspoke.com/mcp. Claude Code takes it as a command, Claude and Claude Desktop add it as a custom connector, and Cursor, Codex and VS Code each read it from a config file of their own.

.mcp.json

{
  "mcpServers": {
    "toolspoke": {
      "type": "http",
      "url": "https://toolspoke.com/mcp"
    }
  }
}

One block covers every tool you have installed. Snyk shows up in the client as soon as your policy allows it, and so does everything else you install later.

Where the address goes, per client

Claude Code: Run it in your project, then /mcp to sign in
claude mcp add --transport http toolspoke https://toolspoke.com/mcp
Claude and Claude Desktop: Settings, then Connectors, then Add custom connector
https://toolspoke.com/mcp
Cursor: ~/.cursor/mcp.json, or .cursor/mcp.json for one project
{ "mcpServers": { "toolspoke": { "url": "https://toolspoke.com/mcp" } } }
Codex: ~/.codex/config.toml
[mcp_servers.toolspoke] url = "https://toolspoke.com/mcp"
VS Code: .vscode/mcp.json, or the MCP: Add Server command
{ "servers": { "toolspoke": { "type": "http", "url": "https://toolspoke.com/mcp" } } }

What Snyk asks for

API token. You provide it once, when you install the connector. Toolspoke encrypts it at rest and decrypts it only for the length of a single call, and the gateway attaches it to the outbound request itself, so it is never part of the arguments an agent sends.

API tokenRequired: Snyk → your account settings → General → Auth Token, or a service account token from Group or Organization settings. Sent as "Authorization: token <value>", which is Snyk's own format and not a bearer token. A token is tied to one region.; Paste the token value
Default organization IDOptional: Used whenever an action is called without an explicit org_id. This is the UUID from Organization settings, not the slug. Leave it blank to require one on every call; list_organizations shows what this token can see.; 00000000-0000-0000-0000-000000000000
REST API URLOptional: The REST host for your Snyk region: https://api.snyk.io/rest (SNYK-US-01), https://api.us.snyk.io/rest (US-02), https://api.eu.snyk.io/rest (EU-01), https://api.au.snyk.io/rest (AU-01). A token issued in one region does not authenticate against another.; https://api.snyk.io/rest

What Claude can do in Snyk

9 actions, each one declared and named by the connector rather than discovered at runtime. A workspace policy grants a person all of them, a hand-picked selection, everything on the read side, everything on the write side, or none.

Reads: 9Reads
Writes: 0Writes
Destructive: 0Destructive

Reads

Fetches data and changes nothing.

list_organizations
List the organizations this token can see, with each one's id, name and slug. Call it first when you do not know which organization to act on, and to find out whether the connection reaches anything at all. The id returned here is the UUID every org_id argument below takes - not the slug shown in the Snyk URL bar.
get_self
Return the user or service account this token belongs to. Call it to confirm whose access the connection is acting with before reading anything else.
list_projects
List an organization's projects - each one is a single manifest or image Snyk monitors, with its name, type, origin, target reference and business criticality. Pass meta_latest_issue_counts to get the open issue counts per project in the same call, which is usually the fastest way to find what is worth looking at.
get_project
Fetch one project by id - its name, type, origin, target file and reference, tags, business criticality, environment and lifecycle. The target it belongs to is always embedded, so this answers which repository or image the project came from without a second call. Pass meta_latest_issue_counts for its open issue counts.
list_issues
List an organization's security issues. To see one project's issues, pass its UUID as scan_item_id - the API filters by scan item rather than by a project_id parameter, and this operation supplies the matching scan_item.type for you. Each issue carries its title, type, effective severity, status, and the file path, line and commit where it was found. The response is not written to the audit log: a list of unfixed vulnerabilities with the file each one lives in is the single most useful thing an attacker could read out of a transcript.
get_issue
Fetch one issue by id - its title and description, severity, the problems it maps to (CVE, CWE, Snyk rule), its coordinates in the codebase or dependency tree, and any recorded resolution. The response is not written to the audit log, for the same reason list_issues is not.
list_targets
List an organization's targets - the repositories, images and other sources Snyk imports projects from, with each one's display name, URL and origin. A target is the thing you connected; a project is one manifest inside it. Pass exclude_empty to skip targets that produced no projects.
get_project_sbom
Fetch a project's software bill of materials - every dependency Snyk resolved for it, with versions and, unless excluded, licences. This is the closest thing the REST API has to a dependency listing: Snyk publishes no REST endpoint that lists dependencies, only this document and a count on the projects endpoints. The response is not written to the audit log, because a complete versioned dependency inventory is a map of what a project is vulnerable to.
get_sast_settings
Read whether Snyk Code is enabled for an organization, and how it is configured. Snyk has no single org-settings endpoint - settings are split by product - so this is the Code one; the equivalent IaC and secrets settings live on sibling paths this connector does not expose. Use it to check that a clean Code report means scanning was actually on.

What it will not do

Enforced by the gateway rather than left to convention, which is why each of these can be stated flatly.

It cannot call anything else: The 9 actions above are the whole of it. A call to any other name is refused before it reaches Snyk rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time.
It only reads: Every action here reads. Nothing this connector can do changes anything in Snyk.
It reaches no further than your credential: Toolspoke holds no access to Snyk of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either.
It never hears from Snyk: Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Snyk. An agent has to ask.
It does not smooth over provider limits: Toolspoke does not retry, queue or back off around Snyk's own rate limits. A call that Snyk refuses comes back to the agent as a failed call.

Before you connect it

What can Claude do in Snyk?

9 named actions: 9 that only read. They include list_organizations, get_self and list_projects. Nothing outside that list is reachable: the connector declares each operation by name rather than proxying whatever an agent asks for.

What credentials does the Snyk connector need?

API token. The connector asks for api token, and optionally default organization id and rest api url. Values are encrypted at rest and attached to the outbound request by the gateway, so they are never part of the arguments an agent sends and never reach the audit log.

Does the Snyk connector work with Cursor and Codex, or only Claude?

Any client that speaks MCP, and every one of them gets the same 9 actions. There is a single address, https://toolspoke.com/mcp. Claude Code adds it with claude mcp add --transport http, Claude and Claude Desktop take it as a custom connector in settings, Cursor reads it from .cursor/mcp.json, Codex from ~/.codex/config.toml, and VS Code from .vscode/mcp.json. Each of them signs in to the gateway itself, so there is no key to paste.

What does the Snyk connector not do?

The 9 actions above are the whole of it. A call to any other name is refused before it reaches Snyk rather than forwarded on, and connecting your account does not add to the list: it is fixed by the connector, not discovered at run time. Every action here reads. Nothing this connector can do changes anything in Snyk. Toolspoke holds no access to Snyk of its own. Every call carries the credential you stored and nothing besides, so whatever that credential cannot reach, this connector cannot reach either. Nothing is pushed to it. There is no webhook, no subscription and no polling, so this connector cannot notice by itself that something changed in Snyk. An agent has to ask. Toolspoke does not retry, queue or back off around Snyk's own rate limits. A call that Snyk refuses comes back to the agent as a failed call.

Can I limit which actions an agent can call?

Yes, in two places. The project switches Snyk's actions on and off one at a time, for everyone in the project at once, and the screen groups them by read, write and destructive so turning off everything that deletes is one click. An individual agent key can then be narrowed further, to particular toolkits in a project and to particular actions in a toolkit. Whatever it was granted, a key never reaches a project its owner cannot.

What gets recorded when an agent calls Snyk?

Every attempt, with the agent that made it and the person that agent belongs to, the full request payload, the response payload, the status, the duration, and the credits spent. Values whose key names a secret are masked out before the record is shown to anyone. An operation the connector marks as not retained never has its response body written at all, so the gateway keeps no second copy of what was read.

More security connectors

Browse all of them