Skip to main content
Watch: I Built an AI App Without Leaving Databricks

Auth and security - official Snyk server

Snyk API & Web MCP server

Local Python MCP server for Snyk API & Web (formerly Probely), a DAST product, that lets an agent onboard web and API scan targets, configure login sequences and credentials, start scans and triage findings. It runs locally from snyk-apiweb-mcp (pypi) with API key auth.

Last verified 13 tools6 sources

Install

Generic

JSON
{
  "mcpServers": {
    "SAW": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/snyk/saw-mcp.git", "saw-mcp"],
      "env": {
        "MCP_SAW_API_KEY": "your-api-key"
      }
    }
  }
}

Tools

probely_list_targets
List scan targets, optionally filtered by search.
probely_create_web_target
Create a web application scan target.
probely_start_scan
Start a scan on a target, optionally with a profile.
probely_list_findings
List findings for a target, filtered by severity or state.
probely_update_finding
Change the state of a finding.
probely_create_sequence
Create a recorded login sequence for a target.
probely_configure_sequence_login
Enable or disable sequence-based login for a target.
probely_create_credential
Store a credential used for sensitive values such as passwords and tokens.
probely_list_credentials
List stored credentials.
probely_configure_form_login
Configure simple single-page form login for a target.
probely_configure_2fa_totp
Configure TOTP two-factor authentication for a target.
probely_create_api_target_from_postman
Create an API target from a Postman collection.
probely_create_api_target_from_openapi
Create an API target from an OpenAPI schema.

As documented on October 17, 2026. A running server reports its current list through tools/list.

Notes and caveats

  • Requires a Snyk API & Web API key (create a limited-scope custom-role key at plus.probely.app); set it as MCP_SAW_API_KEY.
  • Tool names, API endpoints (api.probely.com) and the console still use the legacy Probely naming.
  • Also installable from the Cursor Marketplace and Devin MCP Marketplace.
  • Destructive tools (delete target, delete credential, bulk update findings) are off by default.
  • Python 3.10+.
  • The PyPI identifier comes from the registry entry and matches the pyproject name, but the README documents install via uvx from git or release tarballs.
  • Status 'ga' is from the pyproject 'Production/Stable' classifier.
  • Repo closed to public contributions.

More MCP servers for auth and security

Related reading

FAQ

What does the Snyk API & Web MCP server do?

Local Python MCP server for Snyk API & Web (formerly Probely), a DAST product, that lets an agent onboard web and API scan targets, configure login sequences and credentials, start scans and triage findings. The vendor documents 13 tools, including probely_list_targets, probely_create_web_target, probely_start_scan and probely_list_findings.

How do I add the Snyk API & Web MCP server to an MCP client?

Snyk documents a Generic config; copy it from the Generic section of this page.

Does the Snyk API & Web MCP server need authentication?

Yes, API key. Transport: stdio. Status: GA, last checked October 17, 2026.

Sources

Last verified against 6 Snyk pages, then re-checked independently.

Newsletter

New MCP servers, the week they ship

One email per week. New official MCP servers, the coding tools that support them and how developers wire them up.