OfficialVerified

Saw MCP Server

Snyk API & Web scan targets, DAST configuration, and finding triage via AI.

Data last scanned today · Reviewed today

63★ 8PythonApache-2.0

Overview

This server integrates Snyk API & Web (formerly Probely) functionality into MCP-compatible clients, allowing AI models to interact with security workflows. It supports onboarding scan targets, performing DAST scans, and managing triage processes through natural language commands. The tool is built on FastMCP 2.0 and supports multiple installation paths, including direct integration within the Cursor or Devin marketplaces, as well as a standalone configuration via the uvx package runner.

Our verdict

With a high-risk security score of 40/100, this server requires cautious deployment. The risk is primarily attributed to the fact that it is not yet editorially reviewed and its authentication methods have not been evaluated, which is significant when granting an AI server access to security scan targets and triage tools. Users should strictly adhere to the README recommendation of creating a custom, limited-scope API key rather than using a highly privileged or global account key.

Supports limited-scope API keys for permission containment
Zero direct dependencies reduce potential supply-chain attack surface
Active repository maintenance with commits as recent as three days ago
Apache-2.0 open-source licensing

Community-maintained repository without official vendor support
Read-only mode and authentication methods remain unreviewed
Repository is closed to external public contributions
No official project homepage provided

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›What are the core system requirements for running this server?

You need Python 3.10+ and Node.js 18+ with npm to support web target login recording via playwright-cli.

›How should I configure my API key for security?

Use a custom role, limited-scope API key rather than a global one, and utilize environment variables or secret manager references like 'op://' to avoid storing plaintext keys.

›Why do the tool names and endpoints still use the 'probely' prefix?

Snyk API & Web was formerly known as Probely, so legacy components and API endpoints retain the previous naming convention while newer configuration variables use 'SAW'.

›Do I need to install anything else for web targets requiring login?

You must install playwright-cli and the chromium browser, or alternatively, use the Playwright MCP server as a second integrated server.

›Can I contribute to the codebase?

No, this repository is currently closed to external contributions, including pull requests and issues.

›Where does the server look for my API key?

The server checks for the API key in the environment variable MCP_SAW_API_KEY, then a .env file, and finally the config/config.yaml file.