Does Snyk agent-scan require a Snyk account?

Yes. Snyk agent-scan requires a SNYK_TOKEN environment variable set before running scans. You need a Snyk account (free tier available at snyk.io) and an API token from your account settings. Keelix requires no account, no token, and makes no network calls during a scan.

Can Snyk agent-scan check if my Docker host is exposed to the internet?

No. Snyk agent-scan analyzes MCP server definitions and tool descriptions in isolation — it does not scan host configuration, network exposure, running containers, or deployment context. It answers: 'does this MCP server definition contain risky patterns?' Keelix answers: 'is this deployed box safe to ship?' They operate on different surfaces.

Should I use Keelix or Snyk agent-scan?

Both, at different stages. Run Snyk agent-scan at development time to check an MCP server's tool descriptions for prompt injection patterns, tool poisoning, and known CVEs in its dependencies — before it merges. Run Keelix at deploy time to confirm the whole box — host config, containers, internet exposure, and the AI agents actually running on it — is fit to ship. Neither tool replaces the other.

Does Keelix detect prompt injection in MCP server tool descriptions?

Keelix grades MCP servers on the live deployed box — checking auto-approval state, plaintext secrets in MCP config, unvetted server publishers, and the lethal trifecta. For static analysis of tool descriptions for prompt injection patterns before deployment, Snyk agent-scan is the purpose-built tool. The two tools are complementary: Snyk catches bad definitions at dev time, Keelix grades the deployment context at ship time.

What is the lethal trifecta and does Snyk agent-scan detect it?

The lethal trifecta is a risk pattern introduced by Simon Willison: an AI agent simultaneously has access to private data, is exposed to untrusted input, and has a reachable exfiltration channel. Snyk agent-scan can detect individual risk indicators in tool descriptions; Keelix specifically checks whether all three legs are present together on a deployed box and scores the combined risk as a whole-box posture finding.

Comparison

Keelix vs Snyk

Short answer: run both — at different stages. Snyk's agent-scan checks MCP server definitions for risky patterns before they deploy. Keelix grades the live deployed box — host config, containers, internet exposure, and the AI agents actually running on it — and rolls everything into a 0–100 posture score. Different stages, different surfaces, no overlap.

Different questions at different stages

Snyk agent-scan answers: “Does this MCP server's tool descriptions contain prompt injection, tool poisoning, or known CVEs in its dependencies?” It runs on your local machine, auto-discovers agent configurations for Claude Code, Cursor, Windsurf, and Gemini CLI, connects to MCP servers to retrieve tool descriptions, and checks them against 15+ risk categories — including prompt injection, tool shadowing, toxic flows, and hardcoded credentials. Apache-2.0, genuinely useful, and the right tool for catching bad server definitions before they merge.

Keelix answers: “Is this deployed box fit to ship — including the AI agents and MCP servers running on it right now?” It scans from outside the box in, audits host config against 93 CIS/SOC 2/ISO 27001 controls, checks what ports are actually reachable from the internet, and grades every AI agent and MCP server on the machine for auto-approval state, plaintext secrets in config files, and the lethal trifecta. The result is a single 0–100 score you can gate CI on — with no Snyk account required, no API token, and nothing leaving your box.

The gap between the two tools is the deployment context. Snyk agent-scan can tell you a tool description looks risky in isolation. It cannot tell you whether auto-approval is actually active on the box where that server is running, or whether that box has port 2375 reachable from the open internet because Docker silently bypassed UFW. That gap is exactly what Keelix closes.

Side by side

	Keelix	Snyk agent-scan
Primary scope	Live deployed box: host config, containers, internet exposure, AI-agent/MCP posture	Local MCP server definitions + tool descriptions (pre-deploy, in isolation)
What it analyzes	Running deployment context — auto-approval state, live host config, open ports, container posture	MCP server code and tool descriptions — prompt injection patterns, tool poisoning, hardcoded secrets
AI-agent / MCP posture	✓ Auto-approval, plaintext secrets, unvetted servers, lethal trifecta — on the live box	✓ Prompt injection, tool poisoning/shadowing, toxic flows, credential handling — in definitions
Host config & exposure	✓ 93 CIS/SOC 2/ISO 27001 checks + outside-in exposure (what's reachable from internet)	✗ Not scanned
CVE scanning	Host OS packages (via posture checks)	✓ Known CVEs in MCP server dependencies
Output	0–100 posture score + per-finding report, JSON/HTML/scan record	Finding list with severity and issue codes, JSON output
CI gate mechanism	Exit code on posture threshold (e.g. score ≥ 80)	Exit code on findings (block on high/critical severity)
Compliance evidence	✓ SOC 2, ISO 27001, CIS Docker Benchmark — shareable audit records	✗ Not generated
Requires account / token	No — runs entirely locally; CLI is anonymous	Yes — SNYK_TOKEN environment variable required
Local-first / zero telemetry	✓ Nothing leaves your box; secrets redacted at boundary	Validates components against Snyk API; requires network call to Snyk Evo for background mode
License	Apache-2.0	Apache-2.0
Price	CLI free forever; Keelix Cloud (history, alerts, teams) — see /pricing	Free tier available; Team/Enterprise plans from $25/month per developer

The token and trust question

Snyk agent-scan requires a SNYK_TOKEN environment variable. The tool validates components against Snyk's API, and its background monitoring mode (Snyk Evo) sends results to a Snyk instance for company-wide monitoring. That is a reasonable trade-off for teams already in the Snyk ecosystem — you get aggregated reporting, policy management, and integration with Snyk's broader vulnerability intelligence.

For a self-hosted VPS or an air-gapped deployment — the server running your Nextcloud, your internal AI tooling, your customer database — the calculus is different. Keelix is designed from the ground up for that environment. The CLI requires no account, no token, and makes no outbound network calls during a scan. Secrets found in MCP config files are redacted at the scan boundary. The posture score is computed entirely on-box.

That design is not just a feature checkbox. It is why Keelix can safely scan production servers without routing findings through a third-party cloud service — and why the posture score remains meaningful on hosts that have no outbound connectivity at all.

Where Snyk agent-scan excels

Snyk agent-scan has earned its 2,500+ GitHub stars because it solves a real problem: catching dangerous tool descriptions before they reach production. Its 15+ risk categories — prompt injection, tool poisoning, tool shadowing, toxic flows, malware payload patterns — are specifically designed for the pre-deploy, developer-facing workflow. If your team is building or consuming MCP servers and wants a shift-left gate on the server definitions themselves, agent-scan is the right tool for that job.

Snyk also brings its broader ecosystem: dependency scanning for CVEs in MCP server packages, integration with its policy engine, and a SaaS-native reporting layer for teams that want centralized visibility across many developers. For developer-first security teams already running Snyk in CI, agent-scan slots naturally into the existing workflow.

The deployment context Snyk agent-scan cannot reach

After Snyk agent-scan clears your MCP server definitions, there are deployment-context questions that static analysis cannot answer:

Is the MCP server on this box configured with auto-approval active? A clean tool description with auto-approval enabled means any prompt injection that gets through turns into unconstrained tool execution.
Does the Claude Code config file on this host contain a plaintext Anthropic API key or database password? Secrets in MCP config are a deployment-time problem, not a definition-time problem.
Is this box missing the other two legs of the lethal trifecta? A server with access to private data, exposed to untrusted input, with an exfiltration channel open is high-severity regardless of whether its tool descriptions look clean.
Is port 2375 reachable from the open internet because Docker bypassed the firewall? That is an infrastructure finding that no amount of MCP definition analysis will surface.

These are the questions Keelix answers — and none of them require a Snyk account.

Recommended setup: shift-left with Snyk, gate at deploy with Keelix

A practical pipeline for teams building with MCP servers looks like this: Snyk agent-scan runs in the build/PR stage to flag risky tool descriptions and CVEs in MCP server dependencies before the code merges. Keelix runs in the deploy-to-staging stage to confirm the live box — host config, exposure, and every agent running on it — meets the posture threshold before promote-to-production.

Example pipeline (GitHub Actions)

# Build stage — Snyk agent-scan (MCP definition analysis)
- name: Snyk agent-scan
  run: |
    npm install -g @snyk/agent-scan
    snyk-agent-scan
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}

# Deploy-to-staging stage — Keelix posture gate (live box)
- name: Keelix posture gate
  uses: jakelamon/keelix@v0.1.0
  with:
    threshold: 80
    fail-on: mcp-auto-approval,mcp-secrets

Snyk catches risky definitions before they ship. Keelix confirms the deployed box is fit to run them.

Frequently asked

Does Snyk agent-scan require a Snyk account?: Yes. Snyk agent-scan requires a SNYK_TOKEN environment variable set before running scans. You need a Snyk account (free tier available at snyk.io) and an API token from your account settings. Keelix requires no account, no token, and makes no network calls during a scan.
Can Snyk agent-scan check if my Docker host is exposed to the internet?: No. Snyk agent-scan analyzes MCP server definitions and tool descriptions in isolation — it does not scan host configuration, network exposure, running containers, or deployment context. It answers: 'does this MCP server definition contain risky patterns?' Keelix answers: 'is this deployed box safe to ship?' They operate on different surfaces.
Should I use Keelix or Snyk agent-scan?: Both, at different stages. Run Snyk agent-scan at development time to check an MCP server's tool descriptions for prompt injection patterns, tool poisoning, and known CVEs in its dependencies — before it merges. Run Keelix at deploy time to confirm the whole box — host config, containers, internet exposure, and the AI agents actually running on it — is fit to ship. Neither tool replaces the other.
Does Keelix detect prompt injection in MCP server tool descriptions?: Keelix grades MCP servers on the live deployed box — checking auto-approval state, plaintext secrets in MCP config, unvetted server publishers, and the lethal trifecta. For static analysis of tool descriptions for prompt injection patterns before deployment, Snyk agent-scan is the purpose-built tool. The two tools are complementary: Snyk catches bad definitions at dev time, Keelix grades the deployment context at ship time.
What is the lethal trifecta and does Snyk agent-scan detect it?: The lethal trifecta is a risk pattern introduced by Simon Willison: an AI agent simultaneously has access to private data, is exposed to untrusted input, and has a reachable exfiltration channel. Snyk agent-scan can detect individual risk indicators in tool descriptions; Keelix specifically checks whether all three legs are present together on a deployed box and scores the combined risk as a whole-box posture finding.

Add the deployment-context gate Snyk agent-scan cannot provide.

Free, local-first, Apache-2.0. No account. No token. Nothing leaves your box.

operator@host — keelix

# install — free & open source (Apache-2.0)

$ curl -fsSL https://keelix.dev/install.sh | sh

$ keelix scan

Get started Pricing