Snyk MCP server

What the model can do

Snyk security findings: organisations, projects (what is scanned, from where, with its latest issue counts), open and resolved issues by severity, type, project and date with the vulnerable package and whether a fix exists, issue counts by severity and type, and one issue in full with its CVEs, CWEs and remedies. Can ignore and un-ignore an issue in a project, change a project's criticality, environment, lifecycle, tags, test frequency or owner, delete a project or target, and create collections and add projects to them.

Reads

• snyk_orgsWho the token is and the Snyk organisations it can see (id, name, slug, group).
• snyk_projectsProjects in an organisation — each thing Snyk scans: name, type (npm, maven, sast, terraformconfig…), origin (github, cli, docker-hub…)…
• snyk_projectOne project in full by id: what it is, where it came from, its settings, latest issue counts and dependency total, plus up to 50 of its open issues…
• snyk_issuesIssues Snyk found in an organisation, in the order Snyk returns them (it promises none — narrow by created dates for the recent ones): title, type…
• snyk_issue_countsHow many issues there are, counted here from the issue list: by severity, by type, how many have a fix available…
• snyk_issueOne issue in full by id: description, severity and risk score, every CVE/vulnerability id with its link, CWE classes, every location…

Acts, when you ask

These change something in Snyk. The model is told to use them only when you ask for exactly that, and each one is granted by name: per team on a shared connection, by the owner on a personal one.

• snyk_ignore_issueIgnores one issue in one project so it stops counting in that project's results, attributed to the token's owner.
• snyk_unignore_issueRemoves every ignore on one issue in one project, so it counts in the project's results again.
• snyk_update_projectChanges a Snyk project's business criticality, environment, lifecycle, tags (each replaces that whole list) or recurring test frequency (daily…
• snyk_delete_projectPermanently deletes one Snyk project and its findings history.
• snyk_delete_targetPermanently deletes one Snyk target (a repository or image, target_id from snyk_projects) and every project under it, with their findings history.
• snyk_create_collectionCreates a collection (a named group of projects) in the organisation.
• snyk_add_projects_to_collectionAdds up to 100 named projects to a collection.

Connect it

First connect Snyk on Dashboard → Connections, then add Memtro to your client once. The Snyk tools appear alongside the tools of everything else you have connected; nothing is configured per connector.

claude plugin marketplace add memtro-org/claude-memtro
claude plugin install memtro@memtro --config api_key=sk-memtro-...

{
  "mcpServers": {
    "memtro": {
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

{
  "mcp": {
    "memtro": {
      "type": "remote",
      "url": "https://platform.memtro.com/api/mcp",
      "headers": {
        "Authorization": "Bearer sk-memtro-..."
      }
    }
  }
}

Who may use it

The key identifies the person, and the server offers that person the tools they may use everywhere else in Memtro. A shared Snyk connection is used by the teams an administrator granted it to, tool by tool, on the Permissions page; a personal connection is used by its owner alone, and its tools that act stay off until the owner allows them. See Teams and permissions and Connectors.

Ask it like this

• › Which critical issues in the api repo have an upgrade available?
• › How many open high-severity vulnerabilities do we have, and which package has the most?
• › What was found in the last 7 days across all projects?
• › Give me the full detail and remedies for the lodash prototype pollution issue
• › Ignore the minimist issue in the build-tools project for 30 days: it is not reachable at runtime

Questions

Is this an official Snyk MCP server?

No. It is Memtro's MCP server with Memtro's Snyk connector behind it: the connector reads Snyk through its API with the credentials you connect on Dashboard → Connections, and Snyk publishes nothing here. The same endpoint carries every other system you connect and Memtro's memory tools.

What does it cost?

Nothing on top of Memtro. One price per organisation by its number of users, from $50 a month for up to 10 users after a 7-day free trial, with every connector, the MCP server, jobs and memory included. You bring your own model keys.

Can it change anything in Snyk?

Only when you ask, and only what it has been granted: ignore an issue in a project, with a reason and an optional expiry; remove an ignore so the issue counts again; change a project's business criticality, environment, lifecycle, tags, test frequency or owner; delete a project and its findings history; delete a target and every project under it; create a collection; add projects to a collection. Every other tool reads, searches or lists. An administrator grants each acting tool by name per team, and a personal connection acts only after its owner allows it.

Which clients work?

Any MCP client that speaks Streamable HTTP: Claude Code, Cursor, Claude Desktop, OpenCode, Codex, Zed, Windsurf, Cline and the Anthropic and OpenAI SDKs. There is no local process to run; the server is remote and authenticated with your key.

Other MCP servers · Engineering and operations

• GitHub MCP server
• AWS CloudWatch MCP server
• Sentry MCP server
• ServiceNow MCP server
• Okta MCP server
• Twilio MCP server