# Agent Scan v0.6.4: The Hacker's Swiss Army Knife for AI Supply Chain Security

The emerging AI agent ecosystem is a paradise for threat actors, and the release of agent-scan v0.6.4-snapshot-6e2d290-1638 is the cybersecurity community's answer. This open-source security scanner is designed to rip through your machine, discovering AI agents, MCP servers, and agent skills to expose prompt injections, malware payloads, and toxic flows hiding in natural language. For security researchers and ethical hackers, this tool is the latest essential asset for auditing the explosive attack surface of local AI infrastructure.

While the industry obsesses over LLM alignment and jailbreaks, the real vulnerability often lies in the plumbing: the Model Context Protocol (MCP) servers, harnesses, and "skills" that connect these models to your data. Agent Scan, developed by the Snyk team, targets this exact gap. It automates the discovery and analysis of these installed components, scanning for common threats like prompt injection, sensitive data handling failures, and malicious payloads hidden in plain text. This release marks a significant upgrade to a risk-based output structure, moving away from the legacy issue-code system, making it more resilient for researchers integrating it into their workflows.

## The Deep Dive: How Agent Scan Audits Your AI Stack

Agent Scan operates by aggressively hunting down agent configurations on your system. It supports auto-discovery for major platforms including Claude Code, Claude Desktop, Cursor, Gemini CLI, and Windsurf, alongside broader ecosystem tools like GitHub Copilot and OpenClaw. The tool doesn't just look at the agents themselves; it dives into their configuration scopes, differentiating between user-level installs, project-specific repositories, and plugin scopes. This ensures that a security researcher can map the entire supply chain, from a global setting down to a malicious `.mcp.json` file hidden in a repository’s `.github` directory.

The core utility lies in its dual operational modes. The first is a **Scan Mode**, where the CLI command `snyk-agent-scan` performs a comprehensive sweep of the current machine and outputs a detailed report. The second is a **Background Mode** (often called MDM), where the agent scans at regular intervals and reports findings to a centralized Snyk Evo instance. For enterprise security teams, this second mode is gold—it allows for company-wide monitoring of the agent supply chain, flagging vulnerabilities before they become a data breach.

### The Security Implications: Why This Tool is a "Hacker" Must-Have

From a pen-testing perspective, the most fascinating—and dangerous—aspect of this tool is how it interacts with MCP servers. To retrieve tool descriptions, **Agent Scan actually executes the commands in the stdio configurations and connects to remote MCP server URLs**. This is where the gloves come off. The tool acknowledges that scanning an MCP config can trigger code execution or outbound network requests. For security professionals, this is a powerful way to prove a point: if you can lure a developer into running a scan on a poisoned repository, you can potentially exfiltrate data via DNS rebinding or malicious MCP responses.

To mitigate this during interactive forensic runs, Agent Scan requires explicit user consent (y/n) before contacting each discovered server. However, in background or "push-key" scans, it automatically inspects remote servers without starting stdio ones unless the user explicitly passes the `--dangerously-run-mcp-servers` flag. This flag is a literal red flag for hackers: it confirms that the scanner is willing to run arbitrary commands found in config files, but only in trusted environments. The built-in protections block requests to link-local addresses and cloud-metadata endpoints (like 169.254.0.0/16 or 100.100.100.200) to prevent obvious SSRF attacks, though the documentation candidly notes a DNS-rebinding window exists—a tasty detail for vulnerability researchers.

## Installation and Integrity: A Security-First Approach

The developers note that they do not publish an npm package for Agent Scan, steering users away from the potentially poisoned npm supply chain. Instead, installation is handled via `uvx` or by downloading standalone binaries from GitHub Releases. This is a crucial step for cybersecurity best practices; using `uvx` ensures dependencies are managed in isolated environments, reducing the risk of dependency confusion attacks, a common vector for malware distribution.

Integrity is further ensured through **GPG signing on the release checksums file**. The documentation provides a clear workflow for verification: download the binary and the `.asc` signature file, verify the key ("Snyk Limited"), and then check the SHA256 checksums. This is an excellent standard for the industry, ensuring that the scanner you are using to find malware isn't itself trojanized.

## Navigating the Experimental CLI and Future Deprecations

A critical note for developers and system administrators: the raw output of this CLI is explicitly experimental. The issue codes, field names, severity labels, and response structures are subject to change without notice. The docs warn against building production workflows that depend on specific output fields. The release signals a transition period, with v0.5.x slated for deprecation in favor of v0.6 and later, which use a risk-based output structure and a newer analysis API (2026-07-10). This ensures that while the underlying discovery engine remains stable for enterprise use, the user-facing data formats are evolving rapidly as the security landscape shifts.

For those looking to test their own defenses, the repository includes a "vulnerable MCP server" demo. This is a perfect sandbox for ethical hackers to see exactly what kind of findings the tool reports, from prompt injection to destructive capabilities. By running Agent Scan against this demo server, users can see the risk indicators scored in real-time, allowing them to calibrate their own detection signatures.

## Conclusion

Agent Scan v0.6.4 is more than just a scanner; it is a declaration that the AI supply chain is a legitimate warzone. For ethical hackers and security researchers, it provides the necessary firepower to inspect agent components that are often overlooked in standard vulnerability assessments. With its auto-discovery across major AI platforms, robust background scanning for enterprise monitoring, and a strict security posture regarding execution and data redaction, it is the definitive tool for ensuring your AI stack isn't secretly exfiltrating data. While the CLI output is experimental, the core value proposition is solid: **know your agents, or risk being owned by them.**

---

**Keywords:** `agent scan`, `AI security`, `MCP server vulnerability`, `prompt injection`, `cybersecurity tool`, `AI supply chain attack`, `malware detection`, `data breach prevention`, `security scanning`, `ethical hacking`.