Kiwi for Snyk
Have the agent on a Kiwi step scan its code and dependencies for vulnerabilities through the MCP server in the Snyk CLI.
- Your agent works in Snyk through its own connection. Kiwi does not call Snyk and never holds its credentials.
- A workflow skill can list Snyk among the tools it requires. When you supply your agent's available tools to a skill check and Snyk is not among them, the check reports
SK15-UNSUPPORTED-TOOL. - A project Admin can add links to Snyk, with notes, under Connections and bind them to the steps that use them. The agent reads them with
list_connections. - The agent can report the tools and plugins it ran with, including its Snyk connection, with
report_configuration. - The agent submits links to its work in Snyk as the step's outputs. People review them, and sign-off stays with the people your workflow names.
What your agent can do in Snyk
- Scan source code for security issues with Snyk Code.
- Scan open source dependencies for known vulnerabilities.
- Scan infrastructure as code files and container images.
- Generate a software bill of materials and check a package's health before adding it.
Set up
Connect your agent to Kiwi
Add Kiwi's hosted MCP server,
https://kiwiflow.io/mcp, to your coding agent.Connect your agent to Snyk
Run the Snyk MCP server where your agent runs. The credentials stay with your agent.
snyk mcp -t stdioExample skill
Publish instructions like these as a workflow skill that lists Snyk among its required tools.
Start from the repository path and the changed files in the assignment. Run the Snyk code and open source scans on the changed project. Fix new high severity issues, then scan one more time and stop there. Submit the scan summary and any remaining issue IDs as the step outputs. If issues remain after the second scan, report a blocker to the step owner; the assigned reviewer decides on the remaining risks.