Snyk

Plugins for VS Code, Visual Studio, Eclipse, JetBrains; real-time Snyk Code and Secrets scanning.

Snyk Studio hooks and rules for Claude Code, Cursor, Codex CLI, Gemini CLI, Copilot; local MCP server.

Snyk CLI runs local pre-commit and CI/CD scans across code, deps, container, IaC, secrets.

Per-issue inline PR comments with severity and data flow, capped at 10 per PR.

PR checks set SCM status and GitLab MR pipeline status; severity and fixability failure conditions.

SCM import scans whole repos into Snyk Projects; Free capped at 5 projects.

Recurring tests never/daily/weekly (default daily Open Source, weekly IaC); scheduled container registry sync.

Kubernetes Connector reads live workloads; cloud scans of deployed resources are Enterprise; DAST scans live apps.

Snyk Code semantic SAST (DeepCode AI engine) across IDE, CLI, SCM and CI/CD.

Source-to-sink data flow analysis with AI-learned sources, sinks and sanitizers; data-flow visualization.

Snyk Secrets uses entropy, ML semantic analysis and regex; IDE, CLI, SCM and PR checks.

Not offered in vendor documentation reviewed as of 2026-09-05.

Snyk Open Source builds full dependency graph including transitive deps against Snyk Vulnerability Database.

Java and JavaScript only; Early Access via Snyk Preview; limits of 300,000 files / 3GB.

CWE-506 malicious packages flagged Critical; research team monitors typosquatting, dependency confusion, hijacking.

SPDX-aligned catalog, default severities, OR/AND dual licenses, custom license policies, org Licenses tab.

Org-wide BOM view exportable to CSV and AI-BOM generation; CLI `snyk sbom test` consumes SBOMs.

Terraform, CloudFormation, Kubernetes, Helm, ARM, AWS CDK, Serverless; CCSS severity; custom-rule SDK.

Scans final image OS and app packages; base image upgrade advice; automatic Dockerfile fix PRs.

Cloud scans of live AWS, Azure, Google Cloud resource configurations; Enterprise plan only.

Snyk API & Web scans live apps and APIs; BOLA testing; SAST/DAST correlation to source lines.

Snyk Code coding-issue detection covers dead code, predefined branches, duplicate branch logic only.

Not documented; Snyk Code's 8 AI-engine categories include no complexity metric

Only duplicate branch logic inside Snyk Code coding-issue analysis; no repo duplication metric documented.

Snyk Code coding-issue detection explicitly includes dead code and predefined branches.

Snyk's own 'coverage' means scan coverage of assets, not test coverage

Snyk's coverage model has no changed-line/new-code coverage concept

Not documented; Snyk Code's 8 AI-engine categories have no module-boundary rules

Remediation reports track MTTR/time-to-resolve history only, no effort/cost estimate

Analytics tracks IDE/CLI usage over time, orgs introducing most new issues, repository freshness; Ignite and Enterprise.

DeepCode AI engine finds null dereferences, race conditions, off-by-one, division-by-zero, type mismatches, buffer overruns.

Aggregated issue summary comment per PR by severity and type, updated in place on new commits.

Snyk Code sanitizer Rule Extensions, IaC custom-rule SDK, custom secret regex; custom rules need Ignite or Enterprise.

Snyk Agent Fix returns up to five AI fix suggestions via `@snyk /fix`, applied with `@snyk /apply #`.

Automatic Fix, backlog, dependency upgrade and Dockerfile base-image PRs; base-image PRs default-on for free accounts.

Triage Assistant checks exploit conditions for Java Gradle/Maven on GitHub only; reachability de-prioritizes unreachable vulns.

The CLI's --all-projects flag explicitly documents monorepo scanning, alongside --detection-depth and --exclude for multi-package repos.

DeepCode AI semantic engine powers Snyk Code; LLMs used for breakability, Agent Fix, Snyk Assist.

Not offered in vendor documentation reviewed as of 2026-09-05.

Local MCP server runs the Snyk CLI with scan tools; no hosted or remote MCP server offered.

No AI-generated-code inventory; Evo AI-BOM inventories models, agents, tools and MCP servers instead.

Evo chat queries inventory and policies; `@snyk /fix` PR commands; Snyk Assist ships in Learning add-on.

Thumbs up/down on breakability PR comments and a SAST/DAST correlation feedback loop improve accuracy.

"Does not use customer proprietary software code to train, optimize, fine-tune, or improve any AI models"

Audit logs exist as platform data and can be scoped to a hosting region.

SSO available on Ignite and Enterprise; SAML not named; Snyk for Government is Okta-managed SSO.

Fixed roles on Team; Custom Roles require Ignite or Enterprise; dedicated Rule Extensions permissions.

Auditor-ready PDF (first 50 rows) and CSV compliance reports; Ignite and Enterprise; PCI-DSS v4.0.1 Early Access.