Hermes Agent plugin: Snyk code/dependency/container/IaC scanning via Snyk's first-party MCP server, with the snyk-security-scan skill bundled (Agent Plugins v1)
Scan code, dependencies, container images, IaC and SBOMs from Hermes Agent through Snyk's first-party MCP server. Snyk ships the server inside the Snyk CLI (snyk mcp is a vendor subcommand, not a community wrapper), so this plugin is a pinned npx stdio launch plus a workflow skill.
This is a portable Agent Plugins v1 package. One install ships:
- mcp.json — the Snyk MCP server entry (sn), registered for every new session while the plugin is enabled. No mcpservers edits in config.yaml. - skills/snyk-security-scan/ — the workflow skill: when to use which scanner, the auth/trust/scan/fix loop, pitfalls, and a full per-tool argument reference generated from the live server.
Then start a new Hermes session. The skill is available as agent-plugin-snyk-8cb0f11d:snyk-security-scan via skillview (skillslist shows the exact name). Node.js/npm must be on PATH (the server is launched with npx -y snyk@1.1306.0 mcp -t stdio --profile full). The first launch downloads the pinned CLI.
No credentials are needed at install time. Ask Hermes to run the snykauth tool before the first scan: it opens Snyk's browser login and stores the token in the Snyk CLI's own config, never in Hermes. A free Snyk account covers the code (SAST) and open-source (SCA) scanners.
13 tools, all listed in skills/snyk-security-scan/references/tools.md: snykcodescan (SAST), snykscascan (dependencies), snykcontainerscan, snykiacscan, snyksbomscan, snykaibom, snykpackagehealthcheck, snykbreakabilitycheck, snykauth, snyktrust, snyklogout, snykversion, snyksendfeedback.
From the project README.
Add the radar badge to your README — it shows your project was picked up by MCP Radar and links to this page:
[](https://mcp.liqiwa.com/s/NousResearch--hermes-plugin-snyk.html)
The top new MCP servers of the week, every Monday. No spam, unsubscribe anytime.