Security scanning
A coding agent writes a lot of code quickly, and some of it will be wrong in ways that matter — a key pasted into a config file, a query built by string formatting, a dependency with a known CVE. Some of that is caught automatically; the rest you can connect a scanner for.
Built in, nothing to set up
Every file the agent writes is checked as it is written. If it puts an API key in a config file, builds a SQL query by string formatting, sends credentials over http://, or logs a password, it is told so immediately — and fixes it on the spot:
wrote 63 chars to config.py
SECURITY WARNING (1 in config.py)
line 2: live API key in source — load it from the environment insteadThe write still happens; this warns rather than blocks, because a wrong guess that refuses your file is worse than a line of noise. It costs nothing — no extra model call, no tokens — and needs no account, no laptop and no configuration.
It is a deliberately short list of things that are nearly always a real mistake. For the rest, connect a scanner.
Connecting Snyk
SnykSnyk publishes an MCP server, so it plugs into iCoderAgent the same way any other connection does — there is nothing Snyk-specific to install in the app.
- Open Settings → Connections (MCP) → Browse and search for
snyk. - Pick
io.snyk/mcp. You will see exactly what is being added —npx -y snyk mcp -t stdio— and a warning that it runs a command on your laptop. Read it, then Save. - The first scan asks you to authenticate with your Snyk account.
After that, just ask. The agent calls the scan itself:
agent scan this project for vulnerabilities
agent check my dependencies for known CVEs
agent is anything in here exploitable before I ship it?What you need first
Snyk is a local (stdio) connection, which means it runs as a command rather than a web service. iPhone and iPad cannot spawn commands, so this needs a connected laptop — the companion runs Snyk and passes the results back to your phone.
| Requirement | Why |
|---|---|
| Companion running on a Mac, Windows or Linux machine | Runs the scan; the phone cannot |
| Node.js on that machine | npx fetches and runs the Snyk CLI |
| A Snyk account | Free tier works, with limits on first-party code scanning |
No laptop paired? Nothing breaks — the connection simply reports that it needs one, and the rest of the app is unaffected.
What it catches
Snyk brings a real vulnerability database, which is the part no amount of pattern-matching replaces:
- Known CVEs in your dependencies, including transitive ones you never chose and would never think to look at.
- Code-level flaws — injection, path traversal, unsafe deserialisation — found by analysis rather than by matching text.
- Fix guidance, which the agent can act on directly: it reads the finding and edits the code.
Which does what
| Built in | Snyk | |
|---|---|---|
| Setup | None | Account, laptop, Node |
| Runs | On every write | When you ask |
| Cost | Nothing | Free tier, with limits |
| Finds | Secrets and unsafe patterns in what was just written | Known CVEs, dependency and container issues, deeper code analysis |
They overlap very little. One catches the key as it is typed; the other catches the vulnerable package three levels down your dependency tree that you would never think to look at.
Other scanners
Nothing here is specific to Snyk. Any security tool that ships an MCP server connects the same way, and several do. Snyk is simply the one with the broadest language coverage and a usable free tier, so it is the one worth documenting.