> For the complete documentation index, see [llms.txt](https://docs.snyk.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.snyk.io/agent-security/agentic-security-with-snyk-studio/quickstart-guides/devin-guide.md).

# Connect Devin to Snyk

How to set up Snyk Studio and the Snyk MCP server in Devin

Connect Devin to the Snyk MCP server to scan code and dependencies from a Devin cloud session. The MCP server runs in the Devin session environment, not on your workstation.

{% hint style="info" %}
This setup provides MCP access. It does not install Studio Secure at inception hooks. Rules instruct the agent when to scan and depend on the model following those instructions.

For clients supported by the Studio CLI installer, use [Getting started with Snyk Studio](/agent-security/agentic-security-with-snyk-studio/getting-started-with-snyk-studio.md). For enterprise deployment, use the [Agentic Development Security (ADS) installer](/agent-security/evo-by-snyk/agentic-development-security-ads/activation-and-deployment.md).
{% endhint %}

## Prerequisites

* Get Started with Devin

Navigate to [Devin.ai](https://devin.ai/) to get started using the AI software engineer.

## Install the Snyk MCP server in Devin

Install the Snyk MCP server by navigating to **Settings** > **Organization settings** > **MCP marketplace** > **Add your own**.

The command to run the Snyk MCP server is `npx -y snyk@latest mcp -t stdio`. Add this command to your Devin configuration in the **STDIO Configuration** section, as shown in the following example.

<figure><img src="https://2912686697-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FN5N885PkllOWeBmgm3Bp%2Fuploads%2FAD9L2Gc4kkrqIX5MLc1Q%2F2025-11-05_11-22-43.png?alt=media&amp;token=c61916be-ea66-4b88-b3e3-ca78215b9640" alt="Snyk MCP server command added to the Devin configuration"><figcaption></figcaption></figure>

Select **Add a new secret** and add your API token. To learn more, visit [How to obtain your personal token](https://docs.snyk.io/developer-tools/snyk-api/authentication-for-api#how-to-obtain-your-personal-access-token). You must use `SNYK_TOKEN` for the **Secret Name** and **Environment Variable** name.

{% hint style="warning" %}
Devin stores the token in the **Secret** and references it with `$SNYK_TOKEN`. Do not put your full Snyk token in the **Environment Variables** section.
{% endhint %}

<figure><img src="https://2912686697-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FN5N885PkllOWeBmgm3Bp%2Fuploads%2FO7aCLCjmewCl9JXlCFep%2F2025-11-05_11-17-43.png?alt=media&amp;token=2173e60e-a2e1-4087-b150-6681b902d654" alt="Snyk token stored as a Devin secret and referenced by name"><figcaption></figcaption></figure>

Finally, you can optionally add the `--disable-trust` argument to the command, as shown in the following example.

<figure><img src="https://2912686697-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FN5N885PkllOWeBmgm3Bp%2Fuploads%2Fvr9MmxBgsLHVFsx8qhhR%2F2025-11-05_11-24-48.png?alt=media&amp;token=d34da493-182e-4974-8f82-85118bb92ca9" alt="Optional disable-trust argument added to the MCP server command"><figcaption></figcaption></figure>

The Snyk MCP server includes a folder trust mechanism that helps safeguard users from executing Snyk on untrusted code. To learn more, visit [Visual Studio workspace trust](https://docs.snyk.io/developer-tools/integrations/snyk-ide-plugins-and-extensions/visual-studio-extension/visual-studio-workspace-trust). Without this option, the Snyk MCP server opens a browser window to request trust for the repository directory. Devin handles the request through its built-in browser. Add `--disable-trust` only if you want to skip the folder-trust workflow.

## Secure at inception rules

Add rules to [Devin Knowledge](https://docs.devin.ai/product-guides/knowledge) to guide the assistant when it invokes Snyk scans. Rules do not guarantee that the model runs a scan. For the generic rule text, visit [Rules for manual MCP integrations](/agent-security/agentic-security-with-snyk-studio/directives.md#rules-for-manual-mcp-integrations).

Add the generic rule text to Devin Knowledge.

<figure><img src="https://2912686697-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FN5N885PkllOWeBmgm3Bp%2Fuploads%2Ff4zUVYq6Z0VJgmlXpIsM%2Fimage%20(390).png?alt=media&amp;token=02f77692-e131-42a1-b442-36906d140a35" alt="Snyk rules added to the Devin configuration"><figcaption></figcaption></figure>

## Examples

In the chat, you can tag specific files or functions and ask Devin to scan your code before deployment:

{% code title="prompt" overflow="wrap" %}

```
Scan this directory for code security & dependency vulnerabilities security issues
```

{% endcode %}

Check the tool calls to confirm that Devin invoked the requested Snyk MCP scans.

Devin combines the code and dependency scan results with Snyk recommendations to suggest fixes for some or all of the findings.

<figure><img src="https://2912686697-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FN5N885PkllOWeBmgm3Bp%2Fuploads%2FohepRUbQpehVJYvQrRAI%2Fimage.png?alt=media&amp;token=84b3593d-80ef-4143-bab2-397508f3b555" alt="Devin reporting combined code and dependency scan results"><figcaption></figcaption></figure>

<figure><img src="https://2912686697-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FN5N885PkllOWeBmgm3Bp%2Fuploads%2Ftecm0rwzK1LyPjr5X9fm%2Fimage%20(388).png?alt=media&amp;token=31f6b3ed-08a2-4d86-b83c-a9603b5c5a7b" alt="Devin applying a recommended fix from the scan results"><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.snyk.io/agent-security/agentic-security-with-snyk-studio/quickstart-guides/devin-guide.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.