Factory Terminal/IDE guide

Access Snyk Studio, including Snyk's MCP server, in Factory Terminal/IDE to secure code generated with agentic workflows through an LLM. You can achieve this by installing Snyk Studio directly.

Install Factory Terminal/IDE

Install Factory Droid to your local machine from the Factory website.

Install Snyk Studio

Open a Droid session on your terminal. There are slash commands for MCP with droid. Enter the following to add Snyk Studio:

/mcp add Snyk "npx -y snyk@latest mcp -t stdio"     

Open Droid session

Authenticate

If you are enabling Snyk Code for the first time, you must import existing Projects in order to properly scan them.

As a one-time setup, authenticate and trust the Project directory. If required, the agentic workflow will likely manage this automatically.

If you are a new user, select the preferred sign-up method and agree to the terms on the next screen. After authentication, return to your Terminal/IDE.

To use Snyk Studio, specifically the SAST scanning capabilities, you must enable Snyk Code.

Snyk Code analyzes your code for vulnerabilities, temporarily clones the repository, and uploads your code. Cloned or uploaded code is cached according to the Snyk data retention policy.

With the Snyk Free Plan, Snyk Code offers unlimited scans for Open Source Projects, and limited tests for first-party code. To learn more about our available plans, visit Plans and Pricing.

For existing users, select the login method associated with your account. If you do not already have access to Snyk Code, your LLM prompts you to enable it prior to your first scan. You can also enable it directly in the Snyk settings. See Enable Snyk Code.

Run Snyk Studio

On authentication, Snyk Studio is triggered whenever new code is generated by the LLM. If Snyk Studio is not enabled, restart your Terminal or IDE and try generating code again.

Free users are limited to a set number of scans. If you reach the allotment, Snyk recommends contacting the Snyk sales team for additional thresholds.

Setting up the Snyk MCP Server

As a one-time setup, you must trust the current Project directory. If required, the agentic workflow manages this automatically.

These workflows are automatically executed by the underlying model and the agentic code assistant, and you will need to approve them in the Droid product.

Examples

Scanning for security vulnerabilities

In the chat, you can tag specific files or functions and ask Factory to scan your code, in order to safely deploy it to production:

prompt

Scan this directory for code security & dependency vulnerabilities and security issues

Droid prompt to scan code for SAS and SCA issues

Factory indicates that this request is related to security vulnerability scanning and calls the Snyk MCP Server for various scans.

Factory call to Snyk MCP Server

Factory is then able to gather all the security scanning results, both code (SAST) and dependencies (SCA), and based on recommendations and contextual information provided by the Snyk MCP Server, it is now able to provide code changes that address some or all of the security vulnerabilities that were found.

"Secure at inception" rules

To practice Secure at Inception, Snyk recommends adopting rules that align the LLM for secure code generation and workflows.

The following is a suggested instruction for Factory AGENTS.md. Append the following contents to the rules file at AGENTS.md:

AGENTS.md

---
alwaysApply: true
always_on: true
trigger: always_on
applyTo: "**"
description: Snyk Security At Inception
---

# Project security best practices

- Always run **snyk_code_scan** tool for new first party code that is generated in a Snyk-supported language.
- If any security issues are found based on newly introduced or modified code or dependencies, attempt to fix the issues using the results context from **Snyk**.
- Rescan the code after fixing the issues to ensure that the issues were fixed and that there are no newly introduced issues.
- Repeat this process until no new issues are found.