VibeRPGSimulator

Snyk MCP server and hooks that scan agent code, dependencies, containers and IaC, and rescan after each fix.

How it works

Foe: Breach Spider, a security hole an attacker could use.

Foes

  • Breach Spider

Party · Context

  • RogueYour agent100/100

  1. Breach Spider

    The Breach Spider blocks the way.

    What really happensIt stands for a security hole an attacker could use.

    Rogue: Context 100/100.

  2. Exploit

    The spider strikes through a gap nobody guarded. Its bite lingers.

    What really happensAn attacker gets in through a hole nobody checked, and the harm spreads until it is patched.

    Rogue takes 11. Rogue: Context 89/100. Rogue: Poison.

  3. Snyk Studio

    A Snyk ward is set into the agent's workshop.

    What really happensThe installer script adds Snyk Studio hooks to your agent. You sign in to Snyk and trust the project folder once.

    Breach Spider takes 18.

  4. Snyk Studio

    Fresh code is checked before the work is called done.

    What really happensThe agent runs snyk_code_scan (SAST) on new first-party code and snyk_sca_scan on its dependencies.

    Breach Spider takes 15.

  5. Exploit

    The Breach Spider uses Exploit.

    Rogue takes 11. Rogue: Context 78/100.

  6. Snyk Studio

    Each hole found is patched, then checked again.

    What really happensIf Snyk finds new issues, the agent fixes them with Snyk's results and rescans until no new issues remain.

    Breach Spider takes 36.

  7. Snyk Studio

    Containers and castle plans pass inspection too.

    What really happensThe full profile also scans container images, IaC files such as Terraform and Kubernetes, and SBOMs.

    Breach Spider takes 31. Breach Spider falls.

  8. Victory

    The Breach Spider falls.

Learn this spell

Claude Code and Codex

curl -fsSL 'https://raw.githubusercontent.com/snyk/studio-recipes/main/installer/dist/snyk-studio-install.sh' -o snyk-studio-install.sh
bash ./snyk-studio-install.sh

Notes

Needs a Snyk account. The hooks installer supports Claude Code, Codex CLI, Cursor, Gemini CLI and Copilot, and asks before installing uv, Python, Node and the Snyk CLI. Older rules-based setup for Claude Code: npx -y snyk@latest mcp configure --tool=claude-cli. Tools include snyk_code_scan, snyk_sca_scan, snyk_iac_scan and snyk_container_scan. The server runs locally through the Snyk CLI; Snyk has no hosted one. Installer repo snyk/studio-recipes is Apache-2.0; GitHub reports no SPDX license for snyk/cli.

This spell has no recorded sessions in the curator's logs. Tried it? Send a spell report.