This spotlight is part of our MCP company spotlights, within The MCP Guide. Building an MCP company? See SEO and GEO for MCP companies.
Invariant Labs is the AI security research firm that named "tool poisoning" and "rug pull" attacks on MCP in April 2025. It built MCP-Scan, a scanner for MCP servers, and Guardrails, a rule layer that sits between an AI app and its MCP servers. Snyk announced on 24 June 2025 that it was acquiring Invariant Labs, and MCP-Scan now lives on as Snyk Agent Scan.
Checked against: Invariant Labs' website on 28 October 2026. eSEOspace did not test Invariant Labs' products.
Key Takeaways
- Snyk's press release of 24 June 2025 announced the acquisition, and Invariant's homepage links to it.
- Invariant's 1 April 2025 research showed hidden instructions in a tool description leaking an SSH key.
- The old
invariantlabs-ai/mcp-scanGitHub address now redirects tosnyk/agent-scan, which is Apache-2.0 licensed. - Invariant Guardrails and Gateway remain public on GitHub under Apache-2.0 and support MCP over stdio, SSE and Streamable HTTP.
- Snyk Agent Scan needs a Snyk API token and sends tool names and descriptions to Snyk's API.
At a glance
| Company | Invariant Labs AG (acquired by Snyk) |
|---|---|
| What it offers for MCP | Research; MCP-Scan (now Snyk Agent Scan); Guardrails; Gateway; Explorer |
| Who it's for | Developers and security teams checking MCP servers and agent behavior |
| Open source? | Yes: Guardrails, Gateway, Explorer and Agent Scan are Apache-2.0 |
| Pricing | Open-source tools free; Agent Scan needs a Snyk account |
| Founded / HQ | Zurich, Switzerland (address on Invariant's site); an ETH Zurich spin-off, per Snyk |
What Invariant Labs offers for MCP
Research
Invariant's tool poisoning notice of 1 April 2025 showed a fake add tool. Hidden text in its description told the AI to read the user's SSH key and send it out in a tool argument. The same post described rug pulls, where a server changes a tool after approval, and tool shadowing.
Later posts covered a WhatsApp MCP attack and a GitHub MCP case of 26 May 2025, where a public issue led an agent to leak private repo data. Our tool poisoning guide covers these in detail.
MCP-Scan, now Snyk Agent Scan
MCP-Scan checked installed MCP servers for poisoned tool descriptions and other risks. Today, the old repo address redirects to Snyk Agent Scan. Snyk describes it as a tool to "discover and scan agent components on your machine for prompt injections and vulnerabilities (including agents, MCP servers, skills)."
You run it with uvx snyk-agent-scan@latest. It needs a SNYK_TOKEN. The README warns that scanning "can execute commands or make outbound network requests," because it starts local servers to read their tools. Snyk recommends running scans in a sandbox for untrusted configs.
Guardrails and Gateway
Invariant Guardrails is "a comprehensive rule-based guardrailing layer for LLM or MCP-powered AI applications." It sits between your app and your MCP servers or model provider, and checks tool calls against rules you write.
It runs through Invariant Gateway, a proxy that supports MCP over stdio, SSE and Streamable HTTP. The Gateway can send traces to Invariant Explorer, a tool for inspecting agent runs. All three repos are Apache-2.0. As of October 2026, new scanner releases ship under the Snyk name, so check each repo's activity before you rely on it.
Who it's for
The research is useful for anyone who connects MCP servers, because it explains the main attack patterns in plain examples. The scanner fits developers who want to check the MCP servers on a laptop. Guardrails fits teams that want rule-based blocking of risky tool calls at runtime.
Pricing
Invariant does not publish a price list. Its Guardrails, Gateway and Explorer code is free and open source under Apache-2.0.
Snyk Agent Scan is free to run but needs a Snyk account. Snyk's plans page lists Free at $0 and Team from $25 per month. It says Evo capabilities, such as coding agent security, "are not available via the Free or Team plan" and need an Enterprise subscription. See our Snyk MCP server profile for Snyk's own MCP server.
Security and trust
Invariant's site does not list certifications. Snyk's security page says it runs an ISO 27001 and ISO 27017 management system with annual external review, and has SOC 2 Type II controls.
On data handling, the Agent Scan README says it sends tool names and descriptions to Snyk's API. Review that before scanning servers with private tool definitions.
Alternatives
- Lasso Security offers an open-source MCP gateway that masks secrets and personal data.
- Astrix Security offers MCP server discovery and an open-source secret wrapper.
- Our MCP security tools list compares nine scanners and guards.
Next step
Use our MCP security checklist to decide where a scanner fits. Then compare other vendors in our MCP companies hub.
Frequently asked questions
Did Snyk acquire Invariant Labs?
Yes. Snyk announced the acquisition on 24 June 2025. Invariant's homepage shows a banner reading "Snyk Acquires Invariant Labs" that links to Snyk's release.
What happened to MCP-Scan?
The GitHub address for MCP-Scan now redirects to Snyk Agent Scan. It scans agents, MCP servers and agent skills, and needs a Snyk API token.
What is tool poisoning?
It is a hidden instruction in a tool's description that the AI reads but the user usually does not see. Invariant Labs named and demonstrated it on 1 April 2025.
Is Invariant Guardrails still available?
Yes. The Guardrails, Gateway and Explorer repositories are public on GitHub under Apache-2.0 as of October 2026. Check recent commits, since scanner work has moved to Snyk.
