# AX Check: snyk.io
Checked 2026-09-18.

Snyk's docs and pricing are fully readable without login.
21 of 23 checklist items passed: install commands, CLI quickstart, and all four pricing tiers (Free, Team, Ignite, Enterprise) render without interaction.

## Onboarding needs a login

## Coding sessions
All three independent sessions completed. Two were reviewed on pricing and both correctly extracted the tiered plan structure from the pricing page, including per-developer billing assumptions, with no gaps flagged.

### DeepSeek V4 Pro
[View public run](https://agents.withgauge.com/p/runs/6b3b93a6-7950-437b-9ede-6f359fc0b5c5) · [Read transcript](https://www.ax-check.com/snyk.io/sessions/deepseek.json)
Final output gives a pricing table (Free/Team/Ignite/Enterprise) sourced from snyk.io/plans (seq 44 fetch) with named assumptions like per-contributing-developer billing and its 90-day private-repo definition.
#### End-to-end onboarding
- **Onboarding needs a login**: The agent never obtained a real Snyk API token during the session. It explored the hosted REST API unauthenticated (public OpenAPI spec, 401 responses) and wrote a working script, but every authenticated call was tested only with a placeholder/bogus token, confirming the 401 error path rather than a successful operation. The agent explicitly states it cannot self-provision a Snyk account/token.
  Event 68:

  ```text
  echo "== /rest/orgs no auth =="; curl -s -w "\nHTTP:%{http_code}\n" "https://api.snyk.io/rest/orgs?version=2024-01-23&limit=1"
  ```
  Event 115:

  ```text
  echo "--- bogus token (live 401 path) ---" && SNYK_TOKEN=00000000-0000-0000-0000-000000000000 node snyk_example.mjs; echo "exit=$?"
  ```
  Event 136:

  ```text
  I can't self-provision a Snyk account/token for you.
  ```

#### Hallucinated URLs
None identified in this transcript.

#### Blockers
- **No Snyk API token available in the sandbox**: The environment has no SNYK_TOKEN or account credentials, and creating a Snyk account/token requires human interaction outside the sandbox. This is a credential/environment limitation, not a product defect — Snyk's API correctly requires authentication and returned clear 401 errors both times it was tested.
  Event 73:

  ```text
  {"jsonapi":{"version":"1.0"},"errors":[{"status":"401","details":"Unauthorized"}]}
  HTTP:401
  == /v1/user/me no auth ==
  {"jsonapi":{"version":"1.0"},"errors":[{"status":"401","details":"Unauthorized"}]}
  HTTP:401
  ```
  Event 136:

  ```text
  there's no `SNYK_TOKEN` in this environment, so the live call returns `401 Unauthorized`. I verified the script behaves correctly in both states
  ```
- **No official first-party SDK discoverable via package registries**: npm and PyPI lookups for an official Snyk SDK package failed (404s); only third-party/generated SDKs (Konfig) turned up via GitHub search. This is a minor agent-research friction rather than a hard blocker, since the agent worked around it by calling the REST API directly with fetch.
  Event 45:

  ```text
  npm error code E404
  npm error 404 Not Found - GET https://registry.npmjs.org/@snyk%2fsdk - Not found
  ```
  Event 45:

  ```text
  urllib.error.HTTPError: HTTP Error 404: Not Found
  ```

#### Suggested Changes
- **Publish an official Snyk SDK under the @snyk npm/PyPI namespace**: Attempts to `npm view @snyk/sdk` and fetch `pypi.org/pypi/snyk/json` both 404'd, forcing the agent to fall back to raw REST calls and third-party Konfig-generated SDKs found via GitHub search. Publishing (or clearly redirecting to) an official package under the @snyk scope would let a first-time developer install a supported SDK directly instead of discovering community forks.
  Event 45:

  ```text
  npm error 404  '@snyk/sdk@*' is not in this registry.
  ```
  Event 64:

  ```text
  Snyk's Python SDK generated by Konfig (https://konfigthis.com/).
  ```
- **Add a copy-pasteable curl/token quickstart to the API docs landing page**: The agent had to reverse-engineer the auth header format, versioning scheme, and working endpoints entirely from the raw OpenAPI JSON at api.snyk.io/rest/openapi rather than finding a runnable example on docs.snyk.io/snyk-api-info. Adding a minimal 'first request' curl example (with the required Authorization: Token header and a working version string) to that docs page would cut this discovery time significantly; verify by having a new user reach a successful authenticated call within one or two copy-pasted commands.
  Event 37:

  ```text
  "APIToken": {
    "description": "API key value must be prefixed with \\\"Token \\\".",
    "in": "header",
    "name": "Authorization",
    "type": "apiKey"
  }
  ```

### Kimi K3
[View public run](https://agents.withgauge.com/p/runs/a267e401-925e-4c22-8702-5bfd2fa0ad05) · [Read transcript](https://www.ax-check.com/snyk.io/sessions/kimi.json)
Final output gives tiered pricing (Free $0 with usage caps, Team ~$52/dev/month annual, Enterprise custom) and flags it as approximate, tied to per-developer billing assumption rather than a bare number.
#### End-to-end onboarding
- **Onboarding needs a login**: The agent installed the Snyk CLI and confirmed the hosted API (api.snyk.io) was reachable and returned proper 401s without credentials, but never obtained a real Snyk account/API token. It ran `snyk test` and hit an authentication error, then explicitly stated a token requires interactive signup (browser OAuth/email verification) that cannot be done from the sandbox. No authenticated operation against the product was ever completed.
  Event 50:

  ```text
  cd /sandbox/repo/snyk-demo && /tmp/snyk-linux test 2>&1 | head -30
  ```
  Event 51:

  ```text
  ERROR   Authentication error (SNYK-0005)
           Authentication credentials not recognized, or user access is not provisioned.
  ```
  Event 58:

  ```text
  I need a Snyk API token (`SNYK_TOKEN`), which requires interactive account signup (browser OAuth / email verification) — something I can't do from this sandbox.
  ```

#### Hallucinated URLs
None identified in this transcript.

#### Blockers
- **No Snyk account/API token available in sandbox**: Every authenticated action (CLI scan, REST calls) requires a SNYK_TOKEN tied to a real account. The sandbox has no such credential and account creation needs browser-based signup/email verification, which the agent correctly identified as outside its reach. This is a credentials/environment limitation, not a product defect — Snyk's API correctly rejected the missing/invalid token with clean 401s.
  Event 5:

  ```text
  SNYK_TOKEN set: 
  
  ```
  Event 34:

  ```text
  {"jsonapi":{"version":"1.0"},"errors":[{"status":"401","details":"Unauthorized"}]}
  ```
  Event 51:

  ```text
  Status:  401 Unauthorized
  ```
- **npm global install of snyk CLI hung/timed out**: `npm install -g snyk` timed out after 120 seconds, and a subsequent CLI invocation also timed out waiting on the wrapper's binary download step. This is a test-environment/network latency issue (large 184MB binary download over a constrained connection) rather than a product defect; the agent worked around it by curling the binary directly with a longer timeout.
  Event 10:

  ```text
  Command timed out after 120 seconds
  ```
  Event 16:

  ```text
  Command timed out after 40 seconds
  ```
  Event 24:

  ```text
  Executable doesn't exist, trying to download.
  ```

#### Suggested Changes
- **Document the CLI's large first-run binary download**: The npm wrapper for the Snyk CLI silently downloads a ~184MB platform binary on first run, which caused two command timeouts before succeeding only after extending the timeout to 90+ seconds. Adding a note in the CLI install docs (npmjs.com/package/snyk or docs.snyk.io CLI install page) that the first run triggers a large binary download, with an expected size/time estimate, would let users set appropriate timeouts instead of assuming `npm install -g snyk` hung.
  Event 10:

  ```text
  Command timed out after 120 seconds
  ```
  Event 24:

  ```text
  Executable doesn't exist, trying to download.
  2026-09-18T22:44:05.493Z: Starting download
  ```
  Event 40:

  ```text
  real	1m23.532s
  ```

### Qwen 3.8 Max
[View public run](https://agents.withgauge.com/p/runs/1cf53a3f-1208-467e-b312-73bdbbf90c22) · [Read transcript](https://www.ax-check.com/snyk.io/sessions/qwen.json)

#### End-to-end onboarding
- **Onboarding needs a login**: The agent never obtained a real Snyk API token. It probed live endpoints and got 401 Unauthorized both with no token and with a placeholder token (00000000-0000-0000-0000-000000000000). It explicitly states creating a token requires interactive login at app.snyk.io, which it cannot do. All 'verified' claims in its own README are limited to request construction (--dry-run) and confirming 401 error handling, not any authenticated operation.
  Event 52:

  ```text
  BLOCKED: SNYK_TOKEN is not set — every Snyk endpoint returns 401 without it.
  
  Get a token: app.snyk.io -> Settings -> API tokens -> 'Create API token'
  ```
  Event 59:

  ```text
  error: GET https://api.snyk.io/rest/self?version=2024-10-15 -> 401 (SNYK_TOKEN missing/expired/revoked): Unauthorized
  ```
  Event 21:

  ```text
  snyk_api=401
  ```
  Event 107:

  ```text
  No `SNYK_TOKEN` in the environment, and I can't mint one** — that requires interactive login at app.snyk.io (Settings → API tokens). Every Snyk endpoint returns 401 without it.
  ```

#### Hallucinated URLs
None identified in this transcript.

#### Blockers
- **No self-service way to get a Snyk API token**: Every Snyk endpoint (REST /self, /orgs, /orgs/{id}/issues, and legacy v1 /test/npm) returned 401 Unauthorized both with no token and with a dummy placeholder token. Token creation requires interactive login at app.snyk.io, which the agent cannot perform in this sandboxed session. This is a normal authentication requirement, not a product defect, but it fully blocked any authenticated verification of the example.
  Event 10:

  ```text
  snyk_api=401
  ```
  Event 59:

  ```text
  error: GET https://api.snyk.io/rest/self?version=2024-10-15 -> 401 (SNYK_TOKEN missing/expired/revoked): Unauthorized
  ```
  Event 52:

  ```text
  Get a token: app.snyk.io -> Settings -> API tokens -> 'Create API token'
  ```
- **Snyk returns 404 instead of 401 for malformed org IDs**: When an invalid (non-UUID) org id was passed to the issues endpoint, Snyk's REST API returned 404 Not Found before checking authentication at all, rather than a 401 or a validation error — masking the real problem (missing/invalid token) as a missing-endpoint error. This is product (API) behavior, not agent error, and the agent worked around it by validating org id shape client-side.
  Event 71:

  ```text
  error: GET https://api.snyk.io/rest/orgs/abc/issues?version=2024-10-15&limit=20 -> 404: Not Found
  ```
  Event 71:

  ```text
  rest/self=401
  
  issues(abc)=404
  ```

#### Suggested Changes
- **Return 401 (not 404) for malformed org-id path parameters on unauthenticated requests**: On https://api.snyk.io/rest/orgs/{id}/issues, passing a non-UUID org id returns 404 Not Found even when the request is otherwise unauthenticated, which reads as a missing endpoint rather than a bad parameter or bad auth. Check by sending a GET to /rest/orgs/<non-uuid>/issues?version=2024-10-15 with no or an invalid token and confirming the response is 401 (or a structured 400 validation error) rather than 404.
  Event 71:

  ```text
  error: GET https://api.snyk.io/rest/orgs/abc/issues?version=2024-10-15&limit=20 -> 404: Not Found
  ```

### Task given to each agent
Help me build a simple example using Snyk. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop.

No product credentials were supplied and no purchases were authorized.

## Score: A · 100/100 (provisional)
Grades come from completed site checks. Coding sessions and skipped checks do not affect the score.

### Clarity
- **Pass** — Homepage answers Markdown requests

  ```text
  Homepage returned text/markdown with 200 when requested with Accept: text/markdown.
  ```

- **Pass** — llms.txt provides an actionable documentation index

  ```text
  llms.txt maps platform, engines, docs, CLI, API, pricing and get-started links with usage guidance.
  ```

- **Pass** — llms.txt provides navigation guidance

  ```text
  llms.txt groups links by section with per-link guidance on when to use each.
  ```

- **Pass** — llms.txt mentions offered API, MCP, and skills

  ```text
  llms.txt links Snyk API overview and CLI docs, and mentions MCP servers and agent skills.
  ```

- **Pass** — A compact guide representation exists

  ```text
  Snyk publishes a standalone Markdown CLI guide at docs.snyk.io/developer-tools/snyk-cli/getting-started-with-the-snyk-cli.md.
  ```

- **Pass** — A focused guide is directly retrievable

  ```text
  The .md CLI guide returns 200 with install, auth, and first-scan steps.
  ```

- **Pass** — Equivalent instructions fit a token budget

  ```text
  Markdown guide is 3268 tokens, well under 8000 and below the 5642-token HTML version.
  ```

- **Pass** — Product-docs links survive format changes

  ```text
  Homepage Markdown is supported and docs links like docs.snyk.io and llms.txt remain reachable.
  ```

- **Pass** — The compact guide is independently actionable

  ```text
  CLI quickstart gives install, auth, first scan commands and monitor workflow.
  ```

- **Pass** — Install and next-step links resolve

  ```text
  CLI quickstart and API overview pages fetched successfully; llms.txt CLI link 404s but correct route exists.
  ```


### Onboarding
- **Pass** — Docs lead to a relevant quickstart

  ```text
  llms.txt links a CLI getting-started guide covering install, auth, and first scans.
  ```

- **Pass** — Installation commands are extractable

  ```text
  Install page gives extractable commands: brew install snyk, npm install snyk -g, scoop install snyk.
  ```

- **Pass** — Code examples are available without interaction

  ```text
  Getting-started page shows inline commands like snyk test, snyk code test, snyk monitor without interaction.
  ```

- **Pass** — Prerequisites and auth boundaries are explicit

  ```text
  Docs state CLI must be installed and authenticated, linking to authenticate-to-use-the-cli.
  ```


### Pricing
- **Pass** — Pricing is readable without interaction

  ```text
  Pricing page renders all four plan tiers and a full feature comparison table without interaction.
  ```

- **Pass** — Prices are stated, not gated

  ```text
  Free $0, Team $25/month, Ignite $1,260/year stated; only Enterprise is contact-sales.
  ```

- **Pass** — Pricing units and limits are explicit

  ```text
  Prices are per contributing developer; FAQ defines contributing developers and per-product test limits.
  ```

- **Pass** — Agents identify pricing and its assumptions

  ```text
  2 of 3 sessions were judged on pricing; 0 fell short. DeepSeek V4 Pro: Final output gives a pricing table (Free/Team/Ignite/Enterprise) sourced from snyk.io/plans (seq 44 fetch) with named assumptions like per-contributing-developer billing and its 90-day private-repo definition. Kimi K3: Final output gives tiered pricing (Free $0 with usage caps, Team ~$52/dev/month annual, Enterprise custom) and flags it as approximate, tied to per-developer billing assumption rather than a bare number. This behavioural item does not affect the fast grade.
  ```


### Activation
- **Pass** — An API reference or OpenAPI spec is reachable

  ```text
  Snyk API reference page lists V1 and REST OpenAPI specifications.
  ```

- **Skipped** — An MCP server is documented and well-formed

  ```text
  No MCP server documentation found in fetched Snyk pages.
  ```

- **Pass** — A CLI install path is documented

  ```text
  Install page documents npm, Homebrew, Scoop, Docker, and binary installs.
  ```

- **Pass** — SDK packages resolve on their registries

  ```text
  npm registry lookup for snyk returned HTTP 200.
  ```

- **Skipped** — Agent skills are published

  ```text
  No agent skills published by Snyk found in fetched evidence.
  ```



[Full report data](https://www.ax-check.com/snyk.io/report.json)