Integration

Snyk API & Web (Probely) integration

Snyk API & Web (formerly Probely) is a dynamic application security testing (DAST) scanner for web applications and APIs. Register targets, start, pause, resume or cancel scans and schedule recurring ones, read and triage the vulnerability findings (state, severity, assignee, labels), retest fixes, generate and download PDF or DOCX reports, verify domain ownership, manage target and finding labels, extra hosts and webhooks, and read Asset Discovery results and scan credits. User, role and API-user administration, billing and credit purchases, third-party integration settings, stored scan credentials, target login and 2FA configuration, scanning agents, account-wide CSV exports (the coverage CSV of one scan is kept) and dashboard charts are not exposed. Authentication is an API key from the Snyk API & Web app, sent in the Authorization header with the JWT prefix.

Connect Snyk API & Web (Probely)How integrations work

Ask it in chat

Say what should happen.
The workflow builds itself.

When this happens, do that in Snyk API & Web (Probely).Built from the 89 Snyk API & Web (Probely) tools below, on the connection you add once.

What you can do with Snyk API & Web (Probely)

Each of these is one operation on one endpoint, available both as a workflow step and as a tool an AI agent can call on its own. Nothing bundles several operations into one action, so what a run did stays readable afterwards.

Most endpoints run on the free plan. A few, mainly the ones that publish on your behalf, need a paid plan.

Finding, 11 operations

create_finding_labelCreate finding labelPOSTCreates a label for tagging findings.
delete_finding_labelDelete finding labelDELETEDeletes a finding label; findings keep existing without it.
get_findingGet findingGETReturns one finding by its compound id (target id and finding number): definition, severity, state, URL, evidence, how to fix it, assignee and labels.
get_finding_labelGet finding labelGETReturns one finding label with its name and color.
get_target_findingGet target findingGETReturns one finding of a target: vulnerability definition, severity, state, affected URL and parameter, evidence (request and response pairs), how to fix it, assignee and labels.
list_finding_labelsList finding labelsGETLists the labels used to tag findings, with name and color.
list_findingsList findingsGETLists vulnerability findings across all targets with definition, severity, state, target, URL and labels. Filter by severity, state, target, label, team, new or dates; paginate with page and length.
list_target_findingsList target findingsGETLists the vulnerability findings of one target with definition, severity, state, URL, assignee and labels. Filter by severity, state, label, scan, new or dates; paginate with page and length.
update_findingUpdate findingPATCHChanges one finding, addressed by its compound id: state (notfixed, invalid, accepted, fixed), severity, assignee, labels or comment.
update_finding_labelUpdate finding labelPATCHRenames a finding label or changes its color.
update_target_findingUpdate target findingPATCHChanges one finding of a target: state (notfixed, invalid, accepted, fixed), severity, assignee, labels or comment. Marking it invalid or accepted takes a change_reason.

Target, 10 operations

create_targetCreate targetPOSTRegisters a target to scan: a web application (type single, default) or an API (type api). site needs at least a url, usually with a name. The URL is checked for reachability unless skip_reachability_check is true.
create_target_labelCreate target labelPOSTCreates a label for tagging targets.
delete_targetDelete targetDELETEDeletes a target from the account.
delete_target_labelDelete target labelDELETEDeletes a target label; targets keep existing without it.
get_targetGet targetGETReturns one target with its site settings (name, URL, authentication flags), open findings per severity, risk, last, running and next scan, scan profile, labels and teams.
get_target_labelGet target labelGETReturns one target label with its name and color.
list_target_labelsList target labelsGETLists the labels used to tag targets, with name and color.
list_targetsList targetsGETLists targets (web apps and APIs registered for scanning) with URL, open findings per severity, risk, last, running and next scan, scan profile and labels. Filter by label, team or risk; paginate with page and length.
update_targetUpdate targetPATCHChanges some settings of a target (site name, URL, description, scan profile, labels, report type and format, partial-scan options); fields left out stay as they are.
update_target_labelUpdate target labelPATCHRenames a target label or changes its color.

Webhook, 10 operations

create_target_webhookCreate target webhookPOSTCreates a webhook that receives the events of one target (such as scan started or completed) as POST requests to the given URL.
create_webhookCreate webhookPOSTCreates an account-wide webhook that receives the events of every target (such as scan started or completed) as POST requests to the given URL.
delete_target_webhookDelete target webhookDELETEDeletes a webhook of a target; it stops receiving events.
delete_webhookDelete webhookDELETEDeletes an account webhook; it stops receiving events.
get_target_webhookGet target webhookGETReturns one webhook of a target: name, URL, certificate check and API version.
get_webhookGet webhookGETReturns one account webhook: name, URL, certificate check and API version.
list_target_webhooksList target webhooksGETLists the webhooks of one target: name, URL and whether the HTTPS certificate is checked. They receive the target's events (scan started, finished, and so on).
list_webhooksList webhooksGETLists the account-wide webhooks, which receive the events of every target: name, URL and certificate check.
update_target_webhookUpdate target webhookPATCHChanges the name, URL or certificate check of a target webhook.
update_webhookUpdate webhookPATCHChanges the name, URL or certificate check of an account webhook.

Scheduledscan, 6 operations

create_scheduled_scanCreate scheduled scanPOSTSchedules scans of a target: the first at date_time, then repeated hourly, daily, weekly, monthly or quarterly (recurrence h, d, w, m or q), in the given timezone (UTC by default).
delete_scheduled_scanDelete scheduled scanDELETEDeletes a scheduled scan of a target; no further scans start from that schedule.
get_scheduled_scanGet scheduled scanGETReturns one scheduled scan of a target: next date and time, recurrence, timezone and scan options.
list_scheduled_scansList scheduled scansGETLists the scheduled scans of every target in the account, with target, next date and time, recurrence and timezone.
list_target_scheduled_scansList target scheduled scansGETLists the scheduled scans of one target with their next date and time, recurrence (hourly, daily, weekly, monthly, quarterly) and timezone.
update_scheduled_scanUpdate scheduled scanPATCHChanges a scheduled scan of a target (date and time, recurrence, timezone, partial-scan options); fields left out stay as they are.

Asset, 5 operations

create_extra_hostCreate extra hostPOSTAdds an extra host to a target so its scans can include it (include true, default) or explicitly leave it out of scope (include false).
delete_extra_hostDelete extra hostDELETERemoves an extra host from a target.
get_discovered_assetGet discovered assetGETReturns one asset found by Asset Discovery: name, URL, type, state, sources, technologies, risk, security-headers score, first and last seen dates and the target created from it, if any.
list_discovered_assetsList discovered assetsGETLists the web apps and APIs found by Asset Discovery, with URL, type, state (new, active and so on), sources, technologies, risk, security-headers score and linked target. Paginate with page and length.
list_extra_hostsList extra hostsGETLists the extra hosts of a target: additional hosts that its scans can include or keep out of scope, each with its name, host and whether it is included.

Domain, 5 operations

create_domainCreate domainPOSTRegisters a domain (or IP address) whose ownership can then be verified with verify_domain, so it can be scanned and used by Asset Discovery.
delete_domainDelete domainDELETERemoves a domain from the account.
get_domainGet domainGETReturns one domain with its verification status, method, token and last verification error.
list_domainsList domainsGETLists the domains registered in the account with their verification status, verification method and token, and whether Asset Discovery may use them.
update_domainUpdate domainPATCHChanges a domain's hostname, port or basic-auth credentials; fields left out stay as they are.

Scan, 5 operations

get_account_scanGet account scanGETReturns one scan by its id, whatever its target: status, times, duration, findings per severity, technologies found and scanner progress.
get_current_scanGet current scanGETReturns the current scan of a target: status, start and completion times, findings per severity, and crawler, fingerprinter and scanner progress.
get_scanGet scanGETReturns one scan of a target: status, start and completion times, duration, findings per severity, technologies found and crawler, fingerprinter and scanner progress.
list_scansList scansGETLists the scans of every target in the account, with target, status, start and completion times and findings per severity. Filter by status, target, label or date; paginate with page and length.
list_target_scansList target scansGETLists the scans of one target with status, start and completion times and findings per severity. Filter by status or date; paginate with page and length.

Event, 4 operations

get_eventGet eventGETReturns one account event with its event type, date and content.
get_target_eventGet target eventGETReturns one event of a target with its event type, date and content.
list_eventsList eventsGETLists the events of the whole account (such as user or target created, scan started, canceled or completed) with event type, date and content (the user, target, scan or finding concerned).
list_target_eventsList target eventsGETLists the events of one target (such as target created, scan started, canceled or completed) with event type, date and content (the target, scan or finding concerned).

Cancel, 3 operations

cancel_current_scanCancel current scanPOSTCancels the scan currently running on a target and returns that scan with its new status.
cancel_scanCancel scanPOSTCancels one scan of a target and returns it with its new status.
cancel_scansCancel scansPOSTCancels several scans at once and returns them with their new status. scans is a list of objects with the scan id.

Report, 3 operations

download_scan_reportDownload scan reportGETDownloads the report of one scan as a file (PDF or DOCX, as set on the target), optionally choosing the report type (standard, executive summary, OWASP, PCI DSS and more).
generate_reportGenerate reportPOSTRequests a findings report (PDF or DOCX) across targets, filtered by target, severity, state, label or team. Returns a report request id: poll get_report_status, then download_report.
list_reportsList reportsGETLists the findings reports requested by the user, with type, format, submission and generation dates.

Retest, 3 operations

retest_findingRetest findingPOSTStarts a scan that retests one finding of a target, to check whether it is fixed, and returns that scan.
retest_findingsRetest findingsPOSTStarts retest scans for several findings across targets at once, given their compound ids.
retest_target_findingsRetest target findingsPOSTStarts retest scans for several findings of one target at once, given their numbers in ids.

Definition, 2 operations

get_vulnerability_definitionGet vulnerability definitionGETReturns one vulnerability definition: name, description, default severity, CVSS vector, CWE id and name, and whether it is found passively.
list_vulnerability_definitionsList vulnerability definitionsGETLists the vulnerability definitions the scanner can report, with name, description, default severity, CVSS vector and CWE. Search by name; paginate with page and length.

Framework, 2 operations

get_frameworkGet frameworkGETReturns one technology the scanner can detect, with its name and description.
list_frameworksList frameworksGETLists the technologies (frameworks, languages, servers) the scanner can detect on targets, such as PHP, WordPress or Apache.

Pause, 2 operations

pause_current_scanPause current scanPOSTPauses the scan currently running on a target; resume it later with resume_current_scan.
pause_scanPause scanPOSTPauses one running scan of a target; resume it later with resume_scan.

Resume, 2 operations

resume_current_scanResume current scanPOSTResumes the paused scan of a target and returns that scan with its new status.
resume_scanResume scanPOSTResumes one paused scan of a target and returns it with its new status.

Scan profile, 2 operations

get_scan_profileGet scan profileGETReturns one scan profile with its description and settings.
list_scan_profilesList scan profilesGETLists the scan profiles available to the account, built-in and custom (custom ids start with sp-), with name, description, speed, payload level and limits such as max_urls and max_run_time.

Team, 2 operations

get_teamGet teamGETReturns one team with its name and settings.
list_teamsList teamsGETLists the teams of the account, which group targets and users.

Create target, 1 operation

create_target_from_assetCreate target from assetPOSTCreates a target from an asset found by Asset Discovery and, with is_create_and_scan true, starts its first scan right away.

Credit, 1 operation

get_creditsGet creditsGETReturns the account's scan credits: promotional and purchased credits available, credits on hold for running scans, and outstanding (owed) credits.

Download, 1 operation

download_reportDownload reportGETDownloads a generated findings report as a file (PDF or DOCX). Call it once get_report_status shows generated_at.

Endpoint, 1 operation

export_scan_coverageExport scan coverageGETReturns the coverage report of one scan: the endpoints the scan crawled and tested, as CSV text.

Log, 1 operation

list_finding_activityList finding activityGETLists the activity log of one finding: state, severity and assignee changes, comments and retests, with who made them and when.

Profile, 1 operation

get_profileGet profileGETReturns the profile behind the API key: user id, name, email, whether it is an API user, and its roles with their permissions (for example start_scan, change_finding).

Scan now, 1 operation

start_scanStart scanPOSTStarts a scan of the target now, with its own scan profile or the one given, and returns the new scan (id, status, started). Scans of targets without unlimited scans consume credits.

Start, 1 operation

start_scansStart scansPOSTStarts scans on several targets at once and returns the new scans. targets is a list of objects with the target id; overrides can set a scan profile for all of them.

Stat, 1 operation

get_discovery_statsGet discovery statsGETReturns Asset Discovery statistics: assets discovered, assets still new, and the share of assets added as targets and scanned or found high risk.

Status, 1 operation

get_report_statusGet report statusGETReturns a report request with its submission date and generated_at, which is empty while the report is still being generated (HTTP 202) and set once it is ready.

Type, 1 operation

list_report_typesList report typesGETLists the report types that can be generated (standard, executive summary, OWASP Top 10, PCI DSS, ISO 27001 and others) with their descriptions.

Verify, 1 operation

verify_domainVerify domainPOSTChecks ownership of a domain with the chosen method (type): file (a text file at the site root), dns_txt or dns (a DNS TXT record), dns_cname (a DNS CNAME record) or meta_tag (a meta tag on the index page).

Use Snyk API & Web (Probely) from Claude Code, Cursor or Codex

Connect Snyk API & Web (Probely) in LiveContext, create an API key in Settings, then add the LiveContext MCP server to your client. Its Snyk API & Web (Probely) operations become tools the client can call, next to every other integration you connected.

Claude Code

claude mcp add --transport http livecontext https://livecontext.ai/mcp --header "X-API-Key: YOUR_API_KEY"

Codex (~/.codex/config.toml)

[mcp_servers.livecontext]
url = "https://livecontext.ai/mcp"

[mcp_servers.livecontext.http_headers]
"X-API-Key" = "YOUR_API_KEY"

Cursor, Claude Desktop and other JSON configs

{
  "mcpServers": {
    "livecontext": {
      "type": "http",
      "url": "https://livecontext.ai/mcp",
      "headers": {
        "X-API-Key": "YOUR_API_KEY"
      }
    }
  }
}

Set up the MCP server step by step

How to connect Snyk API & Web (Probely)

Create your workspace
Sign up free. Nothing to install.
Connect Snyk API & Web (Probely) once
Add your Snyk API & Web (Probely) connection in Settings. Every tool from this integration reuses it, and secrets are encrypted at rest and visible only to you.
Describe the job in chat
The workflow builds itself in front of you and picks the endpoints it needs. Drag the steps yourself on the canvas whenever you would rather be explicit.