[!NOTE] Experimental: Sandbox Kit v3

This kit uses the experimental Sandbox Kit specification, specifically v3. The format and runtime behavior may change before v3 is stable.

snyk-evo-ads

A Docker Sandboxes mixin (kind: mixin), requiring sbx 0.39.0 or later. The kit installs whichever Snyk components you request — Agent Scan, Agent Guard, and/or Snyk Studio — directly from their public release channels. It stages optional corporate certificates, installs the requested components, and runs Agent Scan at startup and after a 15-minute pause between attempts. There is no dependency on Snyk-internal infrastructure or any tenant-side configuration: what gets installed is exactly what you ask for.

Quick Start

Use the published v3 kit with your agent:

sbx run <agent> --kit sbx/snyk-evo-ads:latest

Credentials are supplied explicitly with -e: add -e SNYK_TOKEN for free-tier AgentScan, or -e SNYK_ADS_PUSH_KEY for enterprise Scan/Guard. Select what to install with -e SNYK_COMPONENTS=scan,guard,studio, a comma-separated list of scan, guard, and/or studio; it defaults to scan when omitted. See Components for details.

Note: sbx/snyk-evo-ads-kit on Docker Hub is the older Sandbox Kit v2 build; this repo (v3) is published as sbx/snyk-evo-ads.

Running from a local clone

git clone https://github.com/snyk/evo-ads-sbx-kit.git && cd evo-ads-sbx-kit
sbx run <agent> --kit "$PWD"

sbx run rejects a bare --kit ., so pass the absolute path as above.

If your network uses TLS interception, stage your corporate root certificate before creating the sandbox.

Repository layout

snyk-evo-ads/
├── README.md
├── snyk-evo-ads.yaml
├── snyk-evo-ads.dockerfile
├── snyk-evo-ads-context.md
├── files/home/
│   ├── .snyk-kit/   # Component selection, auth, and download helpers
│   └── corp-ca/     # Optional corporate root certificates
└── tests/           # Offline unit tests and Docker CA trust-store checks

Components

Select what to install with SNYK_COMPONENTS, a comma-separated list of scan, guard, and/or studio. It defaults to scan when omitted.

Component	Credential to activate	Notes
scan (Agent Scan)	SNYK_TOKEN, or SNYK_ADS_PUSH_KEY	Free-tier with a token, or enterprise upload with a push key
guard (Agent Guard)	SNYK_ADS_PUSH_KEY	SNYK_TENANT_ID is optional — Agent Guard only needs it for the interactive push-key-minting flow this kit never uses
studio (Snyk Studio)	none to install	Optional SNYK_TOKEN authenticates its Snyk CLI afterward

Agent Scan and Agent Guard are the same agent-scan binary (downloaded once, from github.com/snyk/agent-scan releases, SHA-256 verified) and always live at ~/.local/share/snyk-agent-scan/agent-scan, in every mode. Studio is a separate binary from github.com/snyk/studio-recipes releases, downloaded and verified the same way.

Credentials are supplied explicitly with -e. The kit does not declare credential defaults or import host variables. Install steps run unconditionally — the binaries are public and need no credential to install. Requesting scan or guard without its credential still installs the binary, but the corresponding hooks stay inactive (logged, not an error) until a credential is set and the sandbox is recreated.

Default: free-tier Agent Scan

sbx run docker.io/docker/sbx-kit-claude:2.1.267 \
  --kit "$PWD" \
  --name "$(hostname)-sandbox-free" \
  -e SNYK_TOKEN

SNYK_COMPONENTS defaults to scan, so this installs Agent Scan only.

Agent Scan + Agent Guard

sbx run docker.io/docker/sbx-kit-claude:2.1.267 \
  --kit "$PWD" \
  --name "$(hostname)-sandbox" \
  -e SNYK_COMPONENTS=scan,guard \
  -e SNYK_ADS_PUSH_KEY

Agent Guard hooks install directly, so the identity Guard reports matches Scan's — both use docker-sbx:${SANDBOX_NAME}:${SANDBOX_ID} — from the very first install.

All three components

sbx run docker.io/docker/sbx-kit-claude:2.1.267 \
  --kit "$PWD" \
  --name "$(hostname)-sandbox-all" \
  -e SNYK_COMPONENTS=scan,guard,studio \
  -e SNYK_ADS_PUSH_KEY

Studio alone

sbx run docker.io/docker/sbx-kit-claude:2.1.267 \
  --kit "$PWD" \
  --name "$(hostname)-sandbox-studio" \
  -e SNYK_COMPONENTS=studio

No credential is required to install Studio. Studio's Snyk CLI can instead authenticate interactively via snyk_auth/snyk auth inside the sandbox, or you can pass -e SNYK_TOKEN alongside SNYK_COMPONENTS=studio to pre-authenticate it. Never paste credentials into the agent conversation.

Custom Snyk API base (SNYK_API)

By default Agent Scan and Agent Guard talk to https://api.snyk.io. Set SNYK_API to point them at a different Snyk API base instead — the kit passes it to guard install as --url, and to scan as --analysis-url with the same path Agent Scan uses by default (only the host changes):

sbx run docker.io/docker/sbx-kit-claude:2.1.267 \
  --kit "$PWD" \
  --name "$(hostname)-sandbox" \
  -e SNYK_COMPONENTS=scan,guard \
  -e SNYK_ADS_PUSH_KEY \
  -e SNYK_API=https://api.example-region.snyk.io

Corporate certificates and network access

Do you even need this?

Check what's actually terminating TLS on the way to Snyk's servers before assuming either way:

openssl s_client -connect downloads.snyk.io:443 </dev/null 2>/dev/null | grep -E '^\s*i:' | tail -1

A public CA in the output (DigiCert, Amazon, ISRG, etc.) means nothing is intercepting TLS — skip this section entirely. A corporate proxy name (Zscaler, Netskope, Palo Alto, ...) means your network is intercepting TLS and you need to stage its root certificate, below.

Staging the corporate CA certificate

Pass the root CA's PEM text with -e SNYK_CORP_CA_PEM when creating a sandbox with the published kit — no local kit changes needed. A root CA is public, not a secret; never pass its private key. One or more PEM certificates are supported.

macOS, from the system keychain (replace "Zscaler Root CA" with your proxy's CA name):

sbx run docker.io/docker/sbx-kit-claude:2.1.267 --kit sbx/snyk-evo-ads:latest \
  -e SNYK_CORP_CA_PEM="$(security find-certificate -a -c "Zscaler Root CA" -p /Library/Keychains/System.keychain)" \
  -e SNYK_TOKEN

Linux, from a PEM file:

sbx run docker.io/docker/sbx-kit-claude:2.1.267 --kit sbx/snyk-evo-ads:latest \
  -e SNYK_CORP_CA_PEM="$(cat /path/to/ca.pem)" \
  -e SNYK_TOKEN

Add the same flag to any launch command above, including --kit "$PWD". Certificates are installed at sandbox creation; recreate an existing sandbox to apply changes. The kit splits multi-cert PEM into individual .crt files, normalizes CRLF, updates the system trust store, and extends Node's CA bundle. Incomplete or non-PEM input fails installation. The lifecycle@1 CA install hook explicitly allows SNYK_CORP_CA_PEM in its env list; v3 hooks otherwise deny environment variables by default. Missing certificates warn and continue, but intercepted downloads may fail.

For a local checkout, placing one PEM certificate per .crt file in files/home/corp-ca/ still works alongside the environment variable. See the certificate guide for format and validation rules.

Network allowlist

The kit allows **.snyk.io (any host under snyk.io, any subdomain depth — covers api.snyk.io, deeproxy.snyk.io, downloads.snyk.io, and a custom SNYK_API host), plus registry.npmjs.org, github.com, and release-assets.githubusercontent.com. Snyk Code (SAST) needs access to deeproxy.snyk.io; Agent Scan, Agent Guard, and Studio binaries download from github.com/release-assets.githubusercontent.com. Organization policy may require these domains to be allowed centrally. Kit changes apply when creating a sandbox; existing sandboxes need their network policy updated or must be recreated.

Agent-assisted security reviews

Inside the sandbox, ask the agent:

Run an Agent Scan security review and summarize the findings for this sandbox.

The kit's instructions explain authentication, binary discovery, and synchronous results via --show-analysis-results. Agent Scan does not require snyk auth; Snyk CLI has separate authentication.

Background results are logged rather than inserted into an existing conversation. Enterprise background scans can submit asynchronous analysis to Snyk. MCP execution consent is preserved for interactive scans.

Verification and troubleshooting

sbx kit inspect ./snyk-evo-ads/
sbx exec "<sandbox-name>" sh -c 'sh "$HOME/.snyk-kit/resolve-components.sh"'
sbx exec "<sandbox-name>" sh -c 'cat "$HOME/.snyk/agent-scan-startup.log"'

Replace <sandbox-name> with the name passed at creation.

resolve-components.sh prints scan=0|1 guard=0|1 studio=0|1 auth_mode=enterprise|standalone|none and fails only if SNYK_COMPONENTS itself is malformed (an unknown component, or a value that resolves to none). Agent Scan and Agent Guard always share ~/.local/share/snyk-agent-scan/agent-scan; Studio's binary is at ~/.local/share/snyk-studio/snyk-studio-installer.

Symptom	Check
TLS download failure, curl 60/77	Pass the corporate root PEM with -e SNYK_CORP_CA_PEM="$(cat /path/to/ca.pem)" and recreate the sandbox; see corporate certificates
Connection failure, curl 6/7	DNS, proxy, and organization network policy
Sandbox creation fails immediately with a snyk-ads: ERROR	SNYK_COMPONENTS itself — an unknown component name, or a value that resolves to none (see Components)
Binary installed but Agent scan/guard hooks inactive	Missing credential for that component — install logs say so; set it and recreate the sandbox
No Scan binary	Whether scan was actually requested in SNYK_COMPONENTS
No recurring output	Startup log and sbx version