Remediation Agents, Demystified: Why Fixing Beats Finding

What it is

Snyk's Remediation Agent (public preview) — an orchestration layer between your own LLM and Snyk's vulnerability intelligence that auto-generates mergeable SCA and SAST fixes. The existing summary covers the architecture, the intelligence layers, the demo, and the 94%/13% mergeable-fix numbers. What follows is the getting-started detail the summary omits.

Preconditions / Affected

• A Snyk account, plus either the CLI or a supported agentic development environment.
• Bring-your-own-LLM is the default for open preview — you supply your own model API key.
• Supported IDE/ADE surfaces: Cursor, Windsurf, Antigravity, or VS Code with a Claude plugin. (The summary lists only Cursor, Windsurf, and VS Code; Antigravity and the Claude-plugin requirement for VS Code are additional.)
• Cost: free to all current Snyk customers, in exchange for feedback. Open-source maintainers get the full enterprise license free via Snyk's Secure Developer Program.

What to do

IDE path — install two pieces, both via one curl command from Snyk's recipes repo:

• the /snyk-fix skill
• the Snyk Studio MCP server

CLI path is more participatory. Run:

snyk fix --agentic --experimental --sca

It lists each upgradeable package with its current version, Snyk's recommended target (chosen because it clears the most criticals/highs), and a breakability score. You can then:

• Fix everything
• Fix only the low-breakability items
• Select specific findings
• Talk to the agent (ask why a given upgrade is rated high-risk; it returns the release-note reasoning and the transitive vulns the upgrade resolves)

After changes, Snyk re-runs scans to confirm the issue is gone and executes the project's unit tests to confirm the build still works. Every path terminates at a pull request — the developer keeps final sign-off.

Caveats

• Breakability reasoning is derived from analysis of release notes and breaking changes across the ecosystem; design partners report few false positives, mostly on the SAST side, filtered through Snyk Code's existing engines.
• The 13% SAST improvement is far smaller than the 94% SCA figure — the intelligence advantage is concentrated on dependency upgrades.
• An autonomous "human on the loop" variant (Snyk spins up a sandbox, pulls code, returns a finished PR) is still in active development, not shipping in this preview.