docs/guides/cloud-agents/automated-security-remediation-with-snyk.mdx
Most teams don’t struggle to detect security vulnerabilities. They struggle to keep up with fixing them.
This guide shows how teams use cloud agents to automatically remediate high and critical Snyk vulnerabilities without introducing risk or losing control.
<Info> **Who this is for?** Full-stack teams without a dedicated AppSec or DevOps function who still need to ship securely. </Info>Snyk has an excellent "Automatic Fix" feature that opens PRs to upgrade vulnerable dependencies. However, because Snyk cannot run your application's build or test suite, these PRs often break the build and require human cleanup.
Continue's Cloud Agent sits on top of Snyk to complete the engineering work:
| Feature | Snyk Native Auto-PR | Continue Cloud Agent |
|---|---|---|
| The Fix | "Bump lodash to v4.17.21" | "Analyze security issue and create PR with fix" |
| Context | Vulnerability Database | Vuln DB + Security Impact Analysis |
| Intelligence | Deterministic (Always bumps version) | Reasoning: "Analyzes dependency risks" and suggests updates |
| Result | A PR that might break the build | A PR that is green and ready to merge |
A Snyk remediation cloud agent owns the handling of security issues, but not the final decision.
<CardGroup cols={2}> <Card title="Inputs"> - High & critical Snyk vulnerability events - Repository context - Dependency graph and version constraints </Card> <Card title="Outputs"> - Draft or ready PR with remediation - Clear summary of risk and fix </Card> </CardGroup> <Tip> The agent doesn’t silently change production code. It produces **reviewable security PRs**. </Tip>Continue's Snyk Cloud Agent is built from these core components:
<CardGroup cols={3}> <Card title="Triggers" icon="bolt"> **Webhook:** Snyk new vulnerability event </Card> <Card title="Tools (MCPs)" icon="toolbox"> **Snyk MCP:** Fetch vulnerability details </Card> <Card title="Rules" icon="list"> **GitHub CLI:** Tells the agent how to create PRs </Card> </CardGroup>A new Snyk vulnerability has been detected. Please investigate and resolve the issue. This should include the following steps:
**Step 1: Investigate the Issue**
Make sure you understand the vulnerability, the options for resolution, and what their consequences are.
**Step 2: Implement Fix**
- Focus on fixing the immediate issue identified
- Avoid overdoing it with error handling, cleaning up other problems, etc.
- Avoid making breaking changes
- Ensure the solution is robust and follows best practices.
**Step 3: Create Draft Pull Request**
Create a draft pull request with the following structure:
--
**PR Title:** [Snyk] <brief description of issue solved>
## Issue
**Snyk Link:** [<shortId>](<permalink>)
**Issue Type:** `<issue type>`
**Priority:** <priority>
**Summary:** <Two sentence summary of what caused the issue and how it was fixed>
- Agent runs automatically
- PRs require human approval
- CI must pass before merge
*This is where most teams should live.*
- Agent is triggered manually
- Used to validate behavior and build trust
- Narrow classes of fixes only
- Patch-level updates
- Strict constraints and rollback paths
This workflow is often a team’s first successful cloud agent because:
Once this is working, teams often expand into: