Snyk
Connect Snyk to Clearly AI to import vulnerability and code-security findings as project sources, and scan repositories from workflows.
Overview
The Snyk integration imports Snyk project findings as Clearly AI project sources. Clearly AI renders those findings as review and chat context.
The integration supports:
- Personal access token or service account token authentication.
- Regional Snyk API base URLs (for example
https://api.snyk.io,https://api.eu.snyk.io,https://api.au.snyk.io). - Listing Snyk organizations and projects available to the token.
- Fetching a findings snapshot for a Snyk project with severity, status, and issue-type filters.
- Scan Project With Snyk workflow steps that import supported code repositories already on a Clearly AI project into Snyk and attach the resulting Snyk projects as sources.
Clearly AI reads findings from Snyk. It does not resolve or ignore issues back in Snyk.
Connect Snyk
- In Clearly AI, open Integrations and select Snyk.
- In Personal Key, paste a Snyk personal access token or service account token.
- In Snyk API base URL, enter the REST API host for your Snyk region if it is not the default
https://api.snyk.io. - Save the configuration and click Test.
A successful test confirms the token can list at least one Snyk organization at the configured API host.
Use a dedicated Snyk service account when multiple people share the integration. The token needs read access to the organizations and projects you want to import.
Add Snyk findings to a project
- Open Projects and select the project you want to review.
- Open Manage Sources and select Search Integrations.
- Choose Snyk.
- Select a Snyk organization and Snyk project.
- Configure snapshot filters such as minimum severity, whether to exclude ignored issues, open issues only, issue types, and the maximum number of issues included in the snapshot.
- Save the source and wait for processing to finish.
The imported source is a markdown snapshot of matching Snyk issues at save time. Regenerate the source or add a new one when you need fresher findings.
Scan repositories from a workflow
The Scan Project With Snyk workflow step scans supported code repositories already attached to a Clearly AI project:
- GitHub, GitLab, Bitbucket, and Azure Repos repositories and branches on the project.
- Imports each repository into a chosen Snyk organization (Snyk creates one project per detected manifest).
- Waits for each import job to finish or time out, then adds the resulting Snyk projects back to the Clearly AI project as sources.
Configure:
- Project — the Clearly AI project whose repository sources should be scanned.
- Snyk organization — required when the token can see more than one org; otherwise Clearly AI auto-selects the only org.
- Manifest files (optional) — limit imports to specific paths (for example
package.jsonorservices/api/pom.xml). Leave empty to let Snyk auto-detect manifests. - Poll timeout (seconds) (optional) — how long to wait per repository import before treating it as timed out.
The matching source-control integration must already be configured in the target Snyk organization (for example GitHub connected inside Snyk). Clearly AI calls Snyk's import API; it does not replace Snyk's SCM setup.