docs: add snyk remote mcp

[RaduPetreTarean]

Adds the Snyk Remote MCP into the user docs

---

Note

Low Risk
Changes are documentation-only and do not alter product code, authentication, or data handling.

Overview
Adds Snyk Remote MCP to the developer-tools docs: a new integration section with a main guide and a tools reference, linked from the integrations table of contents.

The integrations overview no longer states that Snyk lacks a hosted MCP server. It now contrasts Snyk Studio’s local MCP (CLI, local scans) with Snyk Remote MCP (hosted, read-only queries over existing Snyk data). The glossary adds a Snyk Remote MCP definition and fixes dependency bullet formatting.

^{Reviewed by Cursor Bugbot for commit b14ca80. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[mihaisau-snyk]

Style guide fixes: "log in" not "sign in," avoid the modal "may," and "visit" not "see" when linking to a page (3 instances). Suggestions inline.

[mihaisau-snyk]

Suggested change

	| `snyk_get_issue_counts` | Aggregates all matching Organization issue instances by severity, type, status, and Project. A positive `limit` bounds analysis; `project_limit` controls the size of the Project breakdown. |
	| `snyk_get_issue_counts` | Aggregates all matching Organization issue instances by severity, type, status, and Project. A positive `limit` bounds analysis. `project_limit` controls the size of the Project breakdown. |

[mihaisau-snyk]

Suggested change

	For `snyk_get_issue_counts`, `limit` defaults to 0 and analyzes all matching pages. A positive value bounds the analysis; when that bound is reached, `truncated` is true and a warning identifies the counts as incomplete.
	For `snyk_get_issue_counts`, `limit` defaults to 0 and analyzes all matching pages. A positive value bounds the analysis. When that bound is reached, `truncated` is true and a warning identifies the counts as incomplete.

[mihaisau-snyk]

Suggested change

The `project_limit` argument defaults to 10 for issue counts, security posture reports, and remediation backlog reports. It controls only the size of the `by_project` breakdown; set it to 0 to return every matching Project entry. Responses include `by_project_total` and `by_project_truncated` so clients can identify a bounded breakdown. For remediation backlogs, `action_group_limit` defaults to 20 and controls the number of returned remediation action groups; set it to 0 to return all action groups.

The `project_limit` argument defaults to 10 for issue counts, security posture reports, and remediation backlog reports. It controls only the size of the `by_project` breakdown. Set it to 0 to return every matching Project entry. Responses include `by_project_total` and `by_project_truncated` so clients can identify a bounded breakdown. For remediation backlogs, `action_group_limit` defaults to 20 and controls the number of returned remediation action groups. Set it to 0 to return all action groups.

[mihaisau-snyk]

Suggested change

The `snyk_get_remediation_handoff` tool requires an Organization name, slug, or UUID and an issue UUID. It returns the primary issue identity and a fallback identity based on the Project, rule, source or manifest path, and affected package. Repository, branch, and source details are included only when Snyk Project, target, or issue data contains them. If the Project has a `prodsec-commit-hash` tag, the value is returned as `handoff.project.commit_hash`; otherwise, `commit_reference` is identified as missing in `handoff.context`.

The `snyk_get_remediation_handoff` tool requires an Organization name, slug, or UUID and an issue UUID. It returns the primary issue identity and a fallback identity based on the Project, rule, source or manifest path, and affected package. Repository, branch, and source details are included only when Snyk Project, target, or issue data contains them. If the Project has a `prodsec-commit-hash` tag, the value is returned as `handoff.project.commit_hash`. Otherwise, `commit_reference` is identified as missing in `handoff.context`.

[mihaisau-snyk]

Suggested change

	The `snyk_review_project_sbom` tool accepts an Organization and Project by name or UUID. Use `project_type`, `project_origin`, and `target_file` to disambiguate duplicate Project names. The `format` argument supports CycloneDX 1.4, 1.5, or 1.6 JSON and SPDX 2.3 JSON; the default is `cyclonedx1.4+json`. Its evidence controls are:
	The `snyk_review_project_sbom` tool accepts an Organization and Project by name or UUID. Use `project_type`, `project_origin`, and `target_file` to disambiguate duplicate Project names. The `format` argument supports CycloneDX 1.4, 1.5, or 1.6 JSON and SPDX 2.3 JSON. The default is `cyclonedx1.4+json`. Its evidence controls are:

[mihaisau-snyk]

Suggested change

Snyk Remote MCP provides audit logs, cloud issue filters, container inventory, and risk reports as separate evidence. It does not expose a unified attack-path or runtime graph and does not infer deployment causality or blast radius. If an MCP client correlates external SIEM or ticketing data, conclusions must preserve source attribution and distinguish external evidence from Snyk observations.

Snyk Remote MCP provides audit logs, cloud issue filters, container inventory, and risk reports as separate evidence. It does not expose a unified attack-path or runtime graph and does not infer deployment causality or blast radius. If an MCP client correlates external SIEM (security information and event management) or ticketing data, conclusions must preserve source attribution and distinguish external evidence from Snyk observations.