docs: add snyk remote mcp

[RaduPetreTarean]

Adds the Snyk Remote MCP into the user docs

---

Note

Low Risk
Documentation-only changes with no application code, auth, or data-handling logic modified.

Overview
This PR adds user-facing documentation for Snyk Remote MCP, a hosted read-only MCP server for querying existing Snyk data from AI assistants without the CLI or local source access.

New pages under developer-tools/integrations/snyk-remote-mcp/ cover what it is, how it differs from the local Snyk Studio MCP, regional endpoints, OAuth/PKCE authorization and read scopes, Cursor and Claude Code setup, pagination/views, troubleshooting, and investigation boundaries. A companion tools reference catalogs all 28 read-only tools, reporting/remediation workflows (including Studio handoff and verification), SBOM/dependency tooling, rate limits, and response/error semantics.

Navigation and cross-links are updated: developer-tools/SUMMARY.md lists the new section; integrate-with-snyk.md replaces the prior note that Snyk does not offer a hosted MCP with a Snyk Remote MCP section and guidance on when to use Remote MCP vs Snyk Studio; the glossary gains a Snyk Remote MCP entry.

^{Reviewed by Cursor Bugbot for commit 602adeb. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[mihaisau-snyk]

Style guide fixes: "log in" not "sign in," avoid the modal "may," and "visit" not "see" when linking to a page (3 instances). Suggestions inline.

[mihaisau-snyk]

Suggested change

	| `snyk_get_issue_counts` | Aggregates all matching Organization issue instances by severity, type, status, and Project. A positive `limit` bounds analysis; `project_limit` controls the size of the Project breakdown. |
	| `snyk_get_issue_counts` | Aggregates all matching Organization issue instances by severity, type, status, and Project. A positive `limit` bounds analysis. `project_limit` controls the size of the Project breakdown. |

[mihaisau-snyk]

Suggested change

	For `snyk_get_issue_counts`, `limit` defaults to 0 and analyzes all matching pages. A positive value bounds the analysis; when that bound is reached, `truncated` is true and a warning identifies the counts as incomplete.
	For `snyk_get_issue_counts`, `limit` defaults to 0 and analyzes all matching pages. A positive value bounds the analysis. When that bound is reached, `truncated` is true and a warning identifies the counts as incomplete.

[mihaisau-snyk]

Suggested change

The `project_limit` argument defaults to 10 for issue counts, security posture reports, and remediation backlog reports. It controls only the size of the `by_project` breakdown; set it to 0 to return every matching Project entry. Responses include `by_project_total` and `by_project_truncated` so clients can identify a bounded breakdown. For remediation backlogs, `action_group_limit` defaults to 20 and controls the number of returned remediation action groups; set it to 0 to return all action groups.

The `project_limit` argument defaults to 10 for issue counts, security posture reports, and remediation backlog reports. It controls only the size of the `by_project` breakdown. Set it to 0 to return every matching Project entry. Responses include `by_project_total` and `by_project_truncated` so clients can identify a bounded breakdown. For remediation backlogs, `action_group_limit` defaults to 20 and controls the number of returned remediation action groups. Set it to 0 to return all action groups.

[mihaisau-snyk]

Suggested change

The `snyk_get_remediation_handoff` tool requires an Organization name, slug, or UUID and an issue UUID. It returns the primary issue identity and a fallback identity based on the Project, rule, source or manifest path, and affected package. Repository, branch, and source details are included only when Snyk Project, target, or issue data contains them. If the Project has a `prodsec-commit-hash` tag, the value is returned as `handoff.project.commit_hash`; otherwise, `commit_reference` is identified as missing in `handoff.context`.

The `snyk_get_remediation_handoff` tool requires an Organization name, slug, or UUID and an issue UUID. It returns the primary issue identity and a fallback identity based on the Project, rule, source or manifest path, and affected package. Repository, branch, and source details are included only when Snyk Project, target, or issue data contains them. If the Project has a `prodsec-commit-hash` tag, the value is returned as `handoff.project.commit_hash`. Otherwise, `commit_reference` is identified as missing in `handoff.context`.

[mihaisau-snyk]

Suggested change

	The `snyk_review_project_sbom` tool accepts an Organization and Project by name or UUID. Use `project_type`, `project_origin`, and `target_file` to disambiguate duplicate Project names. The `format` argument supports CycloneDX 1.4, 1.5, or 1.6 JSON and SPDX 2.3 JSON; the default is `cyclonedx1.4+json`. Its evidence controls are:
	The `snyk_review_project_sbom` tool accepts an Organization and Project by name or UUID. Use `project_type`, `project_origin`, and `target_file` to disambiguate duplicate Project names. The `format` argument supports CycloneDX 1.4, 1.5, or 1.6 JSON and SPDX 2.3 JSON. The default is `cyclonedx1.4+json`. Its evidence controls are:

[mihaisau-snyk]

Suggested change

Snyk Remote MCP provides audit logs, cloud issue filters, container inventory, and risk reports as separate evidence. It does not expose a unified attack-path or runtime graph and does not infer deployment causality or blast radius. If an MCP client correlates external SIEM or ticketing data, conclusions must preserve source attribution and distinguish external evidence from Snyk observations.

Snyk Remote MCP provides audit logs, cloud issue filters, container inventory, and risk reports as separate evidence. It does not expose a unified attack-path or runtime graph and does not infer deployment causality or blast radius. If an MCP client correlates external SIEM (security information and event management) or ticketing data, conclusions must preserve source attribution and distinguish external evidence from Snyk observations.