Synapse documentation¶
Verify Everything. Trust Nothing.
Synapse is a governed control plane for supply-chain, code, cloud, offensive, and runtime security assessments. These guides cover the first scan, production operations, governance, integrations, and the architectural boundaries that keep execution auditable.
Landing page · GitHub · License
Get started¶
| Guide | What it covers |
|---|---|
| Introduction | The product model, safety principles, and assessment flow |
| Installation | Supported platforms, requirements, tools, and install paths |
| Quickstart | Run the dashboard and complete a first supported scan |
| Features | Shipped capabilities and honest platform limits |
Assessment workflows¶
| Guide | What it covers |
|---|---|
| Project code quality | Projects, analyses, issues, hotspots, profiles, gates, and source views |
| Governed assessments | Engagement scope, evidence, imported artifacts, threat models, work orders, purple coverage, and write-ups |
| Vulnerability intelligence | Sources, synchronization, reconciliation, risk changes, rollout, and recovery |
| Cloud posture | Read-only AWS, Azure, and Google Cloud inventory, checks, and credential boundaries |
| Fleet and runtime defense | Agent identity, inventory, detections, coverage, work, rollout, and decommissioning |
| AI triage review | Propose/verify/review flow, evidence requirements, independence, and promotion |
| Remediation SLA governance | Risk scoring, immutable deadlines, lifecycle transitions, and reassessment |
Operate and integrate¶
| Guide | What it covers |
|---|---|
| Configuration | Environment variables, defaults, dependencies, and production requirements |
| Deployment | Containers, services, agents, Linux-only capabilities, and production checks |
| CLI | Scanning, code-quality gates, advisory maintenance, imports, and exit contracts |
| MCP integration | Read/propose-only tool access scoped to one engagement |
| Fleet agent packaging | Package, identity, rollout, upgrade, and uninstall contracts |
| AI triage evaluation | Offline datasets, comparison gates, promotion, rollback, and drift detection |
| Code quality rule authoring | Clean-room rule packs, schemas, references, and golden coverage |
Architecture and policy¶
| Guide | What it covers |
|---|---|
| Architecture | Clean-architecture layers, runtime topology, ports, and binaries |
| Security model | The safety invariants and their enforcement boundaries |
| Telemetry store ADR | Why fleet telemetry is isolated behind a dedicated store port |
| CSPM helper ADR | Why cloud SDKs and credentials live in an authorized sandbox helper |
| Promotion rules | Deterministic cross-pillar priority proposals and uncertainty handling |
| Offensive policy | Enforced technique classifications, approval, cleanup, and kill switch |
Quick links¶
- Full local stack:
docker compose -f deploy/docker-compose.full.yml up --build - Native development:
SYNAPSE_API_TOKEN="$(openssl rand -hex 32)" make dev - CI scan:
./bin/synapse-cli scan . --fail-on high - Only required development setting:
SYNAPSE_API_TOKEN
Authorized use¶
Synapse is for authorized security testing. Every engagement enforces an explicit scope and legal authorization window server-side before execution. Synapse validates those controls but cannot verify that an operator holds legal permission. Keep written authorization for every target.