The Syndu MCP server turns the published report graph, the contextual-risk model, and the operator knowledge layer into a tool surface for Codex and other MCP clients. It is designed for SOC triage, analyst copilots, detection drafting, and shared outcomes.
The server is not a separate data stack. It builds directly on the same IP, subnet, ISP, ASN, organization, city, region, and country truth that already powers the report shells and the contextual risk API.
The launch toolset supports indicator resolution, report snapshots, contextual-risk explanation, related-entity discovery, detection drafting, knowledge lookup, and knowledge submission.
Syndu MCP stores outcomes, annotations, and playbook fragments as authenticated workspace knowledge. Agents can read from that memory and contribute back to it, so knowledge does not disappear with one chat session.
MCP usage is a third product track with its own daily call ladder. It is meant for SOC teams, AI workflow owners, and partner operations that want a reusable cyber knowledge layer instead of isolated one-off lookups.
The MCP service uses the same merchant subscription control plane as Syndu's direct web and API products. The dashboard records the chosen MCP tier, Syndu creates the matching PayPal subscription request, and the approval link is sent by email. The MCP quota does not turn active until PayPal confirms the subscription lifecycle back to Syndu.
The server is mounted directly inside the Syndu ASGI application and speaks MCP over streamable HTTP.
Initial tools expose the report graph and the knowledge layer without inventing a new evidence model.
Analyst findings, triage outcomes, detection stubs, and playbook notes become searchable workspace memory for later agent runs.
{
"tool": "explain_entity_risk",
"arguments": {
"kind": "org",
"key": "google llc"
}
}{
"tool": "submit_annotation_outcome",
"arguments": {
"kind": "ipaddress",
"key": "8.8.8.8",
"title": "Observed scanning pattern",
"summary": "Escalate when subnet peers align.",
"contribution_type": "triage_note",
"visibility": "workspace"
}
}This is the public documentation hub for Syndu's three delivery modes: direct report access, the contextual risk API, and the Syndu MCP server for agentic SOC workflows and shared cyber knowledge.
Syndu exposes a dimensional risk surface across network entities and geography: ip address, subnet, ISP, ASN, organization, city, region, and country. That same dimensional graph is also the basis for the planned risk API.
Syndu reports are external context pages for monitoring, hygiene review, and decision support. They complement SoC and SIEM processes rather than replace them.
The product supports two delivery modes: direct report access for large-scale browser or agent consumption, and the planned risk API for customers that want application-native scoring calls.
Syndu is a two-mode product: direct access for report-shell consumption and API access for application-side scoring. Both sit under the same account, quota, and subscription control plane, but they differ in delivery contract.
The `score` endpoint accepts an IP address and returns the full contextual-risk scoring object that Syndu already renders in the homepage and report headers. It is authenticated with account-owned API keys and metered against the API subscription service, not the direct web quota service.
Registration unlocks the quota dashboard, plan selection, and the subscription flow while keeping report delivery quota-based.
This is a custom alert message.
Are you sure you want to proceed?