Syndu exposes a dimensional risk surface across network entities and geography: ip address, subnet, ISP, ASN, organization, city, region, and country. That same dimensional graph powers the Risk API, MCP tools, and the memory loop that preserves the resulting decisions.
IP helps buyers judge single-actor behavior, account risk, bot activity, and transaction context. Subnet helps them judge campaign density, cohort behavior, and coordinated infrastructure patterns.
ASN, ISP, and organization views help teams see hosting concentration, provider footprint, cloud-abuse patterns, merchant or affiliate attribution, and the broader infrastructure story around one risky identifier.
Geographic layers give teams a territorial baseline for anomaly review: geo clustering, routing irregularities, jurisdiction context, and regional density that may matter for both cyber and fraud decisions.
The reports and API are driven by the latest computed truth rows for each matched key. Syndu does not invent on-request behavior; it projects the latest computed risk and activity baselines that already exist in the reporting graph, then lets the resulting decision be preserved in memory.
Syndu turns outside-in network behavior into shared cyber-and-fraud context, then preserves decisions in memory for humans, applications, and agents. This manual is the public map of that platform: the evidence graph, the Risk API, the MCP server, and the governance layer that ties them together.
Syndu is an external context layer for monitoring, hygiene review, agent workflows, and decision support. It complements SoC and SIEM processes rather than replacing them, while sharing the same evidence and memory model used elsewhere on the platform.
Syndu is also a decision surface for fraud, payments, merchant-risk, and trust workflows. The same outside-in evidence graph, Risk API, and governed memory loop help teams score, review, and preserve conclusions around risky identifiers.
The platform supports three access surfaces at scale: direct report access for large-scale browser or agent consumption, the Risk API for application-native scoring, and the MCP server for collaborative agent workflows.
Syndu is one platform with three access surfaces: direct access for report-shell consumption, API access for application-side scoring, and MCP access for agent collaboration. They sit under the same workspace, quota, and subscription control plane, but differ in delivery contract.
Score risky IPs in real time, report lightweight business feedback, and push structured identifier outcomes back into workspace memory from the same authenticated API surface. Syndu keeps the contract simple: `score` is the metered read path, while `rate` and `report` are authenticated writeback endpoints that do not consume score quota.
Registration unlocks the workspace control plane, plan selection, credential provisioning, and the subscription flow across web, API, and MCP access.
