cloud1
cloud2
cloud3
cloud4
cloud5
cloud6
Shared risk memory
Syndu MCP | Shared Risk Memory For Agents
← Back to platform brief
Shared risk memory

Syndu MCP | Shared Risk Memory For Agents

Give Codex, Claude Code, Manus, and other MCP clients outside-in risk context plus memory that survives the chat. Syndu helps agents investigate risky identifiers, see when public analyst demand is converging on the same entity, decide what matters, and carry approved findings forward inside one governed workspace.

Set up Codex Set up Claude Code Set up Manus
Install by prompt

Copy this prompt into Codex to install the plugin and connect Syndu

Use the same prompt-led flow as the Codex plugin page. Codex should install the plugin, warn before the browser handoff opens, run the login step when needed, and then guide the user into the Syndu workspace Access Dashboard to provision workspace MCP quota and the optional shell key fallback.

Codex, visit https://syndu.com/pages/resources/codex-plugin/, install the Syndu plugin in this workspace, tell me before the browser handoff opens, run codex mcp login syndu when needed, then guide me through the Syndu workspace Access Dashboard so I can provision workspace MCP quota and create the MCP key for this shell if I want direct bearer-token fallback.
Copy this into Codex Expect a browser handoff Provision quota in the Access Dashboard Optional MCP key fallback
Primary use case
Investigate IPs, domains, and orgs

This is the clearest first workflow for security, fraud, and abuse teams who want a fast, evidence-backed answer on suspicious identifiers.

Explore use cases
Hosted endpoint
https://syndu.com/mcp/

Use Syndu as a hosted MCP service so your team installs once and gets to work, without running a local bridge or maintaining extra infrastructure.

Memory model
Workspace memory + hive collaboration

Keep approved findings available across analysts and agents, then promote share-safe outcomes into the hive when the workspace wants broader reuse.

Live analyst signal
10-minute community demand windows

Syndu listens to what the public report surface is being queried for right now, so MCP investigations can return not only the score and evidence graph, but also whether multiple analysts are converging on the same entity.

Start free
75 metered investigation calls / day

$0 / month to evaluate the workflow, connect your assistant, and run real investigations.

First paid tier
1,000 metered investigation calls / day

$99 / month for one active operator or one continuously useful agent loop.

One-Minute Investigation

Show the full value in one pass: a suspicious identifier, the investigation steps, and the saved outcome that stays available after the chat ends.

Live example

Investigate once, keep the answer

A strong investigation flow should show the question, the reasoning steps, and the reusable conclusion in one screen.

Analyst:
Investigate 91.245.110.0/24, explain why it looks risky, find the related organization, and store the conclusion.

Agent:
1. resolve_indicator(kind="subnet", key="91.245.110.0/24")
2. get_report_snapshot(kind="subnet", key="91.245.110.0/24")
3. explain_entity_risk(kind="subnet", key="91.245.110.0/24")
4. find_related_entities(kind="subnet", key="91.245.110.0/24")
5. store_outcome_event(...)

Result:
- outside-in subnet context resolved against the live evidence graph
- risk explanation tied to the subnet plus related org context
- reusable outcome written into workspace memory for the next run
Investigate Explain Remember
Reusable memory

A saved outcome your next agent can reuse

New workspaces start with stored outcomes and hive mind on, while sensitive identifiers still remain workspace-private when policy requires it. Memory lookup and contribution stay included outside the metered investigation budget.

{
  "tool": "store_outcome_event",
  "arguments": {
    "kind": "subnet",
    "key": "91.245.110.0/24",
    "title": "Scanning subnet escalated",
    "event_type": "suspicious_activity",
    "outcome_code": "escalated",
    "related_subjects": [
      {"kind": "org", "key": "example hosting ltd", "role": "related"}
    ],
    "visibility": "community"
  }
}
Shared by default when safe Typed outcome Ready for next agent run
Why this matters

What changes for the next analyst or agent

The next run starts with the conclusion already in place and can see whether the same entity is drawing fresh community attention right now instead of spending the first part of the session rebuilding context.

No report scraping loop Reusable across analysts and agents Aligned with the same reports and Risk API truth Fresh demand signal every 10 minutes

Start Free, Then Expand The Loop

Start with a real evaluation, move into a single productive operator loop, and then expand into shared team workflows without changing how you connect. The ladder measures investigation capacity, while subject resolution and governed memory sharing stay included.

Plan 01

MCP Evaluation

Resolve indicators, orient the subject model, and test up to 75 metered investigation calls per day while subject resolution, memory sharing, and writeback stay included.
Daily quota
75
metered investigation calls / day
Monthly fee
$0
per workspace / month
Intended audience
Individual evaluators and technical buyers testing the Syndu MCP surface.
Plan 02

MCP Operator

For one operator or one agentic SOC loop running against the published Syndu graph.
Daily quota
1,000
metered investigation calls / day
Monthly fee
$99
per workspace / month
Intended audience
Solo operators, incident leads, and prototype agent builders.
Plan 03

MCP Team

For teams that want multiple agents and multiple analysts to share Syndu-backed outcomes and playbooks.
Daily quota
10,000
metered investigation calls / day
Monthly fee
$499
per workspace / month
Intended audience
SOC teams, MSSP pods, and AI workflow owners.
Plan 04

MCP SOC

For sustained agentic SOC operations using Syndu as the external risk-and-knowledge layer.
Daily quota
100,000
metered investigation calls / day
Monthly fee
$1,999
per workspace / month
Intended audience
Enterprise SOCs, national response teams, and large internal platform-security groups.
Plan 05

MCP Enterprise

For high-volume SOC estates, partner programs, and managed analyst services.
Daily quota
1,000,000
metered investigation calls / day
Monthly fee
$5,000
per workspace / month
Intended audience
Platform-scale security organizations and service providers.
Use case

Built for active cyber, fraud, and abuse operations

Syndu MCP fits real investigation work: triage, escalation, detection drafting, merchant review, abuse response, and recurring security operations where a team needs an answer quickly and wants the next run to start ahead.

Evidence layer

One evidence graph across reports, API, and agents

Agents work on the same outside-in IP, subnet, ISP, ASN, organization, city, region, and country truth that already powers Syndu reports and the Risk API. There is no second data stack to reconcile.

Memory loop

Memory that survives the chat

Syndu turns one investigation into reusable context. Agents can preserve approved outcomes, notes, and playbook fragments in workspace memory so the next analyst, automation, or shift inherits the work instead of rebuilding it.

Shared risk memory

Community demand becomes part of the live readout

Syndu also tracks which public entities are being queried in 10-minute windows. MCP clients can use that queryability layer as a fast tactical signal: repeated lookups and multiple requester IPs show when fresh analyst attention is clustering around the same subject.

Governance

Governed sharing keeps collaboration useful

New workspaces start with stored outcomes and hive mind enabled, but sharing is still governed. Sensitive identifiers remain workspace-private when policy requires it, and the write path rejects obvious credential material.

Subject model

Broad subject coverage for real cases

The MCP layer goes beyond the public report graph. Teams can investigate and preserve outcomes for domains, URLs, email addresses, usernames, account ids, device ids, session ids, transaction ids, file hashes, and namespaced custom references.

Investigate, decide, preserve

Getting started is straightforward: create a workspace, connect your MCP client to Syndu, investigate a live identifier, and keep the result so the next analyst or agent inherits the work instead of repeating it.

Resolve and branch

Investigate

resolve_indicator / resolve_subject / get_report_snapshot / find_related_entities

Investigate an IP, organization, domain, URL, email, or other risky identifier from your MCP client without scraping a report page or rebuilding context from scratch.

resolve_indicator resolve_subject get_report_snapshot find_related_entities
Risk with context

Decide

explain_entity_risk / get_risk_api_result / draft_detection

Use report-backed dimensional evidence plus the live community-demand signal to decide why an entity deserves attention, then turn that context into a clearer analyst note, escalation, or detection draft.

explain_entity_risk get_risk_api_result draft_detection Dimensional evidence Community query signal
Workspace memory

Preserve

lookup_subject_memory / store_outcome_event / store_memory_note / link_subjects / bulk_store_outcomes

Store conclusions, playbook fragments, and typed outcomes in workspace memory so the next analyst or agent starts smarter, then optionally promote approved knowledge into the hive mind.

lookup_subject_memory store_outcome_event store_memory_note bulk_store_outcomes link_subjects Included, not metered

How MCP Fits The Syndu System

MCP is the primary operating surface for shared agent work. Reports and the Risk API remain supporting surfaces for human-readable evidence and inline scoring.

Human reading

Reports

Best when an investigator wants to browse, drill down, and read the evidence graph directly.

Canonical human-readable shells Best for readable evidence depth Supports, but does not replace, shared agent memory
Programmable scoring

Risk API

Best when an application needs a narrow contextual-risk decision inside its own workflow or decision engine.

Inline application calls Score-first delivery contract Good supporting contract for product logic
Collaborative agent workflow

MCP

Best when a team wants an assistant to investigate, explain what matters, and keep approved findings available for the next run.

Multi-step investigation surface Private memory plus optional hive mind Investigate, decide, preserve

How Shared Memory Compounds

This is what turns Syndu from a one-off lookup into an operational system. New workspaces start with reusable stored outcomes and hive mind on, so safe knowledge can compound while sensitive work stays private when it needs to.

01

Ask about something risky

An analyst or automation asks the MCP client to investigate an IP, domain, organization, or other suspicious identifier.

02

Syndu brings the context together

Syndu resolves the subject, pulls report-backed context, and explains why the entity deserves attention.

03

The conclusion becomes reusable

The result lands in workspace memory first, so every credential in the account can reuse it safely.

04

Share-safe knowledge can travel further

If the account enables hive mind and the subject is eligible, approved findings can be promoted into broader shared memory.

Install In Leading MCP Clients

Syndu is already hosted at `/mcp/`, so teams point their client at Syndu instead of standing up a local bridge. The install story should feel lighter than the value story, while still making ownership clear: one workspace, one credential plane, one governed memory system.

Repo-native operator

Codex

Use Syndu as Codex's governed external memory layer when you want risky-identifier lookup, contextual-risk explanation, and workspace-safe outcome reuse inside coding and ops loops.

Best for repo-aware investigation flows Pairs well with long-running operator sessions Hosted endpoint keeps install friction low
Open Codex page
CLI-native collaborator

Claude Code

Give Claude Code a shared hive mind instead of a disposable chat memory. The hosted Syndu endpoint fits recurring triage, playbook drafting, and investigation carryover.

Official HTTP transport flow Single CLI add command Private memory remains workspace-governed
Open Claude Code page
Custom MCP surface

Manus

Use Syndu as a hosted MCP surface inside Manus when you want one workspace memory system, outside-in investigation context, and reusable conclusions across future Manus tasks.

Hosted custom MCP configuration Same owned workspace access and memory policy Ready for a Manus-side skill layer
Open Manus page

Prompt-Led Install and Live MCP Calls

Let Codex handle the install and browser handoff, then use the hosted MCP tools for the actual investigation and memory loop.

text

Copy this prompt into Codex

Codex, visit https://syndu.com/pages/resources/codex-plugin/, install the Syndu plugin in this workspace, tell me before the browser handoff opens, run codex mcp login syndu when needed, then guide me through the Syndu workspace Access Dashboard so I can provision workspace MCP quota and create the MCP key for this shell if I want direct bearer-token fallback.
text

One-minute analyst ask

Investigate this IP, explain why it looks risky, find nearby entities, and store the conclusion so the next analyst or agent can continue from the same state.
json

Risk explanation tool call

{
  "tool": "explain_entity_risk",
  "arguments": {
    "kind": "org",
    "key": "google llc"
  }
}
json

Resolve a private identifier

{
  "tool": "resolve_subject",
  "arguments": {
    "kind": "email_address",
    "key": "analyst@example.com"
  }
}
json

Typed outcome event

{
  "tool": "store_outcome_event",
  "arguments": {
    "kind": "org",
    "key": "google llc",
    "title": "Credential abuse pattern",
    "summary": "Observed from one operator run.",
    "event_type": "credential_abuse",
    "outcome_code": "suspicious",
    "related_subjects": [
      {"kind": "domain", "key": "accounts.google.com", "role": "source"},
      {"kind": "ipaddress", "key": "8.8.8.8", "role": "destination"}
    ],
    "visibility": "workspace"
  }
}
json

Batch outcome ingestion

{
  "tool": "bulk_store_outcomes",
  "arguments": {
    "items": [
      {
        "kind": "email_address",
        "key": "analyst@example.com",
        "title": "Impossible travel follow-up",
        "summary": "Re-check MFA device state.",
        "event_type": "account_review",
        "outcome_code": "needs_review",
        "visibility": "workspace"
      },
      {
        "kind": "transaction_id",
        "key": "txn-184-ax7",
        "namespace": "checkout.paypal",
        "title": "Chargeback cluster",
        "summary": "Seen with two related risky accounts.",
        "event_type": "fraud_signal",
        "outcome_code": "chargeback",
        "visibility": "workspace"
      }
    ]
  }
}
json

Reusable note example

{
  "tool": "store_memory_note",
  "arguments": {
    "kind": "ipaddress",
    "key": "8.8.8.8",
    "title": "Observed scanning pattern",
    "summary": "Escalate when subnet peers align.",
    "note_type": "triage_note",
    "visibility": "workspace"
  }
}

Related Resources

Documentation

Syndu Documentation Index

Syndu gives computer-using agents outside-in risk context and a governed memory loop. This index maps the supporting docs: plugin install, MCP workflows, the Risk API, pricing, privacy, and the evidence depth behind the system.

4 briefing points Documentation
Open article
Coverage

What Syndu Reports Cover

Syndu exposes a dimensional risk surface across network entities and geography: ip address, subnet, ISP, ASN, organization, city, region, and country. That same dimensional graph powers the Risk API, MCP tools, and the memory loop that preserves the resulting decisions.

4 briefing points Coverage
Open article
Operations

Using Syndu with SoC and SIEM Workflows

Syndu is an external context layer for monitoring, hygiene review, agent workflows, and decision support. It complements SoC and SIEM processes rather than replacing them, while sharing the same evidence and memory model used elsewhere on the platform.

4 briefing points Operations
Open article
Fraud operations

Using Syndu with Fraud, Payments, and Merchant-Risk Workflows

Syndu is also a decision surface for fraud, payments, merchant-risk, and trust workflows. The same outside-in evidence graph, Risk API, and governed memory loop help teams score, review, and preserve conclusions around risky identifiers.

4 briefing points Fraud operations
Open article
AI and scale

Consuming Syndu at Scale

The platform supports three access surfaces at scale: direct report access for large-scale browser or agent consumption, the Risk API for application-native scoring, and the MCP server for collaborative agent workflows.

4 briefing points AI and scale
Open article
Delivery modes

Direct, API, and MCP Access

Syndu is one platform with three access surfaces: direct access for report-shell consumption, API access for application-side scoring, and MCP access for agent collaboration. They sit under the same workspace, quota, and subscription control plane, but differ in delivery contract.

4 briefing points Delivery modes
Open article
Register

Create a workspace to govern access to Syndu.

Registration unlocks the workspace control plane, plan selection, credential provisioning, and the subscription flow across web, API, and MCP access.

Register Sign in to workspace