Synaplan

io.github.metadist/synaplanmetadiststreamable-httpv5.6.2Scanned 1 hour ago

Self-hosted AI workspace: semantic RAG document search, long-term memory, and AI chat via MCP.

10 tools: 1 do something that can't be undone, 2 change things and 7 only read.

Reads private data · 4
Reads text others write · 4
Can send data out · 1
No findings

Sign-in required, OAuth metadata published. Remote posture

Anlyon alternative

3 of these tools change something. Run those as governed actions.

Declare what an action changes, and Anlyon puts it under a shared limit, binds every approval to the exact request, and grades the outcome. It works on any HTTPS API you can describe as an action.

Anlyon does not run, proxy or govern this MCP server. A tool your own code calls directly is not routed through Anlyon and is not governed by it.

Import an OpenAPI spec →

Tools

Grouped by what each tool does, most consequential first. Open one for its reasons and full description; descriptions are the publisher's own words.

10 tools

Can't be undone 1Sends, pays, publishes or merges: once done, it cannot be taken back.Claude Code: ask

synaplan_chatSend a message through Synaplan's full AI pipeline — intent classification, web search, RAG over the user's documents, long-term memories, and inference — and return the synthesize…Reads text others writeCan send data outNo findings
Why it is in this group
- The description's first verb is "send": a word for sending, and what is sent cannot be taken back.
What it can reach
- untrusted-inputThe server marks it openWorldHint: true: it reaches things outside the server's own data.
- outboundThe description's first verb is "send": it sends or publishes something to other people.
- outboundThe input takes a destination (input.chat_id): what the tool writes goes there.
Description, as the server wrote it
Send a message through Synaplan's full AI pipeline — intent classification, web search, RAG over the user's documents, long-term memories, and inference — and return the synthesized answer. This is richer than a raw model call: it uses the authenticated account's knowledge base and memories.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- openWorldHint: true

Changes things 2Creates or changes something that can be changed back.Claude Code: ask

file_ingestAdd a text document to the authenticated user's knowledge base.No findings
Why it is in this group
- The description's first verb is "add": a word for a change.
Description, as the server wrote it
Add a text document to the authenticated user's knowledge base. The content is chunked, embedded, and stored so it becomes retrievable via rag_search.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
memory_addStore a new long-term memory for the authenticated user — a durable fact or preference that Synaplan will recall in future conversations.No findings
Why it is in this group
- The name "memory_add" says "add": a word for a change.
Description, as the server wrote it
Store a new long-term memory for the authenticated user — a durable fact or preference that Synaplan will recall in future conversations.
Annotations the server declares
- readOnlyHint: false
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false

Only reads 7Looks things up and changes nothing.Show 7 read-only tools

get_messagesReturn the messages of one of the user's chats, in chronological order.Reads private dataReads text others writeNo findings
Why it is in this group
- The name "get_messages" says "get": a word for reading.
What it can reach
- private-dataThe name "get_messages" says "get" and "message": it reads messages.
- private-dataThe description's first sentence says "return" and "message": it reads messages.
- untrusted-inputThe name "get_messages" says "get" and "message": it reads messages, which other people can write.
- untrusted-inputThe description's first sentence says "return" and "message": it reads messages, which other people can write.
Description, as the server wrote it
Return the messages of one of the user's chats, in chronological order.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_assistantsList assistants the authenticated user may use from a connected app.No findings
Why it is in this group
- The name "list_assistants" says "list": a word for reading.
Description, as the server wrote it
List assistants the authenticated user may use from a connected app. Each row includes slug, name, description, version and origin.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_chatsList the authenticated user's conversations (most recently updated first).Reads private dataReads text others writeNo findings
Why it is in this group
- The name "list_chats" says "list": a word for reading.
What it can reach
- private-dataThe name "list_chats" says "list" and "chat": it reads messages.
- private-dataThe description's first sentence says "list" and "conversation": it reads messages.
- untrusted-inputThe name "list_chats" says "list" and "chat": it reads messages, which other people can write.
- untrusted-inputThe description's first sentence says "list" and "conversation": it reads messages, which other people can write.
Description, as the server wrote it
List the authenticated user's conversations (most recently updated first).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
list_promptsList the user's available Synaplan task prompts (internal `tools:*` prompts excluded).No findings
Why it is in this group
- The name "list_prompts" says "list": a word for reading.
Description, as the server wrote it
List the user's available Synaplan task prompts (internal `tools:*` prompts excluded).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
memory_searchSearch the authenticated user's stored long-term memories (preferences, facts, context) using semantic similarity.No findings
Why it is in this group
- The name "memory_search" says "search": a word for reading.
Description, as the server wrote it
Search the authenticated user's stored long-term memories (preferences, facts, context) using semantic similarity.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
rag_searchSemantic search across the authenticated user's vectorized documents and knowledge base.Reads private dataNo findings
Why it is in this group
- The name "rag_search" says "search": a word for reading.
What it can reach
- private-dataThe description's first sentence says "document": it reads documents.
Description, as the server wrote it
Semantic search across the authenticated user's vectorized documents and knowledge base. Returns the most relevant text chunks with similarity scores.
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false
rag_similarFind document chunks similar to a given source message/document id (the `message_id` returned by rag_search).Reads private dataReads text others writeNo findings
Why it is in this group
- The description's first verb is "find": a word for reading.
What it can reach
- private-dataThe description's first sentence says "find" and "document": it reads documents.
- untrusted-inputThe description's first sentence says "find" and "message": it reads messages, which other people can write.
Description, as the server wrote it
Find document chunks similar to a given source message/document id (the `message_id` returned by rag_search).
Annotations the server declares
- readOnlyHint: true
- openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Exfil surface

Which tools read private data, which read text someone else can write, and which can send data out. One of each is a path a prompt injection can use.

16 paths in this server alone from private data, through text someone else wrote, to a way out. Denying 1 outbound tool breaks every one.

Reads private data4: Reads files, mail, messages, databases, secrets, calendars or repositories.; get_messages
list_chats
rag_search
rag_similar
Reads text others write4: Brings in text someone else can write: web pages, inbound email, messages, issues and comments.; get_messages
list_chats
rag_similar
synaplan_chat
Can send data out1: Can carry data to people or systems: it sends, posts or publishes, or takes a recipient, channel or URL.; synaplan_chat

deny to break every path

{
  "permissions": {
    "deny": [
      "mcp__synaplan__synaplan_chat"
    ]
  }
}

Other servers in the same agent add their own tools to these paths. Audit your whole setup to see them together.

Remote posture

What anyone on the internet sees at the remote endpoint: an anonymous initialize and tools/list, and the public OAuth metadata.

Sign-in required, OAuth metadata published

Looked at Oct 22, 2026, 15:02 UTC, unchanged since Oct 22, 2026. No credentials were sent and no tool was called. What is looked at.

Reachable: yes
HTTP status of an anonymous initialize: 401
tools/list served without credentials: no
Tools that change things, listed without credentials: 0
Protocol version: not observed
WWW-Authenticate on 401: yes
resource_metadata in WWW-Authenticate: https://web.synaplan.com/.well-known/oauth-protected-resource/mcp
RFC 9728 protected resource metadata: https://web.synaplan.com/.well-known/oauth-protected-resource/mcp
Authorization servers: not observed
Legacy HTTP+SSE transport: no
Dynamic client registration: not observed
Client ID metadata documents: not observed

Findings

Matches of fixed checks, with the text they matched.

No check matched anything in these tool definitions. That is not a safety guarantee.

History

Changes to its tool definitions and to its remote endpoint, newest first.

No change seen yet. Its tools are rescanned every day, and a remote endpoint is looked at once a week.

All changes to this server

Install

Pinned to version 5.6.2. Values in angle brackets are yours to fill in.

claude mcp add --transport http synaplan https://web.synaplan.com/mcp --header 'X-API-Key: <your-x-api-key>'

claude mcp add --transport http synaplan https://web.synaplan.com/mcp --header 'X-API-Key: <your-x-api-key>'

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change or a way out, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json

{
  "permissions": {
    "allow": [
      "mcp__synaplan__rag_search",
      "mcp__synaplan__memory_search",
      "mcp__synaplan__rag_similar",
      "mcp__synaplan__list_chats",
      "mcp__synaplan__get_messages",
      "mcp__synaplan__list_prompts",
      "mcp__synaplan__list_assistants"
    ],
    "ask": [
      "mcp__synaplan__synaplan_chat",
      "mcp__synaplan__memory_add",
      "mcp__synaplan__file_ingest"
    ],
    "deny": []
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. A read that can send data out (it takes a URL, say) asks first too. It assumes the server is installed as synaplan. Review it before you use it.

Capability tags behind 5 rules

mcp__synaplan__synaplan_chat untrusted-input, outbound
mcp__synaplan__rag_search private-data
mcp__synaplan__rag_similar private-data, untrusted-input
mcp__synaplan__list_chats private-data, untrusted-input
mcp__synaplan__get_messages private-data, untrusted-input

Keep the decision: fail CI when the tools change, follow every change, or show a badge.

Pin in CI

Fail a build when the tools you reviewed are not the tools the server serves today.

curl -s "https://anlyon.dev/api/v1/servers/io.github.metadist/synaplan/verify?hash=1407ed8801cae611563992ae32fa7dd4e039187ff2ff04b81588700f2f452bb3" | jq -e '.changed == false'

Pinned hash 1407ed8801ca, from Oct 28, 2026, 21:18 UTC.

Watch

Get told when its tools change: a new tool, a new description, a new class.

https://anlyon.dev/servers/io.github.metadist/synaplan/changes.xml

An Atom feed. Works in any feed reader or Slack's RSS app.

Badge

[![anlyon.dev](https://anlyon.dev/badge/io.github.metadist/synaplan.svg)](https://anlyon.dev/servers/io.github.metadist/synaplan)

Source: MCP Registry · repository. Synced Oct 28, 2026, 21:17 UTC.