Synapse RMCP
Host, Docker, Compose, SSH, logs, ZFS, and file operations over MCP and CLI.
ai.dinglebear/synapse
Publication
Published
Publisher
dinglebear-ai
Publisher identity: Not verified
Primary source
Official MCP Registry record
https://github.com/dinglebear-ai/synapseStatic analysis · human review · publication
Security evidence
Scanner signals, coverage and review decisions describe different parts of this report.
- Scan status
- completed
- Coverage
- Sufficient source coverage
- Static risk signals
- 18/100 · medium
- Finding count
- 41
- Highest finding severity
- medium
- Human review
- Approved review
- Review freshness
- Stale review
- Publication
- Published
Scan coverage and reliability
The scan completed with enough source coverage for ToolRepute's current review workflow. This does not verify runtime behavior.
Reliability: Meets current requirements
- Scanner version
- V5
- Scan run
- 260
- Last scan date
- 2026-09-09
- Files scanned
- 299
- Bytes scanned
- 2,152,422
- Manifest
- Found
- Source commit
- Pinned
- Truncation
- No
Analyzed source
https://github.com/dinglebear-ai/synapse
Analyzed commit: 9eee2a498483fd6a7d71a24adad13ecbc856dd52
Human review and publication
This historical decision does not establish current approval for the current review workflow. It may concern an older run, changed evidence or an older scanner.
- Review decision
- Approved review
- Review date
- 2026-09-09
- Reviewed scan run
- 260
- Reviewed commit
- 9eee2a498483fd6a7d71a24adad13ecbc856dd52
Publication is a decision to display evidence under ToolRepute's current rules, not a security certification, endorsement or guarantee.
Internal reviewer identity, review notes and private metadata are not displayed.
Published findings
LowExecutable file permission trackedTRACKED_EXECUTABLEentrypoint.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEpackages/synapse-rmcp/bin/synapse.jsFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEpackages/synapse-rmcp/scripts/install.jsFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/asciicheck.pyFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/block-env-commits.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/build-web.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/bump-version.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/check-blob-size.pyFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/check-coupled-files.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/check-dependency-updates.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/check-file-size.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/check-identity-contract.pyFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/check-runtime-current.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/check-rust-module-size.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/check-schema-docs.pyFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/check-version-sync.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/check-yanked-exceptions.pyFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/generate-cli.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/install.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/kache-gate-selftest.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/kache-gate.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/pre-release-check.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/refresh-docs.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/repair.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/run-ascii-check.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/sync-cargo.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/test-live-jsonrpc.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/test-mcp-auth.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/test-template-features.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/validate-plugin-layout.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEscripts/web-watch.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowExecutable file permission trackedTRACKED_EXECUTABLEtests/mcporter/test-mcp.shFinding details and evidence
Executable file permission tracked
Category: code execution
What was found
The repository tracks a file with executable permission.
Why it matters
Executable files identify code or tooling that may be run directly.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the file and how it is invoked. Executable permissions are normal for CLI and server scripts; confirm the intended entry point before running it.
Limitations and legitimate-use context
Executable permission is normal for scripts and does not show that the file is unsafe or automatically executed.
LowCommand-line executable declaredNPM_BIN_DECLAREDpackages/synapse-rmcp/package.jsonFinding details and evidence
Command-line executable declared
Category: code execution
What was found
The package manifest exposes one or more command-line entry points.
Why it matters
Command-line entry points indicate code intended to execute on the user's system.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the declared command-line entry point and its startup behavior, requested permissions and inputs before running it.
Limitations and legitimate-use context
Declaring a command-line tool is common and does not by itself indicate unsafe behavior.
Lownpm publish lifecycle script declaredNPM_PUBLISH_LIFECYCLE_SCRIPTpackages/synapse-rmcp/package.jsonFinding details and evidence
npm publish lifecycle script declared
Category: code execution
What was found
The package declares a lifecycle script associated with preparation or publication.
Why it matters
Such scripts show automated code execution in the package workflow and provide useful review context.
Evidence snippet
prepublishOnly: node scripts/check-package.js --release
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Check which preparation or publication workflow invokes the script and distinguish it from consumer installation.
Limitations and legitimate-use context
Publish-oriented scripts do not normally run when a consumer installs the package.
Mediumnpm install lifecycle script declaredNPM_INSTALL_LIFECYCLE_SCRIPTpackages/synapse-rmcp/package.jsonFinding details and evidence
npm install lifecycle script declared
Category: code execution
What was found
The package declares a script that can run during consumer installation.
Why it matters
Install-time scripts execute before a user starts the tool and can modify the local environment.
Evidence snippet
postinstall: node scripts/install.js
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the lifecycle command and dependencies before installation. Determine what runs on the consumer's machine and whether scripts can be disabled.
Limitations and legitimate-use context
The presence of an execution mechanism does not show that it is unsafe or that it runs without user intent.
MediumInstall or bootstrap script presentINSTALL_SCRIPT_FILEinstall.shFinding details and evidence
Install or bootstrap script present
Category: code execution
What was found
The repository contains a dedicated install, setup, or bootstrap script.
Why it matters
Installation scripts can change the host environment and should be reviewed before execution.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Read the install or bootstrap script before execution. Check downloaded code, shell commands, filesystem changes and requested privileges.
Limitations and legitimate-use context
The presence of an execution mechanism does not show that it is unsafe or that it runs without user intent.
MediumInstall or bootstrap script presentINSTALL_SCRIPT_FILEpackages/synapse-rmcp/scripts/install.jsFinding details and evidence
Install or bootstrap script present
Category: code execution
What was found
The repository contains a dedicated install, setup, or bootstrap script.
Why it matters
Installation scripts can change the host environment and should be reviewed before execution.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Read the install or bootstrap script before execution. Check downloaded code, shell commands, filesystem changes and requested privileges.
Limitations and legitimate-use context
The presence of an execution mechanism does not show that it is unsafe or that it runs without user intent.
MediumInstall or bootstrap script presentINSTALL_SCRIPT_FILEscripts/install.shFinding details and evidence
Install or bootstrap script present
Category: code execution
What was found
The repository contains a dedicated install, setup, or bootstrap script.
Why it matters
Installation scripts can change the host environment and should be reviewed before execution.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Read the install or bootstrap script before execution. Check downloaded code, shell commands, filesystem changes and requested privileges.
Limitations and legitimate-use context
The presence of an execution mechanism does not show that it is unsafe or that it runs without user intent.
MediumInstall or bootstrap script presentINSTALL_SCRIPT_FILEsrc/cli/setup.rsFinding details and evidence
Install or bootstrap script present
Category: code execution
What was found
The repository contains a dedicated install, setup, or bootstrap script.
Why it matters
Installation scripts can change the host environment and should be reviewed before execution.
Evidence snippet
No public snippet is available. It was not recorded or is withheld to protect sensitive content.
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Read the install or bootstrap script before execution. Check downloaded code, shell commands, filesystem changes and requested privileges.
Limitations and legitimate-use context
The presence of an execution mechanism does not show that it is unsafe or that it runs without user intent.
MediumShell command execution detectedINSTALL_SHELL_EXECscripts/check-blob-size.py:27Finding details and evidence
Shell command execution detected
Category: code execution
What was found
Static analysis detected an API or option capable of launching shell commands.
Why it matters
Shell execution can interact with the host system and expands the impact of unsafe input.
Evidence snippet
result = subprocess.run(["git", *args], check=True, capture_output=True, text=True)
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the command, its inputs and call path. Check input validation and whether execution is expected and explicitly authorized.
Limitations and legitimate-use context
The presence of an execution mechanism does not show that it is unsafe or that it runs without user intent.
MediumShell command execution detectedINSTALL_SHELL_EXECscripts/check-yanked-exceptions.py:12Finding details and evidence
Shell command execution detected
Category: code execution
What was found
Static analysis detected an API or option capable of launching shell commands.
Why it matters
Shell execution can interact with the host system and expands the impact of unsafe input.
Evidence snippet
result = subprocess.run(
Scanner interpretation
A static rule match is a signal for contextual inspection, not a confirmed vulnerability or malicious behavior.
Recommended check
Inspect the command, its inputs and call path. Check input validation and whether execution is expected and explicitly authorized.
Limitations and legitimate-use context
The presence of an execution mechanism does not show that it is unsafe or that it runs without user intent.
Reputation evidence
Insufficient evidence · low confidence · model v1
Evidence support score: 5/100. This is separate from risk, review and publication.
Assessment as of 2026-11-06. Live repository HEAD is not checked when this page loads.
Security evidence · 0/25LIMITED · low confidence
Reliable mapped v6 scope is not established; evidence age: aging.
Static support is capped at 18/25 before a risk deduction of ceil(riskScore/4); zero findings does not establish safety.
Last observed: 2026-09-09
- scan record 260: Scanner v5; completed; manifest found; sufficient scope true; 299 files / 2152422 bytes; 41 findings; not truncated; scanner risk score 18.Commit 9eee2a498483fd6a7d71a24adad13ecbc856dd52Source evidence
Static analysis covers a bounded source scope, not runtime, dependencies in full, or hosted behavior.
Source transparency · 5/25STALE · low confidence
Completed matching public GitHub acquisition: not established (+0).
Unique primary mapping: observed (+5).
Completed matching pinned commit: not established (+0).
Completed matching source mapping: not established (+0).
Matching manifest and sufficient untruncated scope: not established (+0).
Last observed: 2026-10-04
- source record 298: Primary mapping is incomplete or changed. Live repository HEAD is not checked by page requests.Source evidence
- scan record 260: Scanner v5; completed; manifest found; sufficient scope true; 299 files / 2152422 bytes; not truncated.Commit 9eee2a498483fd6a7d71a24adad13ecbc856dd52Source evidence
A source mapping does not prove ownership. Repository availability and live HEAD are not rechecked here.
Review freshness · 0/25STALE · low confidence
Current artifact-bound approval earns 25; matching approval with unchecked live HEAD earns 8; stale, missing or rejected evidence earns 0.
Last observed: 2026-09-09
- review record 31: Decision: approved; reviewed run 260; NEXT-11 freshness: stale.
Page requests make no upstream probe. An old approval is not approval of changed evidence.
Registry consistency · 0/10UNKNOWN · low confidence
Unique primary, normalized active/latest official registry observation earns 10 within 30 days, 5 within 90, otherwise 0.
Last observed: 2026-10-04
- registry record 298: Normalized official record: false; active: true; latest: true; observation age: aging.
Registry consistency is a source-record observation, not identity verification or a security endorsement.
Publisher identity confidence · 0/15UNKNOWN · low confidence
No verified legal, domain or repository-ownership binding is available; free text and the registry verification flag earn no credit.
Last observed: Not available
Publisher name and registry namespace cannot establish legal identity or ownership.
Recorded assessment history (1)
History starts with explicit captures in model v1. Past source and review state cannot be fully reconstructed. Page reads do not save snapshots; changes in the live assessment appear in history only after an explicit capture.
- 2026-10-11 · model v1 · 5/100 · low confidence · scan 2609eee2a498483fd6a7d71a24adad13ecbc856dd52
Recorded signal breakdown
- Security evidence: 0/25 · LIMITED
- Source transparency: 5/25 · STALE
- Review freshness: 0/25 · STALE
- Registry consistency: 0/10 · UNKNOWN
- Publisher identity confidence: 0/15 · UNKNOWN
Reputation reflects ToolRepute-observed evidence only; it is not a guarantee of security.
Signals may be incomplete or stale. Runtime and hosted behavior may differ from scanned source.
Publisher identity has no verified binding. Repository ownership and legal identity are not established.
This score measures support in the available evidence, not the probability that a tool is safe.
Registry data
Version
1.0.0
Packages
1
Remote endpoints
0
Enrichment
complete
Last fetched
2026-10-04
Registry inclusion identifies the source record. It is not a ToolRepute security endorsement.
Normalized sources
Structured from the Official MCP Registry record.
Enriched 2026-10-04
Packages
@dinglebear/synapse
More reviewed MCP servers
Continue exploring integrations with published ToolRepute reviews.
Terraform
Generate more accurate Terraform and automate workflows for HCP Terraform and Terraform Enterprise
adtest-mcp
AI-only ad scoring for Claude: score image, video or text ads on 13 dimensions before you spend.
bolthub
The bolthub API marketplace, L402 gateways, and your other MCP servers, on one Lightning budget.