Synapth docs

MCP is an open protocol that standardises how an AI application (the host: Claude Desktop, Cursor, Claude Code…) talks to external capability providers (servers). A server exposes three kinds of things: tools the model can call, resources it can read, and prompts it can reuse.

The host launches the server (over stdio) or connects to it (over SSE/HTTP), asks tools/list, and from then on the model sees the server's tools exactly like built-in functions. Synapth indexes those servers, scans them, and generates the host-specific config so you never hand-edit JSON.

• MCP — a process or endpoint speaking the protocol; installs into the host's mcpServers.
• Tool — a single HTTP function with a JSON-schema signature; called through the Synapth gateway.
• Prompt — only a system-prompt fragment; installs as a Cursor rule, a Claude Code skill or a project instruction.

Open the skill page, pick the Cursor tab and press Copy & install. Merge the snippet into ~/.cursor/mcp.json (global) or .cursor/mcp.json (project):

{
  "mcpServers": {
    "acme-postgres-mcp": {
      "command": "npx",
      "args": ["-y", "@acme/postgres-mcp"],
      "env": { "DATABASE_URL": "${DATABASE_URL}" }
    }
  }
}

Prompt skills become a rule in .cursor/rules/. Restart Cursor or toggle the server in Settings → MCP.

Same snippet, different file: ~/Library/Application Support/Claude/claude_desktop_config.json on macOS, %APPDATA%\Claude\claude_desktop_config.json on Windows. Restart Claude Desktop; the hammer icon lists the new tools.

The Claude Code tab gives a one-liner:

claude mcp add acme-postgres-mcp -- npx -y @acme/postgres-mcp

Prompt skills are written to .claude/skills/<name>/SKILL.md and picked up automatically.

• Verified — clean automated scan and a human review; publisher identity confirmed.
• Community — clean scan, not yet reviewed. Fine for local dev, read the manifest before giving it secrets.
• Sandbox — the scanner found prompt-injection phrases, dangerous shell patterns, hard-coded secrets or exfiltration endpoints. Run only in an isolated environment; the gateway refuses to execute it.

Regardless of badge: never paste real keys into a config — use ${VAR} references; give a server the narrowest permission set; prefer stdio servers you can read the source of.

Synapth looks for, in order: synapth.json, mcp-server.json, tool.json, SKILL.md. The native format:

{
  "schemaVersion": 1,
  "name": "Postgres MCP",
  "description": "Read-only SQL access for agents.",
  "category": "MCP",
  "systemPrompt": "Call postgres_list_tables before writing SQL.",
  "tools": [
    {
      "name": "postgres_query",
      "description": "Run a read-only SQL statement.",
      "parameters": {
        "type": "object",
        "properties": { "sql": { "type": "string" } },
        "required": ["sql"]
      }
    }
  ],
  "entrypoint": { "type": "mcp-stdio", "command": "npx", "args": ["-y", "@acme/postgres-mcp"], "env": { "DATABASE_URL": "${DATABASE_URL}" } },
  "permissions": ["network", "shell"],
  "requiredEnv": ["DATABASE_URL"],
  "flow": [
    { "id": "t", "label": "Data question", "kind": "trigger", "next": ["q"] },
    { "id": "q", "label": "postgres_query", "kind": "tool", "tool": "postgres_query", "next": ["o"] },
    { "id": "o", "label": "Answer", "kind": "output" }
  ]
}

For a prompt-only skill a SKILL.md with frontmatter (name, description, category, tags) and the prompt as body is enough.

Sign in → Publishing & keys → paste the repository URL → Preview. Synapth fetches the manifest, maps it, and runs the sandbox scanner. Critical findings block publishing; high findings publish with a Sandbox badge.

The same flow is available to scripts:

curl -X POST https://synapth.dev/api/v1/import/github \
  -H 'Content-Type: application/json' -H 'X-Synapth-Key: syn_…' \
  -d '{"url":"https://github.com/acme/postgres-mcp","dryRun":true}'

Verified is never granted by the scanner alone. Once the skill is published, request a review from the skill page; a moderator reads the manifest and confirms the publisher's GitHub identity. Verified skills are eligible for Hidden Gems.

Synapth runs its own full-text engine over the catalogue (BM25F over name, tags, description, tools and README), with typo correction and prefix completion. Filters can be typed straight into the box:

category:MCP          MCP | Prompt | Tool
is:verified           Verified | Community | Sandbox
lang:python           repository language
author:anthropics     GitHub owner
tag:pdf               topic / tag
stars:>100            minimum GitHub stars
"exact phrase"        must appear verbatim
-word                 exclude

The same engine backs GET /api/v1/search?q=… (facets, highlights, corrections) and ?suggest=1 for type-ahead.

Most entries are imported by the Synapth crawler from GitHub: repositories found by topic (claude-skills, agent-skills, mcp-server), keyword search and code search for SKILL.md. Every manifest is scanned before it lands here; the badge tells you the result. Each skill page links to the exact file in the source repository.

Add X-Agent-Request: true to any catalogue request. Instead of the web payload you get a minified context blob: merged system prompt, function-calling tool schemas, and an install hint per skill.

curl -s -H 'X-Agent-Request: true' \
  'https://synapth.dev/api/v1/skills?q=postgres&limit=3'
# → {"v":1,"sys":"## Postgres MCP v1.4.2\n…","tools":[{"type":"function","function":{…},"s":"skl_postgres"}],"skills":[…],"n":3}

The tools array is drop-in for OpenAI-style and Anthropic-style tool lists; sys is appended to the system prompt.