cmd/

Command synapse-agent is the fleet VM agent (#410, epic #405).

Command synapse-api is the HTTP API server entrypoint.

Command synapse-ast parses a source tree with language-aware (tree-sitter) grammars and emits structural facts as JSON on stdout.

Command synapse-callgraph builds a general first-party call graph from Go source (via go/ssa) and emits it as the taintcallgraph wire JSON on stdout.

Command synapse-cli runs Synapse's own SCA pipeline from the command line.

Command synapse-cluster-agent is the Kubernetes cluster agent (#411/#446, epic #405).

Command synapse-cspm is the sandboxed CSPM SDK helper.

synapse-dast-helper owns HTTP clients and authenticated session state outside the API process.

Command synapse-fptriage-compare validates and compares two deterministic AI false-positive triage shadow reports.

Command synapse-fptriage-curate converts explicitly reviewed AI-triage outcomes into an offline evaluation dataset after privacy and label-quality approval.

Command synapse-fptriage-drift compares a saved AI-triage observability distribution with a versioned, human-approved baseline.

Command synapse-fptriage-eval runs the production false-positive triager in shadow mode over a versioned, human-reviewed golden dataset and emits a deterministic machine-readable report.

Command synapse-fptriage-release creates an immutable, versioned ledger of independently approved AI-triage promotions and rollbacks.

Command synapse-mcp exposes Synapse's agent tool catalog to external AI clients over the Model Context Protocol.

Command synapse-worker is the privileged execution worker: it claims recon jobs the API enqueued to the durable queue and runs them under the SAME gate/audit/evidence invariants as the in-process path, but with the sandbox + kernel egress allowlist (it runs with CAP_NET_ADMIN/SYS_ADMIN, which the API lacks).