synapse-ce

module

v0.1.0 Latest Latest Go to latest Published: Jul 22, 2026 License: Apache-2.0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/KKloudTarus/synapse-ce

Links

Open Source Insights

README ¶

Verify Everything. Trust Nothing.

A governed control plane for software composition analysis, recon, evidence, and reporting.

Turn a fragmented, manual security process into a controlled, auditable workflow, with server-side scope enforcement, hardened tool execution, tamper-evident evidence, and deterministic reports.

Landing page · Documentation · Quickstart · Features · Configuration

[!IMPORTANT] Authorized use only. Synapse is built for authorized security testing, pentest engagements, and defensive security work. Every engagement enforces an explicit scope and a legal authorization window, server-side, before any tool runs. You are responsible for holding written permission to test any target.

Why Synapse

✅ Deterministic first. Scanning, matching, and reporting are pure, reproducible Go. No model sits in the report path.
✅ Evidence you can trust. Every artifact is hash-chained into a tamper-evident custody record. A broken chain blocks the report.
✅ One tool, four scanners. SCA, first-party SAST, secret scanning, and IaC misconfig behind a single gate.
✅ Reachability aware. A deterministic call graph decides whether a vulnerable symbol is actually reachable from your code.
✅ Detection independent. Owns its SBOM parsers and advisory matching, and ingests OSV, GHSA, and CSAF.
✅ CI ready. synapse-cli is a single static binary that gates a build and emits SARIF for code scanning.
✅ Safe by construction. argv-only execution in a Linux sandbox, server-side scope and authorization before any tool runs, secrets never leave the server.

What is Synapse

Synapse runs the security-assessment lifecycle behind one governed control plane: software composition analysis, recon, evidence capture, findings, and reporting.

It is deterministic-first. Scanning, matching, license classification, and reporting are pure, reproducible Go with nothing else in the path. Where automated analysis is offered it stays strictly bounded: a proposal is only ever proposed, a typed Go state machine validates and executes, scope and authorization are checked in the execution layer, secrets never leave the server, every artifact is hash-chained into a tamper-evident custody record, and a human approves anything intrusive.

Features

SBOM generation across many ecosystems (npm, PyPI, Maven, Gradle, Go, Cargo, RubyGems, Composer, NuGet, Hex, Dart and more), with owned per-ecosystem lockfile parsers.
Vulnerability detection from a live advisory API and an offline database, cross-correlated and de-duplicated, plus an owned advisory store that ingests OSV, GHSA and CSAF feeds for detection independence.
Risk-based prioritization: findings are ordered by exploitability (known-exploited catalog, then exploit-prediction score, then CVSS), never by raw CVSS alone.
License compliance: declared-license resolution, SPDX expression parsing, a curated category and risk model, and coordinate recovery for shaded or metadata-less JARs.
Reachability: a deterministic call-graph engine decides whether a vulnerable symbol is actually reachable from application code.
Tamper-evident evidence: every artifact is hash-chained. A broken chain blocks the report. Audit and evidence logs are append-only.
Hardened execution: tools are shelled out via argv arrays inside a Linux sandbox with egress scoping. Scope and the authorization window are enforced before any tool runs.
RBAC and tenant isolation through a single authorization chokepoint.
Standards native: CycloneDX and SPDX with PURL, SARIF, OpenVEX and CSAF, plus KEV and EPSS.
Deterministic reports templated from stored data, with a curated CWE to OWASP, PCI and ISO compliance mapping.
Bounded AI analysis (optional): the agent proposes, a distinct verifier or a human confirms. No model ever sits in the report path.

See the full walkthrough with screenshots on the documentation site.

How it compares

Detection is at parity with the popular scanners, and sometimes ahead. On one representative real-world repository, Synapse reported 261 unique CVEs to Trivy's 239 (235 in common) and attached a license to 1443 packages to Trivy's 1394. Numbers move with the project, so treat these as illustrative rather than a benchmark claim.

The lasting difference is what sits around the finding:

Capability	Synapse	Most scanners
SCA, license, IaC misconfig, secret scanning	Yes	Yes
First-party SAST (source-code rules)	Yes	Usually no
Reachability via a call graph	Yes	Rarely
Hash-chained, tamper-evident evidence	Yes	No
Server-side scope and authorization before a tool runs	Yes	No
RBAC, tenant isolation, separation of duties	Yes	No
Deterministic, model-free report path	Yes	Varies

Quickstart

Prerequisites

Go 1.26 (pinned in go.mod), Node and pnpm (use pnpm, not npm or yarn).
Syft (required for any scan) and Grype (optional, adds the offline database). make tools installs both, pinned and checksum-verified, into ./bin.
Docker is optional and is the easiest way to run the full stack.
The hardened sandbox and live recon need a Linux host. Without them the API still runs (SCA, findings, reports); sandboxed execution fails closed rather than running unsandboxed.

Install a released build

Grab a prebuilt binary from the Releases page (linux, macOS and Windows; amd64 and arm64) and verify it against checksums.txt. Each archive bundles all five commands.

# Example: linux/amd64
curl -fsSL -o synapse.tar.gz \
  https://github.com/KKloudTarus/synapse-ce/releases/latest/download/synapse-ce_<version>_linux_amd64.tar.gz
tar -xzf synapse.tar.gz synapse-cli
./synapse-cli scan ./path/to/project --fail-on high

Or scan with zero install using the container image (bundles synapse-cli plus syft and grype):

docker run --rm -v "$PWD:/scan:ro" ghcr.io/kkloudtarus/synapse-cli scan /scan --fail-on high

Gate a repository in CI with the reusable action (see docs/guide/cli.md):

- uses: KKloudTarus/synapse-ce@v1
  with:
    fail-on: high

Run the full stack with Docker

docker compose -f deploy/docker-compose.full.yml up --build
# then open http://localhost:5173

Run natively (development)

make install                       # Go modules + web deps
make tools                         # syft + grype into ./bin
export PATH="$PWD/bin:$PATH"

export SYNAPSE_API_TOKEN="$(openssl rand -hex 32)"   # required, no anonymous access
make dev                           # API on :8080, dashboard on :5173

Open http://localhost:5173, paste the token, accept the Acceptable Use Policy. A blank SYNAPSE_DB_DSN runs an in-memory dev store, so nothing is persisted. Migrations are embedded and applied automatically at startup.

Command line

synapse-cli runs the same pipeline as the server, ideal for CI gating.

make build
./bin/synapse-cli scan ./path/to/project --fail-on high

The exit code is 0 when no finding meets the threshold, non-zero otherwise.

Binaries

Binary	Role
`synapse-api`	HTTP API server, the primary service
`synapse-cli`	Run an SCA scan from the command line, CI-friendly
`synapse-worker`	Durable job runner for recon and background jobs, lease-based
`synapse-callgraph`	Sandboxed call-graph builder for reachability analysis
`synapse-mcp`	Read-only, propose-only integration server, never executes

Architecture

Clean architecture with a strict, inward-only dependency rule:

domain  <-  usecase  <-  adapter / infrastructure

All external I/O (database, tools, storage, sandbox) goes through ports, which are interfaces in internal/usecase/ports. cmd/* is the composition root, with dependency injection in main and no business logic.

Configuration

Synapse reads its configuration from the process environment. Copy .env.example and adjust. The only required variable in development is SYNAPSE_API_TOKEN. In production, SYNAPSE_MEASURE_CURSOR_SECRET is also required (generated via openssl rand -hex 32). See the configuration reference for the full list.

Full documentation lives in docs/guide/: introduction, installation, quickstart, features, configuration, CLI, architecture, deployment, and the security model. See CHANGELOG.md for what has changed.

Roadmap

Synapse is under active development. Near-term directions:

Broader ecosystem coverage: more owned lockfile parsers (Conda, R, Julia, Conan).
More first-party SAST rules, and additional languages.
More IaC checks across Terraform, Kubernetes, and CloudFormation.
Richer SARIF output, including remediation in code-scanning alerts.
More curated, model-free compliance profiles.
Reachability for more language ecosystems.
More CI recipes and integration examples.

Have a request? Open an issue or start a discussion. Issues tagged good first issue and help wanted are a good place to start.

Contributors

Synapse was built by its founding team.

	Contributor	Role
	nghiadaulau	Engineer
	nnatuan03	Engineer
	lethanhsang188	Engineer
	tuu-ngo	Brand identity designer

Contributions are welcome. See CONTRIBUTING.md, the Code of Conduct, and report vulnerabilities per the Security Policy.

License

Licensed under the Apache License 2.0.

Directories ¶

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL

Path	Synopsis
cmd
synapse-api command Command synapse-api is the HTTP API server entrypoint.	Command synapse-api is the HTTP API server entrypoint.
synapse-ast command Command synapse-ast parses a source tree with language-aware (tree-sitter) grammars and emits structural facts as JSON on stdout.	Command synapse-ast parses a source tree with language-aware (tree-sitter) grammars and emits structural facts as JSON on stdout.
synapse-callgraph command Command synapse-callgraph builds a general first-party call graph from Go source (via go/ssa) and emits it as the taintcallgraph wire JSON on stdout.	Command synapse-callgraph builds a general first-party call graph from Go source (via go/ssa) and emits it as the taintcallgraph wire JSON on stdout.
synapse-cli command Command synapse-cli runs Synapse's own SCA pipeline from the command line.	Command synapse-cli runs Synapse's own SCA pipeline from the command line.
synapse-mcp command Command synapse-mcp exposes Synapse's agent tool catalog to external AI clients over the Model Context Protocol.	Command synapse-mcp exposes Synapse's agent tool catalog to external AI clients over the Model Context Protocol.
synapse-worker command Command synapse-worker is the privileged execution worker: it claims recon jobs the API enqueued to the durable queue and runs them under the SAME gate/audit/evidence invariants as the in-process path, but with the sandbox + kernel egress allowlist (it runs with CAP_NET_ADMIN/SYS_ADMIN, which the API lacks).	Command synapse-worker is the privileged execution worker: it claims recon jobs the API enqueued to the durable queue and runs them under the SAME gate/audit/evidence invariants as the in-process path, but with the sandbox + kernel egress allowlist (it runs with CAP_NET_ADMIN/SYS_ADMIN, which the API lacks).
internal
adapter/httpapi Package httpapi is the HTTP driving adapter: it maps routes to use case services.	Package httpapi is the HTTP driving adapter: it maps routes to use case services.
adapter/mcpserver Package mcpserver exposes Synapse's agent tool catalog to external AI clients over the Model Context Protocol.	Package mcpserver exposes Synapse's agent tool catalog to external AI clients over the Model Context Protocol.
domain/advisory Package advisory is the OWNED vulnerability-advisory matching brain: it decides whether a component version is affected by an advisory's version ranges WITHOUT querying a third-party service (OSV.dev / Grype), so detection does not depend on any one external matcher.	Package advisory is the OWNED vulnerability-advisory matching brain: it decides whether a component version is affected by an advisory's version ranges WITHOUT querying a third-party service (OSV.dev / Grype), so detection does not depend on any one external matcher.
domain/agent Package agent holds the pure domain types for AI orchestration: the LLM conversation values (messages, tool-calls, usage) and the orchestration state (session, proposed action, risk class, approval decision).	Package agent holds the pure domain types for AI orchestration: the LLM conversation values (messages, tool-calls, usage) and the orchestration state (session, proposed action, risk class, approval decision).
domain/audit Package audit makes the audit trail tamper-evident: each entry's Hash covers its content AND the previous entry's Hash, exactly like the evidence chain (golden rule 6).	Package audit makes the audit trail tamper-evident: each entry's Hash covers its content AND the previous entry's Hash, exactly like the evidence chain (golden rule 6).
domain/aup Package aup models acceptance of the Acceptable-Use Policy.	Package aup models acceptance of the Acceptable-Use Policy.
domain/callgraph Package callgraph is the deterministic call-graph domain model (Tier-2 shared foundation): a directed graph of function-call edges plus the entrypoints reachability is measured from, and the pure query primitives over it.	Package callgraph is the deterministic call-graph domain model (Tier-2 shared foundation): a directed graph of function-call edges plus the entrypoints reachability is measured from, and the pure query primitives over it.
domain/compliance Package compliance maps a finding's CWE to the regulatory/standard controls it bears on (compliance mapping).	Package compliance maps a finding's CWE to the regulatory/standard controls it bears on (compliance mapping).
domain/distro Package distro captures the operating-system distribution of a scanned target (from its OS packages) and flags releases that are past End-of-Life – i.e.	Package distro captures the operating-system distribution of a scanned target (from its OS packages) and flags releases that are past End-of-Life – i.e.
domain/engagement Package engagement is the aggregate root for a security-testing project: its scope, legal authorization window, and lifecycle status.	Package engagement is the aggregate root for a security-testing project: its scope, legal authorization window, and lifecycle status.
domain/evidence Package evidence models tamper-evident, hash-chained records of what an engagement produced (scans, findings, reports).	Package evidence models tamper-evident, hash-chained records of what an engagement produced (scans, findings, reports).
domain/finding Package finding models a confirmed or candidate security issue in an engagement.	Package finding models a confirmed or candidate security issue in an engagement.
domain/hotspot Package hotspot models Project-scoped Security Hotspot projections.	Package hotspot models Project-scoped Security Hotspot projections.
domain/ignore Package ignore models a repo-committed, declarative finding-suppression policy: the accepted-risk decisions a team version-controls alongside its code – Synapse's take on Trivy's .trivyignore, made governance-first.	Package ignore models a repo-committed, declarative finding-suppression policy: the accepted-risk decisions a team version-controls alongside its code – Synapse's take on Trivy's .trivyignore, made governance-first.
domain/importedsbom Package importedsbom models a client-supplied SBOM attached to an engagement.	Package importedsbom models a client-supplied SBOM attached to an engagement.
domain/issue Package issue models Project-scoped code-quality issue projections and their triage lifecycle (open / accepted / false-positive / won't-fix).	Package issue models Project-scoped code-quality issue projections and their triage lifecycle (open / accepted / false-positive / won't-fix).
domain/judgment Package judgment is the AI "analysis brain" primitive: a propose→verify→confirm CLAIM about a subject (a finding, component, vulnerability, or the engagement), evidence-gated and hash-chainable, that generalizes the exploitation gate.	Package judgment is the AI "analysis brain" primitive: a propose→verify→confirm CLAIM about a subject (a finding, component, vulnerability, or the engagement), evidence-gated and hash-chainable, that generalizes the exploitation gate.
domain/measure Package measure holds numeric, non-finding project measures (code size, complexity, duplication, coverage).	Package measure holds numeric, non-finding project measures (code size, complexity, duplication, coverage).
domain/project Package project is the aggregate root for a long-lived code-quality project.	Package project is the aggregate root for a long-lived code-quality project.
domain/projectanalysis Package projectanalysis models immutable, tenant-scoped Project analysis snapshots.	Package projectanalysis models immutable, tenant-scoped Project analysis snapshots.
domain/qualitygate Package qualitygate is the deterministic pass/fail gate over a codebase's measured metrics – the "Clean as You Code" quality gate.	Package qualitygate is the deterministic pass/fail gate over a codebase's measured metrics – the "Clean as You Code" quality gate.
domain/qualityprofile Package qualityprofile models named, per-language rule sets — the industry-standard "Quality Profile".	Package qualityprofile models named, per-language rule sets — the industry-standard "Quality Profile".
domain/rating Package rating turns findings + size measures into deterministic project health grades (A-E) and a technical-debt estimate, the counterpart on the code-quality side to risk priority on the security side.	Package rating turns findings + size measures into deterministic project health grades (A-E) and a technical-debt estimate, the counterpart on the code-quality side to risk priority on the security side.
domain/recon Package recon holds the domain types for reconnaissance runs.	Package recon holds the domain types for reconnaissance runs.
domain/rule
domain/sbom Package sbom models a Software Bill of Materials and its components/licenses.	Package sbom models a Software Bill of Materials and its components/licenses.
domain/shared Package shared holds value objects and errors common to all domain packages.	Package shared holds value objects and errors common to all domain packages.
domain/taint Package taint is the deterministic taint-analysis domain model: a data-flow graph from untrusted SOURCES to dangerous SINKS, with SANITIZER nodes that neutralize a flow, plus the pure query that reports an injection – a source→sink path that crosses no sanitizer.	Package taint is the deterministic taint-analysis domain model: a data-flow graph from untrusted SOURCES to dangerous SINKS, with SANITIZER nodes that neutralize a flow, plus the pure query that reports an injection – a source→sink path that crosses no sanitizer.
domain/threatmodel Package threatmodel is the architecture-input model that threat modeling reasons over: a data-flow diagram – components (processes, data stores, external entities), directed data flows between them, trust boundaries that partition them by trust level, and the assets at stake.	Package threatmodel is the architecture-input model that threat modeling reasons over: a data-flow diagram – components (processes, data stores, external entities), directed data flows between them, trust boundaries that partition them by trust level, and the assets at stake.
domain/user Package user models operator identities: each consultant is a distinct user with their own API key, so every action – comments, findings, assignments, audit, evidence – is attributable to a real person, not a shared "operator".	Package user models operator identities: each consultant is a distinct user with their own API key, so every action – comments, findings, assignments, audit, evidence – is attributable to a real person, not a shared "operator".
domain/verdict Package verdict is the shared adversarial-verdict value type + evidence bar used by BOTH finding (exploitation) and judgment (AI analysis).	Package verdict is the shared adversarial-verdict value type + evidence bar used by BOTH finding (exploitation) and judgment (AI analysis).
domain/vex Package vex holds the OpenVEX domain vocabulary (the closed justification enum, shared by the VEX export and the AI vex-justification judgment) AND the consume-side parser + product-to-finding matcher (document.go: Parse, Statement.Suppresses, Statement.MatchesFinding) shared by the post-scan VEX apply and the in-scan .vex consumer.	Package vex holds the OpenVEX domain vocabulary (the closed justification enum, shared by the VEX export and the AI vex-justification judgment) AND the consume-side parser + product-to-finding matcher (document.go: Parse, Statement.Suppresses, Statement.MatchesFinding) shared by the post-scan VEX apply and the in-scan .vex consumer.