Verify Everything. Trust Nothing.

A governed control plane for the whole security-assessment lifecycle — supply chain, code, cloud, offensive, and runtime defense.

Turn a fragmented, manual security process into one controlled, auditable workflow: SCA, SAST, secret and IaC scanning, reachability, recon and governed exploitation, cloud posture, and a distributed blue-team agent fleet — all behind server-side scope enforcement, hardened tool execution, tamper-evident evidence, and deterministic reports.

Landing page · Documentation · Quickstart · Features · Configuration

• ✅ Deterministic first. Scanning, matching, and reporting are pure, reproducible Go. No model sits in the report path.
• ✅ Evidence you can trust. Every artifact is hash-chained into a tamper-evident custody record. A broken chain blocks the report.
• ✅ One platform, every angle. Supply chain, code, cloud, offensive, and runtime defense behind a single gate.
• ✅ Reachability aware. A deterministic call graph decides whether a vulnerable symbol is actually reachable from your code.
• ✅ Detection independent. Owns its SBOM parsers and advisory matching, and ingests OSV, GHSA, CSAF and OVAL.
• ✅ A detection is evidence, not an alert. Runtime detections are attributable, hash-chained, and joined to the same asset, finding, and attack path the static pillars reason about.
• ✅ CI ready. synapse-cli is a single static binary that gates a build and emits SARIF for code scanning.
• ✅ Safe by construction. argv-only execution in a Linux sandbox, server-side scope and authorization before any tool runs, secrets never leave the server.

Synapse runs the whole security-assessment lifecycle behind one governed control plane, across both point-in-time analysis (SCA, SAST, code quality, IaC) and runtime analysis (a distributed agent fleet, eBPF detections, response actions), over container and VM estates, with a single asset model, one authorization model, one hash-chained evidence chain, and one prioritized queue.

It is deterministic-first. Scanning, matching, license classification, scoring, and reporting are pure, reproducible Go with nothing else in the path. Where automated analysis is offered it stays strictly bounded: a proposal is only ever proposed, a typed Go state machine validates and executes, scope and authorization are checked in the execution layer, secrets never leave the server, every artifact is hash-chained into a tamper-evident custody record, and a human approves anything intrusive.

Software supply chain

• SBOM generation across many ecosystems (npm, PyPI, Maven, Gradle, Go, Cargo, RubyGems, Composer, NuGet, Hex, Dart, pnpm, Poetry, yarn and more) with owned per-ecosystem lockfile parsers.
• Vulnerability detection from a live advisory API and an offline database, cross-correlated and de-duplicated, plus an owned advisory store that ingests OSV, GHSA, CSAF and OVAL for detection independence.
• Risk-based prioritization ordered by exploitability (CISA KEV, then EPSS, then CVSS), never by raw CVSS alone.
• License compliance: declared-license resolution, SPDX expression parsing, a curated category and risk model, and coordinate recovery for shaded or metadata-less JARs.
• Reachability: a deterministic call-graph engine (Go, plus JVM and JS/TS tiers) decides whether a vulnerable symbol is actually reachable from application code.

Code & configuration

• First-party SAST with source-code rules across many languages, plus a taint engine over the sandboxed call graph.
• Secret scanning and IaC misconfiguration (Terraform, CloudFormation, ARM, Kubernetes, Helm, Dockerfile, Compose).
• Code quality rules, quality gates and profiles, and third-party SARIF ingest into the same governance path.

Offensive

• Recon in a hardened sandbox, an attack-path graph over the asset inventory, chained exploitation with per-step proof, and adversary emulation with expected-detection output — all gated by a written offensive policy and a kill switch.
• DAST: authenticated crawling and a first-party check corpus with sessions from the credential vault.

Runtime defense (blue team)

• A distributed agent fleet (host and Kubernetes cluster inventory, coverage/freshness, signed packaging and updates) with certificate enrolment and fenced leadership.
• An eBPF detection engine, detections sealed as hash-chained evidence, a columnar telemetry tier with retention, governed response actions (same admission + evidence as exploitation), and purple-team coverage measured from emulation-expected vs actually-fired.

Cloud posture (CSPM)

• Read-only AWS, Azure and GCP posture connectors behind a sandboxed helper, with vault-ref credentials over an inherited FD, per-operation server-side authorization, and IaC-vs-live drift findings.

Governance & evidence

• Tamper-evident evidence: every artifact is hash-chained (RFC-3161 anchored); a broken chain blocks the report. Audit and evidence logs are append-only.
• Hardened execution: tools run via argv arrays inside a Linux sandbox with egress scoping; scope and the authorization window are enforced before any tool runs.
• RBAC, tenant isolation (Postgres RLS), and separation of duties through a single authorization chokepoint.
• The Judgment primitive: every AI/analysis claim is propose → verify → confirm; gated capabilities promote only on a distinct verifier's sealed verdict.

AI analysis (optional, bounded)

• AI false-positive triage grounded in deterministic evidence citations, with provider-independent proposer/verifier separation of duties, budgets, circuit breakers, observability, and a fail-closed adversarial counterfactual gate for model/prompt promotion.
• The agent proposes; a distinct verifier or a human confirms. No model ever sits in the report path.

Standards & reports

• Standards native: CycloneDX and SPDX with PURL, SARIF and OpenVEX exports; CSAF advisory ingestion; KEV and EPSS prioritization.
• Deterministic reports templated from stored data, with a curated CWE → OWASP, PCI and ISO compliance mapping.

See the full walkthrough with screenshots on the documentation site.

Detection is at parity with the popular scanners, and sometimes ahead. On one representative real-world repository, Synapse reported 261 unique CVEs to Trivy's 239 (235 in common) and attached a license to 1443 packages to Trivy's 1394. Numbers move with the project, so treat these as illustrative rather than a benchmark claim.

The lasting difference is what sits around the finding:

• Go 1.26 (pinned in go.mod), Node and pnpm (use pnpm, not npm or yarn).
• Syft (required for any scan) and Grype (optional, adds the offline database). make tools installs both, pinned and checksum-verified, into ./bin.
• Docker is optional and is the easiest way to run the full stack.
• The hardened sandbox and live recon need a Linux host. Without them the API still runs (SCA, findings, reports); sandboxed execution fails closed rather than running unsandboxed.

Grab a prebuilt binary from the Releases page (Linux and macOS on amd64/arm64, and Windows on amd64) and verify it against checksums.txt. Each archive bundles the packaged commands.

# Example: linux/amd64
curl -fsSL -o synapse.tar.gz \
  https://github.com/KKloudTarus/synapse-ce/releases/latest/download/synapse-ce_<version>_linux_amd64.tar.gz
tar -xzf synapse.tar.gz synapse-cli
./synapse-cli scan ./path/to/project --fail-on high

Or scan with zero install using the container image (bundles synapse-cli plus syft and grype):

Container images are not published by the current release workflow. Use a release archive or build deploy/Dockerfile locally when a containerized CLI is required.

Gate a repository in CI with the reusable action (see docs/guide/cli.md):

- uses: KKloudTarus/synapse-ce@v1
  with:
    fail-on: high

docker compose -f deploy/docker-compose.full.yml up --build
# then open http://localhost:5173

make install                       # Go modules + web deps
make tools                         # syft + grype into ./bin
export PATH="$PWD/bin:$PATH"

export SYNAPSE_API_TOKEN="$(openssl rand -hex 32)"   # required for operational API routes; /healthz and /readyz are public
make dev                           # API on :8080, dashboard on :5173

Open http://localhost:5173, paste the token, accept the Acceptable Use Policy. A blank SYNAPSE_DB_DSN runs an in-memory dev store, so nothing is persisted. Migrations are embedded and applied automatically at startup.

synapse-cli runs the same pipeline as the server, ideal for CI gating.

make build
./bin/synapse-cli scan ./path/to/project --fail-on high

The exit code is 0 when no finding meets the threshold, non-zero otherwise.

Clean architecture with a strict, inward-only dependency rule:

domain  <-  usecase  <-  adapter / infrastructure

All external I/O (database, tools, storage, sandbox) goes through ports, which are interfaces in internal/usecase/ports. cmd/* is the composition root, with dependency injection in main and no business logic.

Synapse reads its configuration from the process environment. Copy .env.example and adjust. The only required variable in development is SYNAPSE_API_TOKEN. In production, SYNAPSE_MEASURE_CURSOR_SECRET is also required (generated via openssl rand -hex 32). See the configuration reference for the full list.

Full documentation lives in docs/guide/: introduction, installation, quickstart, features, configuration, CLI, architecture, deployment, and the security model. See CHANGELOG.md for what has changed.

Synapse is under active development. The current roadmap extends the shipped platform rather than introducing new pillars:

• Broader deterministic rule and ecosystem coverage beyond the current Go, JavaScript/TypeScript, Python, Java/JVM, .NET, Rust, Ruby, PHP, Swift, Dart, Elixir, Conda, R, Julia, and Conan coverage.
• Deeper language-aware reachability and taint analysis, with conservative handling for dynamic code.
• More model-free compliance profiles and ready-to-run CI, fleet, and deployment recipes.
• Continued hardening of sandbox, supply-chain, evidence, and agent-update boundaries.

Have a request? Open an issue or start a discussion. Issues tagged good first issue and help wanted are a good place to start.

Synapse is built by its founding team and contributors.

	Member	Role
	nghiadaulau	Founder
	nnatuan03	Co-founder
	pho-veteran	Lead maintainer
	VietSory	Engineer
	lethanhsang188	Engineer
	tuu-ngo	Brand identity designer
	H1eu232	AI engineer (contributor)
	XUanhoa04	AI engineer (contributor)
	thx2an	AI engineer (contributor)

Contributions are welcome. See CONTRIBUTING.md, the Code of Conduct, and report vulnerabilities per the Security Policy.

Licensed under the Apache License 2.0.