Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add commands/synapsor/synapsor-runner/synapsor-protectgit clone --depth 1 https://github.com/Synapsor/Synapsor-RunnerWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00021 | $0.00528 |
| Opus 5 | $0.00010 | $0.00264 |
| Sonnet 5 | $0.00004 | $0.00106 |
| Haiku 4.5 | $0.00002 | $0.00053 |
Grade A, and why
synapsor-protect scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Protect one application data action
Turn the developer's requested business action into one disabled, deterministic Synapsor Safe Action. This command drafts authority for human review; it never activates an action or approves, applies, commits, or reverts source data.
-
Ask for the action name and one-sentence intended business effect if they are not already explicit. Work on one action only.
-
Confirm that
synapsor.runner.jsonexists. If it does not, stop and direct the developer to the Runner own-database onboarding. Do not invent source, tenant, principal, credential, or writeback authority. -
Inspect project schema/ORM/OpenAPI/test files and the reviewed Runner config. Never print environment-variable values, connect to an unapproved database, execute project code for discovery, or treat names as security authority.
-
Run the pinned Runner scaffold with a shell-safe action identifier and the developer's exact intent:
npx -y @synapsor/[email protected] start --action <action_name> --description "<reviewed intent>" -
Read
synapsor/SAFE_ACTION_AGENT.mdand follow it as the canonical safety instruction source. Edit only the generated file undersynapsor/actions/. Keep the action concise and preserve every unresolved authority question until the developer supplies a reviewed answer. -
Run the project formatter for the action file, then run:
npx -y @synapsor/[email protected] action validate <generated-action.ts> --json -
Fix deterministic diagnostics without weakening tenant/principal scope, visibility, bounds, conflict handling, approval, or executor authority.
-
Report the disabled draft digest, exact generated tests, pending live tests, and unresolved authority. Do not claim the action is active.
-
Tell the developer to open the secured localhost Workbench personally, run the non-mutating staging preview, review the exact Data PR and digest, and activate it there. There is intentionally no
action activateCLI or MCP tool.
Never modify .synapsor/active, the active contract reference, Cursor MCP
configuration, runtime credentials, approval identity, or source data. Never
add raw SQL, generic database tools, model-visible approval/apply tools, or a
command that bypasses the Workbench confirmation.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 46 lines · 21 tokens per session scan A fa96e39f83a1
synapsor-protect is a command published in the GitHub repository Synapsor/Synapsor-Runner (2 stars, last pushed 5d ago), licensed Apache-2.0. It adds 21 tokens to every session and 528 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other commands, from other repositories
validate-dependencies
Validate all task dependencies for issues.
flow-nexus-neural
Train and deploy neural networks in distributed sandboxes.
flow-nexus-auth
Flow Nexus authentication and user management.
validate-prd
Validate an existing PRD against BMAD standards - comprehensive review for completeness, clarity, and quality.
editorial-review-structure
Structural editor that proposes cuts, reorganization, and simplification while preserving comprehension.
add-tool
Scaffold a new FreeAgent MCP tool (handler + registration + test) following the repo pattern.