Name: SynaMCPs
Author: synamcps

LABSCO SUMMARY

The permission model is the product.

Most memory servers give every client the same tools and trust the prompt to keep them apart. Here the token is the boundary: it can only narrow what its owner already has, administrative tools are hidden from access tokens entirely, and a personal document stays invisible even to someone who can read the storage it sits in. That matters once more than one agent, or more than one person, is pointed at the same store.

What it is

A gateway you run yourself. It stores knowledge items (text, uploaded files, fetched links) with embeddings and search, proxies upstream MCP servers behind the same endpoint, and hands out scoped tokens so tools/list returns a different toolset per caller.

What you get

A dynamic tools/list: a research agent sees only knowledge_search, an authoring agent also sees the write tools
Tokens that narrow rather than widen — the intersection of the owner's ACL and the token's own scopes
Per-document visibility on top of storage access: personal, group or public
admin_token_create, admin_token_list, admin_token_revoke and admin_token_update_scopes to run token lifecycle from the client
admin_acl_grant, admin_acl_revoke, admin_storage_create and admin_storage_archive for access and storage changes
admin_user_list, admin_group_members, admin_group_add_member and admin_group_remove_member for people and groups
admin_mcp_server_list, admin_mcp_server_test and admin_mcp_scope_set to register upstream MCP servers and scope their tools
A web admin console for users, groups, storages, tokens, item ingest, search and service status

Requirements

Your own infrastructure: Postgres, Redis and S3 or MinIO, reached either through the bundled Docker Compose file or by running the Go binary directly (Go 1.23+). Clients connect over Streamable HTTP at /mcp with a bearer token; Claude Desktop connectors additionally need the server published on a public HTTPS host, because the OAuth flow cannot reach localhost.

Setup effort

Build from source — git clone https://github.com/synamcps/synamcps-server.git

See installation options

USE CASES

01

Giving a research agent read-only access to team knowledge

Issue a token scoped to one storage in read mode; that agent's tools/list comes back with search only.

admin_token_createknowledge_search

02

Putting several MCP servers behind one endpoint

Register the upstream servers, check they answer, then decide per token which of their tools are in scope.

admin_mcp_server_listadmin_mcp_server_testadmin_mcp_scope_set

03

Tightening a token that turned out to be too broad

Narrow its storage scopes in place, or revoke it, without touching the owner's own permissions.

admin_token_update_scopesadmin_token_revoke

04

Onboarding a team onto a shared store

Create the storage, grant the group access to it, and add members as people join.

admin_storage_createadmin_acl_grantadmin_group_add_member

05

Retiring a project's knowledge

Archive the storage and revoke the access that pointed at it.

admin_storage_archiveadmin_acl_revoke

22 tools

Listed in project docs. Your client may show a different list.

admin_token_create

admin_token_list

admin_token_get

admin_token_revoke

admin_token_update_scopes

admin_token_update_rate_limit

admin_user_list

admin_user_get

admin_user_disable

admin_group_list

admin_group_members

admin_group_add_member

admin_group_remove_member

admin_acl_list

admin_acl_grant

BEFORE YOU INSTALL

What to know first

Tools you get

22 tools named in the project's documentation. Tools/list shows only tools your bearer token allows; access tokens hide administrative tools, so a normal agent token sees roughly one. Proxied upstream tools appear as {slug}__{upstream_name}.

Requires

Go 1.23+
Postgres, Redis, S3

INSTALLATION

Connect your client

Server setup

TERMINAL

git clone https://github.com/synamcps/synamcps-server.git
cd synamcps-server
cp .env.example .env
make compose-up

Open the Admin UI at http://localhost:8080/admin and create a scoped access token

Point the MCP client at http://localhost:8080/mcp with Authorization: Bearer <YOUR_TOKEN>

MCP Clients

Claude Desktop — OAuth

Deploy SynaMCPs on a public HTTPS URL, with oauth_as.enabled set to true (Anthropic cloud egress cannot reach localhost)

In Claude Desktop: Settings → Connectors → Add custom connector

Paste https://<YOUR_HOST>/mcp (no bearer token), where <YOUR_HOST> is that public HTTPS host

Claude discovers OAuth metadata, registers a public client (DCR), and opens a browser login

Sign in with an internal Syna user/password or a configured OIDC provider

Cursor — bearer token

CURSOR — BEARER TOKEN · JSON

{
  "mcpServers": {
    "synamcps-server": {
      "url": "http://localhost:8080/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

Claude Code — bearer token

CLAUDE CODE — BEARER TOKEN · JSON

{
  "mcpServers": {
    "synamcps-server": {
      "type": "http",
      "url": "http://localhost:8080/mcp",
      "headers": {
        "Authorization": "Bearer <YOUR_TOKEN>"
      }
    }
  }
}

Any MCP client — Admin UI

How: The Admin UI (/admin) includes an MCP Connect page that generates the config file name, a configBody (JSON) and step-by-step instructions

SynaMCPs