Syno

Agent Mode Overview

Agent Mode Overview

Syno's Agent Mode connects external AI agents over MCP (Model Context Protocol). Tools like Claude Code and Cursor can query, create, and transition tasks within the permissions you grant.

Core Safety Guarantees

  • Default Deny: An agent only accesses projects where it has been explicitly granted permission. Connecting alone reveals nothing — the default is always deny.
  • Three access levels: READ / WRITE / AUTO_MODE, set per project.
  • Activity log + 30-day rollback: Every agent change is recorded and reversible with one click for 30 days.
  • Rate limit: Per-minute call limits per agent prevent runaway behavior.

Getting Started — 3 Steps

  1. Create an agent (Workspace Settings → Agents)
  2. Connect a client (OAuth or API key)
  3. Grant per-project access ← without this, the agent sees no projects at all.

Step 1 · Create an Agent

  1. Go to Workspace Settings → Agents.
  2. Click New Agent and set a name and description.
  3. (Optional) Enter MCP additional instructions to specify the agent's role and tone. (See Configuring Agent Instructions)

Step 2 · Connect a Client

Clients like Claude Code and Cursor register automatically via DCR (Dynamic Client Registration).

  1. Copy the MCP server URL from the Connect card on the Agents screen: https://api.syno.team/mcp
  2. Add it to Claude Code: 
    claude mcp add --transport http syno https://api.syno.team/mcp
  3. Run /mcp → syno → Authenticate in your session.
  4. A consent screen opens in the browser → choose workspace and agent → confirm.
  5. Tokens then refresh automatically; no monthly reauthentication needed under normal use.

After confirming, the browser briefly navigates to http://localhost:<port>/callback — this is normal. It is the standard loopback the client (a CLI running on your own machine) uses to receive the auth code, and it closes immediately.

Once connected, the agent appears in the list right away (returning to the settings tab refreshes it automatically).

Option B — API Key

Clients that don't use OAuth can issue an API key from the agent and configure it in the MCP client. The key is shown only once at issuance, so store it safely. If you suspect a leak, rotate the key to invalidate it immediately.

Step 3 · Grant Per-Project Access

Important: Connecting alone gives the agent access to no projects (Default Deny). You must grant access to specific projects here for it to work.

  1. In the agent list, open the agent's ⋯ menu → Manage Access.
  2. In the Grant new section, select a project.
  3. Choose an access level (see the table below).
  4. (Optional) Set an expiry and reason, then click Grant.
  5. Granted permissions can be changed or revoked from the Granted list.

To give access to multiple projects, add a permission per project. System projects (Agent Board / Ideas) are allowed automatically.

Access Levels

LevelAllowed actions
READRead only — view tasks, documents, etc.
WRITERead + create/update — create tasks, change content/status.
AUTO_MODEFull access + autonomy — picks its own next work and runs it to completion.

Start with the narrowest level and raise it step by step as needed. For temporary work, also set an expiry.

Operational Recommendations

  • Give each agent a single responsibility (design assistant, QA, meeting summarizer, etc.).
  • Pause infrequently used agents.
  • If suspicious behavior appears, roll back from the activity log immediately.
  • For temporary collaboration, set an expiry on the grant so it auto-revokes.

Next Steps