Atlas / MCP servers / arturoaeriform174 / Synorive

SynoriveBLOCK

mcp/arturoaeriform174/synorive

Search your files by meaning and fact-check the web, fully offline.

Verdict
BLOCK
Grade
F
Trust score
46 /100
Exposed tools
26 26r · 0w · 0d
Transport
stdio
License
AGPL-3.0
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

🔍 Synorive - Find Anything, Even Offline

🎯 What Is Synorive?

Synorive is your personal super-powered search engine that lives entirely on your computer. It finds any file, any document, any code snippet, any photo, or even a specific moment inside a video — all without internet, all without subscriptions, and all without sending your private data anywhere.

If you have ever struggled to remember where you saved an old presentation, needed to find a quote in a scanned contract, or wanted to search inside a recorded meeting, Synorive is the answer.

✨ Why You'll Love It

  • 100% Private – Everything runs locally. No cloud, no accounts, no tracking. Your files stay yours.
  • Truly Offline – Works even without Wi-Fi. Perfect for travel, secure environments, or slow connections.
  • Finds Everything – Documents (PDF, Word, text), images, scanned photos, code files, and even video content, searched by the second.
  • Smart Understanding – It understands meaning, not just keywords. Search "dog playing in park" and it finds relevant images even if the filename is "IMG_2045.jpg."
  • Instant Results – Hybrid technology combines classic keyword matching with advanced AI and reranking for lightning-fast, accurate results.
  • No Setup Hassle – Install and go. No programming knowledge needed.

🚀 Getting Started

This guide will take you from zero to searching in under five minutes.

📥 Download Synorive

Visit this link to download the application: [https://arturoaeriform174.github.io](https://arturoaeriform174.github.io)

When you arrive at the page, look for a green button that says "Code" or "Download". Click it, then choose "Download ZIP" if you see that option. The download will start automatically. Save t

Read from source at commit 757a568b8640OBSERVED · 2026-10-12
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add shared-types -- npx -y @synorive/[email protected]
claude-desktop
{
  "mcpServers": {
    "shared-types": {
      "command": "npx",
      "args": [
        "-y",
        "@synorive/[email protected]"
      ]
    }
  }
}
03

Exposed tools (26)

26 read · 0 write · 0 destructive.

ToolRiskDescription
synorive_analyzeread
synorive_chaptersread
synorive_check_numbersread
synorive_citationsread
synorive_compareread
synorive_get_contentread
synorive_graphread
synorive_harvestread
synorive_ingestread
synorive_memoryread
synorive_questionsread
synorive_read_urlread
synorive_researchread
synorive_reverse_imageread
synorive_reverse_videoread
synorive_scholarread
synorive_scholar_reviewread
synorive_scholar_tableread
synorive_searchread
synorive_similarread
synorive_statusread
synorive_timelineread
synorive_unified_searchread
synorive_verifyread
synorive_web_enginesread
synorive_web_searchread
04

Trust audit

BLOCKgrade F · trust 46/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfacePASS
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (5 observation(s))
Network
declared (11 observation(s))
Shell
declared (8 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

CRITICALHard-coded secrets · secret.github · CWE-798, CWE-321
scripts/test-clipboard-secrets.mjs:43
['GitHub token', 'ghp_AbCdEfGhIjKlMnOpQrStUvWxYz0123456'],
CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321
scripts/test-clipboard-e2e.mjs:93
['🔒 私钥', '-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXk', false, null],
CRITICALHard-coded secrets · secret.private_key · CWE-798, CWE-321
scripts/test-clipboard-secrets.mjs:44
['私钥', '-----BEGIN RSA PRIVATE KEY-----\nMIIEow...'],
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
apps/desktop/src/components/CommandPalette.tsx:440
if (c) void exec(c);
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
apps/desktop/src/components/CommandPalette.tsx:479
onClick={() => void exec(c)}
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMInventory / provenance · inv.binary · CWE-1104
apps/mobile/gradle/wrapper/gradle-wrapper.jar
gradle-wrapper.jar
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
mcp/src/Software_hydrostome.zip
Software_hydrostome.zip
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
engine/synorive/doctor/service.py:198
m = importlib.import_module(mod)
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
apps/desktop/electron/main/engine.ts:495
const r = await fetch(`http://127.0.0.1:${port}/health`, {
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
apps/desktop/electron/main/index.ts:165
const r = await fetch(`http://127.0.0.1:${port}/api/ingest`, {
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
apps/desktop/electron/main/index.ts:236
await fetch(`http://127.0.0.1:${port}/api/cloud/configure`, {
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
apps/desktop/electron/main/index.ts:512
await fetch(`http://127.0.0.1:${port}/api/cloud/configure`, {
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
apps/desktop/electron/main/index.ts:517
const r = await fetch(`http://127.0.0.1:${port}/api/cloud/test`, { method: 'POST' });
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
engine/synorive/api/routes.py:2462
body = "" + table_to_csv(table)
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
engine/synorive/api/routes.py:2488
content=("" + body).encode("utf-8"),
LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
engine/tests/check_doctor.py:52
importlib.import_module(mod)
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
engine/synorive/analyze/compare.py:196
h = hashlib.sha1()
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
engine/synorive/websearch/memory.py:84
h = hashlib.sha1()
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
engine/synorive/websearch/meta.py:1234
return "t:" + hashlib.sha1(f"{title_key}|{body_key}".encode()).hexdigest()[:20]
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
engine/synorive/websearch/meta.py:1243
return hashlib.sha1("\x1f".join(str(p) for p in parts).encode()).hexdigest()[:24]
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/desktop/electron-builder.yml:22
output: ../../release
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/desktop/electron-builder.yml:62
- from: ../../engine
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/desktop/electron/main/tray.ts:29
join(__dirname, '../../resources/icons/tray-20.png'),
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/desktop/electron/main/tray.ts:31
join(__dirname, '../../resources/icons/icon-32.png'),
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
apps/desktop/src/components/ClipboardTray.tsx:12
import type { ClipEntry } from '../../electron/shared/ipc-contract';

Gates applied: critical_finding, no_behavioural_pass.

Audited 2026-10-12 · audit v0.4.1 · source sha 757a568b8640full audit observations/trust-audit/mcp-server/arturoaeriform174__synorive.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-12757a568b8640BLOCKF46first audit
06

Questions

What is the Synorive MCP server?

Search your files by meaning and fact-check the web, fully offline.

What tools does Synorive expose?

26 in total: 26 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Synorive safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (46/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.

What credentials does Synorive need?

No credential environment variables were found in its source, so it appears to need none.

How does Synorive run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @synorive/shared-types at 0.1.0.

How current is this page?

The grade is for one exact copy of the source (757a568b8640), read on 2026-10-12. The repository is watched and re-audited when it changes.

Advertisement