Syncio

Build on Syncio

Everything you can click, you can automate.

Add an SDK to see inside your application. Create scoped tokens to reach the API. Connect your own assistant over MCP. All of it with the same permissions you have in the dashboard.

Read the docsCompare plans

An API for everything in the app.

Organizations, projects, servers, scans, findings, incidents, forecasts, alerts and reports — the same operations the dashboard uses, with tokens scoped per project.

  • Versioned, with pagination, idempotency keys and signed webhooks.
  • Rate limits per token and per plan, stated up front.
  • Reference generated from the same schemas the server validates with.

Tokens that can only do what you say.

Create a token inside a project for a server, an SDK, the API or an assistant. Each has limited permissions and an expiry you choose.

  • Show the secret once; only a hash is stored.
  • Recognisable prefixes, so a leaked key is easy to spot and revoke.
  • Rotation with an overlap window, and a revoke that takes effect at once.

Your assistant, with eyes on production.Beta

Connect your own AI assistant or agent to your Syncio data, so it can see health, incidents, findings and history — and know what needs doing.

  • Read-only by default, scoped to a project or an organization.
  • It sees health, jams, misses, incidents, findings, forecasts and next steps.
  • Actions it requests become approval requests a human approves in the app.
  1. 01

    Create an MCP token in a project.

  2. 02

    Add the connection URL to your assistant.

  3. 03

    Ask it what changed, or what to fix first.

The tools you already run.

Send alerts and approvals where the work already happens, and link deploys to the changes they caused.

  • Slack
  • Discord
  • Telegram
  • Microsoft Teams
  • PagerDuty
  • Opsgenie
  • GitHub
  • GitLab
  • Jira
  • Linear
  • Webhooks

SDKs, by language.

Add a small library to your application and see errors with context, slow endpoints, failed background jobs and the deploy that lined up with each problem. Each language shows where it stands today.

  • Node.js and TypeScriptnpm / pnpm / yarnBeta
  • Pythonpip / uv / poetryBeta
  • GoGo modulesComing Soon
  • JavaMaven / GradleComing Soon
  • KotlinGradleComing Soon
  • RustCargoComing Soon
  • C# and .NETNuGetComing Soon
  • PHPComposerComing Soon
  • RubyRubyGemsComing Soon
  • ElixirHexComing Soon
  • Dart and Flutterpub.devComing Soon
  • SwiftSwift Package ManagerComing Soon
  • C and C++CMake / vcpkg / ConanComing Soon
  • Browser JavaScriptnpm / script tagComing Soon

Need another language? Ask us and we will weigh it against what is already in progress.

Push events into your own tools.

Every event can reach a signed webhook: incidents, findings, scan results, receipts and usage. Each is signed over a timestamp and the body, with a replay window.

Read the docsTalk to us

How the API is shaped.

One resource tree, one auth model, one style of error. Learn it once and every endpoint behaves the same way.

Resources nest
An organization holds projects, a project holds servers, tokens and alerts. A path reads the way the tree does: /v1/projects/:id/servers.
Every call is scoped
A token carries the permissions of the project it was minted in. There is no way to reach outside it, by design.
Lists paginate the same way
Cursor pagination on every list endpoint, with a stable order and a limit you choose. The next page is always one field away.
Writes are idempotent
Send an idempotency key and a retried request never runs twice. This is what makes the API safe to call from a retry loop.
Errors are structured
A machine-readable code, a human sentence and the field it concerns. The same shape for a 404 and a 422.
Webhooks are signed
Each event is signed over a timestamp and the body, with a replay window, so a receiver can trust what it gets.

Three lines to the first answer.

Install the SDK, mint a token, ask a question. The same token works for the API, the SDK and MCP.

Node.js and TypeScriptts
import { Syncio } from "@syncio/sdk";

const syncio = new Syncio({ token: process.env.SYNCIO_TOKEN });

// The score, and the reasons behind it.
const health = await syncio.projects.health("prj_7f2");

// Every server in the project, newest first.
const servers = await syncio.projects.servers("prj_7f2", { limit: 20 });

// Ask a question in plain English.
const answer = await syncio.copilot.ask("what changed before the slowdown?");
MCP connectionjson
{
  "mcpServers": {
    "syncio": {
      "url": "https://api.syncio.live/mcp",
      "headers": { "Authorization": "Bearer $SYNCIO_MCP_TOKEN" }
    }
  }
}

Limits, stated up front.

Rate limits are per token and per plan, returned in the headers of every response so a client can pace itself without guessing.

Read endpoints
Generous by default, with a burst allowance. A dashboard's worth of polling fits inside the standard limit.
Write and approval endpoints
Lower, and counted per project. A change is a deliberate act, not a high-volume call.
Rate-limit headers
Every response carries the limit, the remaining count and the time the window resets.
Backpressure
A 429 says exactly how long to wait. The SDKs honour it and retry once the window opens.