Claude Code
The Synthient plugin for Claude Code: the MCP server for data, and six skills for the judgment the tools cannot carry.
It knows how to read a lookup, how to wire one into a codebase without blocking Googlebot, and how to move off another vendor without quietly changing who gets blocked.
The plugin is open source at github.com/synthient/plugins. It needs the CLI on your PATH, since the MCP server ships inside it: brew install synthient/tap/synthient.
Install
Add the Synthient marketplace, then install the plugin:
/plugin marketplace add synthient/plugins
/plugin install synthient@synthient
Claude Code prompts for an API key when the plugin is enabled. Leaving that blank is fine. The bundled MCP server falls back to the CLI's own credential chain: SYNTHIENT_API_KEY, a .env in the working directory, then the OS keychain populated by synthient auth. Get a key from the dashboard at synthient.com.
synthient auth
Confirm everything resolved with /synthient:doctor, which walks the CLI install, the active credential source, the granted scopes, remaining credits, and MCP connectivity, stopping at the first failure.
Skills
Installing the plugin registers the MCP server and six skills:
| Skill | Purpose |
|---|---|
/synthient:docs | API reference: auth, response shape, field vocabularies, credits, rate limits, errors |
/synthient:integrate | Wire Synthient into the current codebase, with fail-open handling and the benign-automation guard |
/synthient:migrate | Move off Spur, IPQualityScore, or another vendor: audit, map, report, rewrite, verify |
/synthient:triage | Investigate an address, a list, or a domain and return a reasoned verdict |
/synthient:feeds | Parquet snapshots, filtered stream capture, CSV export, local analysis |
/synthient:doctor | Diagnose credentials, scopes, credits, and MCP connectivity |
Claude loads these on its own when the context calls for it: a Synthient field name in a diff, a 403 from api.synthient.com, an ask to check an address. The slash commands are for when you want one specifically.
Migrating from another vendor
/synthient:migrate spur
Also takes ipqs, or any other vendor name. A read-only subagent audits every call site first, and the report lands before anything is rewritten.
That report leads with semantic changes rather than renamed fields, because those are what break quietly: a ported fraud_score threshold that shifts who gets blocked, a client.count that now counts distinct device signatures rather than concurrent clients, an operator-name string comparison that stops matching and so returns clean for everything. Vendors without a published guide go through a derived mapping, marked as inferred.
See Migrating from Spur and Migrating from IPQualityScore for the mappings it works from.
What it adds over the tools
The MCP tools return data. They carry no judgment, and several capabilities have no tool at all.
The skills supply the judgment: that nine of the intelligence.categories values are benign automation, where blocking takes out Googlebot and Stripe webhooks; that network.type is a network classification and not a proxy verdict; that risk_score is a summary rather than a verdict; that Helios honeypot timestamps are milliseconds while everything else is seconds; that an empty providers[] is not a clean bill of health; that rate limits are per team, so a second key does not double throughput.
They also reach what the tools cannot: Parquet downloads with checksum verification, filtered and long-running stream capture, CSV export, and status / scopes diagnostics. Reference detail is fetched live from these docs rather than vendored, so it does not go stale.