# Claude Code

The Synthient plugin for Claude Code: the [MCP server](https://docs.synthient.com/ai/mcp) for data, and six skills for the judgment the tools cannot carry.

It knows how to read a lookup, how to wire one into a codebase without blocking Googlebot, and how to move off another vendor without quietly changing who gets blocked.

> **Note**: The plugin is open source at [github.com/synthient/plugins](https://github.com/synthient/plugins). It needs the CLI on your `PATH`, since the MCP server ships inside it: `brew install synthient/tap/synthient`.

## Install

Add the Synthient marketplace, then install the plugin:

```txt
/plugin marketplace add synthient/plugins
/plugin install synthient@synthient
```

Claude Code prompts for an API key when the plugin is enabled. Leaving that blank is fine. The bundled MCP server falls back to the CLI's own credential chain: `SYNTHIENT_API_KEY`, a `.env` in the working directory, then the OS keychain populated by `synthient auth`. Get a key from the dashboard at [synthient.com](https://synthient.com).

```bash
synthient auth
```

Confirm everything resolved with `/synthient:doctor`, which walks the CLI install, the active credential source, the granted scopes, remaining credits, and MCP connectivity, stopping at the first failure.

## Skills

Installing the plugin registers the MCP server and six skills:

| Skill                  | Purpose                                                                                           |
| ---------------------- | ------------------------------------------------------------------------------------------------- |
| `/synthient:docs`      | API reference: auth, response shape, field vocabularies, credits, rate limits, errors             |
| `/synthient:integrate` | Wire Synthient into the current codebase, with fail-open handling and the benign-automation guard |
| `/synthient:migrate`   | Move off Spur, IPQualityScore, or another vendor: audit, map, report, rewrite, verify             |
| `/synthient:triage`    | Investigate an address, a list, or a domain and return a reasoned verdict                         |
| `/synthient:feeds`     | Parquet snapshots, filtered stream capture, CSV export, local analysis                            |
| `/synthient:doctor`    | Diagnose credentials, scopes, credits, and MCP connectivity                                       |

Claude loads these on its own when the context calls for it: a Synthient field name in a diff, a `403` from `api.synthient.com`, an ask to check an address. The slash commands are for when you want one specifically.

## Migrating from another vendor

```txt
/synthient:migrate spur
```

Also takes `ipqs`, or any other vendor name. A read-only subagent audits every call site first, and the report lands before anything is rewritten.

That report leads with semantic changes rather than renamed fields, because those are what break quietly: a ported `fraud_score` threshold that shifts who gets blocked, a `client.count` that now counts distinct device signatures rather than concurrent clients, an operator-name string comparison that stops matching and so returns clean for everything. Vendors without a published guide go through a derived mapping, marked as inferred.

See [Migrating from Spur](https://docs.synthient.com/migration/spur) and [Migrating from IPQualityScore](https://docs.synthient.com/migration/ipqs) for the mappings it works from.

## What it adds over the tools

The [MCP tools](https://docs.synthient.com/ai/mcp) return data. They carry no judgment, and several capabilities have no tool at all.

The skills supply the judgment: that nine of the `intelligence.categories` values are benign automation, where blocking takes out Googlebot and Stripe webhooks; that `network.type` is a network classification and not a proxy verdict; that [`risk_score`](https://docs.synthient.com/guides/risk) is a summary rather than a verdict; that Helios honeypot timestamps are milliseconds while everything else is seconds; that an empty `providers[]` is not a clean bill of health; that [rate limits](https://docs.synthient.com/rate-limits) are per team, so a second key does not double throughput.

They also reach what the tools cannot: Parquet downloads with checksum verification, filtered and long-running stream capture, CSV export, and `status` / `scopes` diagnostics. Reference detail is fetched live from these docs rather than vendored, so it does not go stale.