What is Synkro?A package manager for agents, with Rules for using your software.Getting startedQuickstartLet your agent set up Synkro, create your first Rule, and verify an action.Getting startedSetup checklistCheck your account, installation, repository, and first agent decision.SetupInstall and verifyInstall the CLI, sign in, and connect your agent.SetupSet up your agentConnect your agent and verify its first tool call.SetupVerify a decisionFind the recorded decision for an agent action.SetupYour first decisionRead your first agent decision and test a Rule.SetupHow Synkro worksUnderstand how Synkro applies Rules and records agent decisions.Core conceptsRules and ControlsChoose repository Rules for actions and Controls for access restrictions.Core conceptsRule outcomesUnderstand when an action continues, needs approval, or must be changed.Core conceptsRulesAdd, test, update, and remove the Rules used by your repository.GuidesEventsFind recorded agent actions and decisions with the Synkro CLI.GuidesApprove MCP toolsChoose project approvals and package defaults for MCP tools.GuidesConsentReview and approve an agent action before it runs.GuidesFeedbackReport a Synkro bug or suggest an improvement with diagnostic context.GuidesBilling and usageAdd funds and check your organization's balance and usage.GuidesGitHubConnect GitHub to discover Rules from private repositories.IntegrationsCLI commandsFind the current commands for setup, Rules, events, account, and recovery.ReferenceSupported agentsFind the installed Synkro files and the checks that apply to each agent.ReferenceTroubleshootingFix setup, sign-in, missing decisions, Rule, and approval problems.Reference
Documentation
Guides

Consent

Review and approve an agent action before it runs.

A Rule with ask pauses an action for your review. Only a human can approve it. The approval applies to that exact action for one retry.

Example Rules:

RuleWhat happens
Ask before deleting files in reports/Synkro pauses the deletion. You can check the exact files, then approve that attempt.
Flag commands that add a dependency, such as pnpm addThe command can run, and Synkro records the match for later review. No approval is needed.
Block edits to generated API clientsThe edit is refused. The agent must update the source schema and regenerate the client.

If an action matches both an ask and a block Rule, the block wins.

Approve in your signed-in session

These steps apply when you signed in to the CLI with synkro login or synkro install. If you connected the agent through synkro onboard, use the owner approval steps below.

  1. Read the exact command or tool action Synkro refused.
  2. Reply allow it in the same agent session.
  3. The agent retries that same action.
  4. The retry uses the approval once.

Approval does not cover a different command, destination, or set of inputs.

Use allow it, not a general "yes". Letter case and trailing punctuation do not matter.

Approve an action after onboarding

For a connection set up through synkro onboard, an organization owner reviews the request and approves it through the authenticated owner API: POST /api/v1/consents/{id}/decision.

The request must name that exact consent ID, harness and stored session ID, with action: "grant" and a non-empty reason. Use the stored session identity, not just the provider's session string. The agent then retries the identical tool call once. Ending its session cancels the request.

Cancel or refuse

In your signed-in session, reply cancel it or deny it to close the pending request without allowing it. For a connection approved through synkro onboard, the human owner uses the same API with action: "cancel" or action: "deny".

A new request replaces an older unapproved one. Read the latest request first.

Time and session limits

Requests and approvals expire after 15 minutes by default.

Approval belongs to the session that requested it. Ending that session clears it.

Headless runs

Cursor CLI --print does not send beforeSubmitPrompt. It cannot grant consent from a prompt containing allow it. Use interactive Cursor CLI with the current Synkro integration; check configuredHarnesses.cursor in synkro status --json and run synkro update if it is false.

codex exec ends its session when the run finishes. That cancels any pending approval. codex exec resume ... "allow it" cannot approve the cancelled request.

For work that needs your approval, keep the agent session open and use the approval steps above before leaving it. In your signed-in interactive codex session, you can reply allow it; a connection approved through synkro onboard requires owner API approval. The same session limit applies to other agents.

What approval cannot do

  • Override a block Rule.
  • Remove the correction required by a fix Rule.
  • Approve unrelated future work.

If approval storage is unavailable, Synkro refuses the action. Check Troubleshooting.

MCP tool approvals are separate

MCP tool approval covers a server/tool coordinate. It is separate from the single-action consent above: allow it and the consent API do not approve an MCP server or change its approval mode.

In observe mode, an unapproved MCP tool receives a notice and may run. In enforce mode, the approval gate blocks it. Project Rules and other controls still apply in both modes, including Rules about the tool's arguments. A notice alone does not establish that the call was refused; inspect its verdict.

synkro status --json reports the mode in health.enforcement.mcpApprovalMode. Signed-out process health has no tenant mode and reports null; a failed configuration read also remains unknown. active describes enforcement readiness, not observe or enforce mode.

Use Approve MCP tools for persistent project declarations, package defaults and revocation. Review the exact server, tool and project before changing them. A limited agent connection's refusal does not authorize replacing its credentials with the owner's credentials.