Manus/multitenant remote mcp audit

[pooyamachine1-ctrl]

No description provided.

[Danialsamadi]

Hello i will take a look at it today, Thanks for your contribution

[Danialsamadi]

Code review

Found 3 issues:

1. The memory_write link-attach loop still uses unscoped repo.get(l.targetId) while every other object-ID path in this PR was switched to repo.getVisible(id, principal.userId, principal.teamIds). Any authenticated principal can probe whether arbitrary memory IDs exist (existence-disclosure oracle) and create cross-tenant graph edges — contradicting this PR's own docs/architecture.md policy that object-ID operations must 404 for objects outside the caller's visibility.

synapse/apps/mcp-server/src/server.ts

Lines 95 to 98 in 65ce047

	// Links attach even on dedup — relating existing knowledge is still useful.
	for (const l of links ?? []) {
	if (repo.get(l.targetId)) repo.addLink(memory.id, l.targetId, l.rel);
	}

2. The /mcp handler constructs a fresh MCP server per HTTP request via createSynapseMcpServer(repo, principal), which unconditionally runs startup side effects at construction: repo.addAudit("startup", ...) and a full runDecay(repo) sweep. The stdio server calls this once per process (with decay on a 24h interval); here every request from every tenant triggers a redundant decay sweep plus an audit row.

synapse/apps/mcp-server/src/remote.ts

Lines 41 to 45 in 65ce047

	app.all("/mcp", async (c) => {
	if (c.req.method !== "POST" && c.req.method !== "GET" && c.req.method !== "DELETE") return c.json({ error: "method_not_allowed" }, 405);
	const principal = c.get("principal");
	const server = createSynapseMcpServer(repo, principal);
	const transport = new WebStandardStreamableHTTPServerTransport({ sessionIdGenerator: undefined, enableJsonResponse: true });

3. Team-scope dedup is dead code: writeMemory reads (input as CreateMemoryInput & { teamIds?: string[] }).teamIds ?? [], but CreateMemoryInput only has a singular teamId and no caller ever sets teamIds, so the expression is always []. Semantic dedup for scope: "team" writes never considers existing team memories. Likely intended input.teamId ? [input.teamId] : [] (or threading the principal's team memberships).

synapse/packages/store/src/write.ts

Lines 62 to 64 in 65ce047

	const candidates = repo
	.listVisible(userId, (input as CreateMemoryInput & { teamIds?: string[] }).teamIds ?? [], { status: "active" })
	.filter((m) => m.type === input.type);

[Danialsamadi]

@pooyamachine1-ctrl
If you explain for me what was the thought process behind the code changes here I would be really happy to discuss about this.