---
name: connector
description: "Generic credentialed connector — register a named REST API with a static credential, then make host-bound authenticated requests to it. Admin-driven."
tools:
  - name: connector-register
    publicAllowlist: false
    adminAllowlist: true
    riskClass: write_local
  - name: connector-call
    publicAllowlist: false
    adminAllowlist: true
    riskClass: external
  - name: connector-list
    publicAllowlist: false
    adminAllowlist: true
    riskClass: read
  - name: connector-deregister
    publicAllowlist: false
    adminAllowlist: true
    riskClass: write_local
metadata: {"platform":{"optional":true,"pluginKey":"connector"}}
mcp:
  command: node
  args:
    - ${PLATFORM_ROOT}/lib/mcp-spawn-tee/dist/index.js
    - ${PLATFORM_ROOT}/plugins/connector/mcp/dist/index.js
  env:
    MCP_SPAWN_TEE_NAME: connector
    LOG_DIR: ${LOG_DIR}
    PLATFORM_ROOT: ${PLATFORM_ROOT}
    ACCOUNT_ID: ${ACCOUNT_ID}
    SESSION_ID: ${SESSION_ID}
mcp-manifest: auto
---

# Connector

A generic, credentialed bridge to any third-party REST API. Register an API once by name with its base URL and a static credential; the agent can then make authenticated requests to it without a bespoke plugin per integration. This is the capability that lets self-serve agent and skill authoring reach the long tail of niche APIs.

The credential is stored in the account's secrets file and is never returned by a tool or written to a log. Every request is confined to the registered API's host: a request aimed at any other host, at a private or loopback address, or a redirect that leaves the host, is refused.

## Capabilities

- **connector-register** — store a named API's base URL and a static credential. The credential scheme is one of bearer, api-key-header (a named header), or basic. Returns the non-secret record only.
- **connector-call** — make a request (GET or a mutating method) to a registered connector. The credential is injected from the secret store; the request is host-bound and SSRF-guarded. Returns the status, redacted response headers, and the (size-capped) body.
- **connector-list** — the registered connectors for this account: names and base URLs only.
- **connector-deregister** — remove a connector and its stored credential.

## Who can use it

These tools are admin-driven. The operator's admin agent registers connectors and makes calls; the tools are not granted to any specialist agent, given their reach (arbitrary authenticated outbound requests and a credential store). A vertical agent that needs an external API is served by the admin acting on its behalf.

## Credentials and isolation

Credentials live only in this account's secrets directory (mode 0600), inside the brand-isolated install — the same store the other credentialed connectors use. Each connector is keyed by name and scoped to the account. A standing audit periodically confirms no stored credential has reached a log and that every registered connector still has its credential.

## Scope

Static credentials only — OAuth client-credentials and refresh-token flows are a separate capability. HTTP(S) REST only; no GraphQL or SOAP transport. The business logic an operator layers on top of a connected API is authored as a skill, not part of this transport.