Connectors

Connect the systems your task needs: source control, issue trackers, cloud accounts, observability, databases and documents. You can start with local code and add connections later; a cloud account is not required for coding work.

​

Team connections and personal accounts

Administrators add team connections from Connectors → Connect and manage member access on the binding. For your own GitHub, Linear, Gmail or Google Drive, use Settings → Personal Credentials. A personal account is not a team-wide service identity. Check the acting account before asking an agent to publish. Select the connections the conversation may use. The member’s role, binding allow-list and provider permissions still apply. Some external entry points have different initial selections; review the relevant guide before using production.

​

Authentication depends on the provider

Short-lived access tokens do not mean every integration avoids storing a long-lived refresh token or secret. See IAM trust model. A local runtime may also use sign-ins already on its computer; connector selection does not remove those sign-ins.

​

Find a connection

The live Connect catalog shows what the current deployment can configure. Some connectors have dedicated resource pages; others work through the agent. A GUI’s resource list does not restrict the authorized provider CLI or API to only those resource types.

​

Read, change and automate

Permission modes govern runtime action prompts. Plans make significant cloud work reviewable, rather than gating every write to every integration. The connected provider’s permissions are the hard limit: Full Access cannot turn a read-only token into a write token. A Watch is an alert-to-agent workflow, not just a browsable monitor. It needs a provider notification path, a Nuphos trigger, an approved destination when messaging is used, validation and recorded cleanup. Slack is the reference incident-delivery path; do not assume every chat integration supports every Watch destination. The Monitoring overview aggregates Grafana, Better Stack and GCP; other provider pages are separate.

​

Verify and disconnect

After connecting, run a bounded read against the expected account or workspace. Then select the binding in the intended conversation. Authentication success does not prove all project, page or Kubernetes permissions are present. Remove a team binding from Connectors or a personal grant from Personal Credentials when it should no longer be used. Revoke unnecessary tokens and cloud trust at the provider too. Deleting a connection is not a cloud-resource cleanup or deletion of its previous transcripts.