Independent integrations.
Shared guarantees.

Shipped · runs today

• ShippedDescribe and invokeA connector's standalone service answers a typed descriptor and invokes its operations over HTTP; admission and freshness are checked before dispatch.
• ShippedOne-hop federationThe connectors_host::federation library puts one gateway in front of several standalone services, prefixes their operations and reports a downstream failure without retrying it.
• ShippedAudited v1alpha2 invokeA host whose service configuration names a state directory serves POST /v1alpha2/invoke: every admitted invocation is anchored in the execution audit before dispatch (since 0.35.0).
• ShippedThe attempt a write producedAn admitted write records its attempt before its one dispatch and answers it as mutation; a lost answer is outcome_unknown and is never sent again (since 0.35.0).
• ShippedRust client for v1alpha2connectors_client::Client::invoke_v1alpha2 returns the attempt the host recorded and reports an older host as unsupported instead of falling back.
• ShippedSetup and metadata storesetup init creates a private configuration and an Entity Runtime metadata store over Eventlog SQLite, with durable open checkpoints (since 0.33.0).
• ShippedSupervised instancesA local owner starts the process that serves each configured instance, refuses a changed executable or configuration before provider work, and stops exact incarnations.
• ShippedStopping an owner after an upgradesetup owner-stop asks the state directory's running owner, of any build, to drain and exit within 30 seconds, answers no_owner when none runs, and never signals a process.
• ShippedConfiguration upgradesAfter a configuration change each saved connection has one working path: revalidate, a new connection under the same instance id after an evidence lifetime change, or a new instance id after a changed provider authority or profile.
• ShippedApproval clock refusalsapprovals clock-check names why the quorum formed no answer (below quorum, split or too imprecise) with its next action, and each source's result: unreachable, unverified or verified at any radius; only the combined answer is capped.
• ShippedSaved connectionsconnections connect validates a credential and keeps it in Secret Service custody; revalidate, reconnect and revoke manage it, and an unanswered revalidation is outcome_unknown.
• ShippedUnattended readsA connection connected or revalidated once keeps serving reads across any number of evidence lifetimes: a read on lapsed evidence recollects it once from custody, with no re-entry, before it is served.
• ShippedConnector instancesA connectors-local/5 configuration enables connectors by name and names their instances; an instance that pins nothing is derived from the catalog provider installed beside the CLI.
• ShippedListing connectorsconnectors list prints every connector the CLI ships a declaration for, with its auth profiles and configured instances, without a configuration file and without starting a process.
• ShippedSelecting an instance--connector and --instance select one instance; the deprecated --adapter reaches the same instance and says it is deprecated once.
• ShippedRenamed commandsinstances replaces the adapters group and connections reconnect replaces connections repair; each old name runs as its new one and says it is deprecated once.
• ShippedStale connectionsA connection whose stored credential the provider refused is Stale until connections reconnect publishes a new credential under the same reference.
• ShippedOne connection per instanceconnections connect is refused while the instance holds a published Live or Stale connection, naming the reconnect, revalidation or revocation that helps.
• ShippedConfiguration migrationsetup migrate moves each legacy catalog entry to an instance of its connector, keeping its instance id, revision, executable selection and custody items, and names why any other entry is kept.
• ShippedMounted-secret custodyAn owner configuration can explicitly select read-only mounted-secret custody (mounted_secret, Linux): connect, list and a credentialed invoke run under an empty environment in a container, reading a Kubernetes-style Secret volume and writing nothing; rotation needs a revalidation.
• ShippedApproved writesapprovals policy-set, prepare and issue bind a write's whole input to a protected proof before the host dispatches it once.
• ShippedApproval-signing keysApproval-signing keys are initialized, rotated, recovered, revoked and retired through the CLI; status reads never touch custody.
• ShippedApproval clock checkapprovals clock-check answers from a quorum of two to eight configured Roughtime sources, naming each source's result, without starting the owner or reading metadata.
• ShippedConsumer launchconnections launch hands one connection's protected document to a pinned consumer and refuses a launch its configuration does not admit (since 0.31.0).
• ShippedOperations by familyoperations list --family names the operations of one contract family, such as datasource.feed/v1alpha1, with their contract and profile.
• ShippedJSON values in JSON answersWith --output json, invoke results and operation schemas are JSON values, not JSON text (breaking since 0.32.0).
• ShippedBundles from pinned sourcesconnectors-build catalog compiles a pinned OpenAPI document into a digest-verified bundle; every committed bundle matches a fresh run byte for byte.
• ShippedGuarded writes as dataA selection's guard reads before the one request and refuses unless every check holds; after it, a failed check leaves the outcome uncertain, never refused.
• ShippedGitLabProjects, issues, files, the repository tree, branches, tags, releases, commits, commit diffs, compares, code search, deployments, environments, pipelines, jobs, traces, merge requests and their diffs and discussions as reads; issue, merge-request (auto-merge and reopen included), note, discussion, tag and release writes under approval.
• ShippedGitLab CI, branch, commit and project writespipeline.retry, pipeline.cancel, pipeline.create, commit.create, file.update, branch.create, branch.delete and project.create under approval, each guarded on the caller's commit (project.create on the namespace path and id) and proven by GitLab's answer or a read after it; environments.list as a read; verified against fixtures, not a live GitLab.
• ShippedGitLab merge-request feedGitLab binds datasource.feed/v1alpha1 as profile gitlab-merge-requests/1, checked against recorded GitLab answers (since 0.32.0).
• ShippedFeed time query in an unknown zoneA declared feed's time query can be read by the provider in a zone it is not told, between utc_offsets least and greatest minutes east of UTC, and a resume then starts early enough to skip no item in any such zone. The Jira issue feed that declares it, profile jira-issues/1, is in the shipped Jira selection, so a Jira instance has feed.containers and feed.items; verified in every profile zone from UTC-12:00 to UTC+14:00 against fixtures from the upstream description, not a live Jira (*unreleased*).
• ShippedConfluence page feedA Confluence REST v1 binding of datasource.feed/v1alpha1, profile confluence-pages/1: spaces as containers, their pages as items, resumed by a CQL lastmodified query and continued by the cursor of the next link. It is in the shipped confluence-v1 selection, so a confluence-v1 instance has feed.containers and feed.items, and only a connection bound to REST v1 reads it. Verified in every profile zone from UTC-12:00 to UTC+14:00 against fixtures written from the v1 reference, not a live Confluence; the CQL lastmodified precision and order are not established (*unreleased*).
• ShippedJira CloudIssue search by JQL, one issue by key, comments, changelogs, an issue's available transitions, a project's creatable issue types and one issue type's create fields, the visible projects and one project by id or key, user search, an attachment's content, running one transition by id under a guard that reads the issue before and after it, and creating, commenting on, editing, linking and deleting issues under approval, each guarded by a read before it (edit and delete on the caller's updated stamp, refused as conflict), over HTTP basic authentication (one issue, issue types and user search since 0.39.0; the visible projects and one project *unreleased*); the writes are verified against fixtures, not a live site.
• ShippedBinary responsesA selection can read an answer as bytes: media type, length, SHA-256 and the bytes in base64, at most 2 MiB and refused as capacity above it, with at most three redirects, each only to an origin the selection names and the connection admits in its hosts; verified against fixtures only.
• ShippedJira attachment contentattachment.content reads one attachment as a binary body, directly with redirect=false or through Jira's 303 to an admitted media host; that host, api.media.atlassian.com, is inferred and not verified against a live site.
• ShippedConfluence CloudChanged pages, a space's pages, one page with its body and a page's comments; exercised against local fixtures only.
• ShippedConfluence Cloud REST v1CQL search, changed pages by CQL, spaces, one space, a space's content, one page with its body and a page's comments under the provider id confluence-v1, from a source document this repository writes from Atlassian's v1 reference; exercised against local fixtures only.
• ShippedHubSpot CRMOne object type's records, paged, and one record by id; exercised against local fixtures only.
• ShippedZendesk SupportTickets, users and organizations changed since a start time, one of each by id, and a ticket's comments, with OAuth client credentials or an API token; a ticket update, a private note and a draft reply behind an approval, refused as a conflict when the ticket changed since it was read.
• ShippedGoogle Drive, Slides, Calendar and GmailReads and guarded writes from Discovery documents projected to OpenAPI, with a refresh token from browser consent; exercised against local fixtures only.
• ShippedRunpod podspod.create, pods.list and pod.terminate with the API key in custody; a create without a definite answer is unknown and never sent again, and one refused for lack of capacity is refused as capacity; verified against a local fixture only (since 0.36.0).
• ShippedSwagger 2.0 sourcesA Swagger 2.0 document is ingested through an exact, recorded projection to OpenAPI 3.1.0; a construct without an exact row is refused by name (since 0.37.0).
• ShippedSlack conversationsconversations.list, conversations.history and conversations.replies with a bot token (since 0.38.0), users.list, one user by id (users.info) or e-mail address (users.lookupByEmail), team.info, emoji.list and auth.test, and on a second connection with a user token search.messages and the three conversation reads and users.list, which reach every conversation that user can read, the channels the bot is not in included; verified against a local fixture only.
• ShippedSlack messageschat.postMessage posts a message, a thread reply included, conversations.open opens a direct message to post to, and chat.update and chat.delete edit and delete a message the bot posted, each under approval after the token's auth.test read; an edit or delete Slack refuses by name (cant_update_message, cant_delete_message, message_not_found) is refused, and a dispatch without a definite answer, or any other 200 with ok false, is unknown; none is sent again; verified against a local fixture only.
• ShippedSlack filesfiles.list, files.info and file.download, which reads a file's url_private on files.slack.com as a binary body with the bot token, only where the connection admits that host with the credential, and files.delete under approval after the token's auth.test read and a files.info read of the file, with file_not_found and file_deleted refused as not_found and cant_delete_file as forbidden; verified against a local fixture only.
• ShippedSlack read refusalsA Slack read answered 200 with ok false is refused, never returned as an empty read: Slack's error is the reason, and missing_scope, not_in_channel and user_not_visible are forbidden, invalid_auth and its kin unauthorized, an unknown channel, thread, file or user not_found, an e-mail address no user has (users_not_found) not_found, ratelimited rate_limited with its Retry-After, a bad cursor or argument invalid_input, and any other name internal, on every JSON read of both Slack sets; verified against a local fixture only.
• ShippedOpsgenie alerts and incidentsalerts.list and incidents.list over a creation window the caller advances, alert.get, incident.get and incident.alert_ids, read only, with the key sent as GenieKey <key>; verified against a local fixture only.
• ShippedKubernetes reads and discoveryresources.list, endpoints.discover and optionally hosts.discover, scoped to configured namespaces and kinds, with a saved bearer token.
• ShippedKubernetes single objects, namespaces and rollout historyresources.get reads one object by name, namespaces.list the configured namespaces the cluster has, deployments.history the ReplicaSets a Deployment controls; replicasets and events are configurable kinds; verified against API-shaped fixtures.
• ShippedKubernetes statefulsets, nodes and custom resourcesstatefulsets is a configurable kind; nodes.list pages the full Node objects when node_reads is configured; custom_resources.list pages one configured namespaced custom resource collection by group, version and plural; verified against API-shaped fixtures.
• ShippedKubernetes exec credential pluginA kubeconfig user that authenticates through an exec plugin, such as aws eks get-token, is reached when the local configuration pins the plugin by absolute path and sha256: it runs on Linux from the descriptor it was hashed through and on macOS from its checked path, with the kubeconfig arguments, an empty environment plus an allow-list, a deadline and an output bound, and its token is held in memory until expiry; verified with fixture plugins against a recorded API session, not a live EKS cluster.
• ShippedKubernetes pod logspods.logs reads a bounded tail of one container's log in a configured namespace, at most 1,000 lines and 128 KiB, when pod_logs is configured; verified against API-shaped fixtures.
• ShippedKubernetes kubeconfig contextscontexts.list lists the contexts of the one kubeconfig a local configuration names, never its credentials or servers, with no cluster request.
• ShippedKubernetes pod execpods.exec runs one command as an argument vector in a named container, through the local CLI under approval, when pod_exec is configured; exit status and bounded output come back, and a lost stream is unknown and never resent; verified against recorded streams, not a live cluster.
• ShippedHelm release readsHistory, status, values and manifest of a named release, values and manifests disclosed only as redacted projections.
• ShippedPostgreSQL readsschema.list, query.read, database.list, table.list, table.describe and index.list in a read-only transaction with fixed statement and lock timeouts; a deadline or a dropped invocation cancels the query.
• ShippedMySQL readsThe same six reads on a connection whose engine is mysql, in a read-only session bound to the configured database, over TLS unless plaintext is allowed.
• ShippedSQL read profilesprofile.read runs a read the operator declares in the native file by name, on either engine: declared parameters only, bound; typed columns with numbers masked by default; one call identifier; keyset pages that never take a short page for the end and refuse, rather than skip, a non-unique ordering value at a page boundary; cursors checked for shape, type and context; verified against scripted wire fixtures, not a live database.
• ShippedTavily web searchwebsearch.search, websearch.fetch and websearch.crawl through the shared websearch family; the key is checked without spending a search.
• ShippedLoki LogQL readslogs.query_range, logs.query_metric and logs.labels through a saved bearer connection (since 0.38.0).
• ShippedLoki line and trace profileslogs.profile_lines (one typed, masked record per line of a configured line profile) and logs.call_trace (one call's lines from every source, by its identifier) through a saved bearer connection.
• ShippedA call by its number, every leg typedA configured SQL read profile over the call table and a configured Loki line profile over the CDR lines, joined by a workflow on the call identifier each declares, answer every leg of a transferred call with its type, numbers masked, across a page boundary of the SQL read.
• ShippedGrafana data sourcesdatasources.list through a saved service-account connection, and Loki reads through Grafana's data-source proxy (since 0.39.0).
• ShippedGrafana IRM alert groups and incidentsirm.alert_groups.list, irm.alert_group.get, irm.incidents.list and irm.incident.get over a since window, with incident-to-alert-group links (inferred), through a saved IRM service-account connection; read only.
• ShippedPrometheus PromQL readsseries.query, series.query_range and rules.list through a saved bearer connection, directly or through Grafana's data-source proxy.
• ShippedRelease binariesA release page carries an archive per Linux and macOS target (x86_64 and aarch64) holding connectors, connectors-catalog-provider and the Grafana, Prometheus, Loki and Kubernetes programs, with SHA256SUMS; the other adapters are built from the checkout, and there is no Windows binary.