# Connections and APIs A connector is something 0bridge can connect to: an MCP server (Linear, Notion, Slack) or an HTTP API it calls for you (Google Calendar, or any API with a key). A connection is your signed-in account on it. ## Any service ``` 0b connect stripe 0b connect api.example.com 0b connect acme --spec https://api.acme.com/openapi.json ``` You don't need 0bridge to know a service. Give its name or address and 0bridge finds the best way in: 1. A connection 0bridge already polished (Linear, Notion, Channel Talk, Google Calendar, …). 2. The service's own MCP server: the official MCP registry, or the usual addresses (`mcp./mcp`). 3. An OpenAPI document, when the address you gave is one. 0bridge doesn't go looking for documents: a service without an MCP server connects by its base URL and key (below), or by the document you point it at with `--spec`. It never picks someone else's MCP server for a service on its own: those see the data passing through, so they're only listed. On the dashboard, **Connect** does the same: type a name or address and pick a result. An API connected from its OpenAPI document gives your agents three tools: `acme__search` finds an operation, `acme__describe` shows its parameters, `acme__call` runs one that only reads (GET). Operations that change data go through a fourth tool, `acme__call_write`, which appears once you allow writes: on the dashboard, a connection's ⋯ menu › **Allow writes**, or `--allow-write`. ### Keys 0bridge reads which keys an API needs from its document. Your agent can set a connection up without them (`0b connect acme --spec https://api.acme.com/openapi.json --yes`, or from chat); you then add the keys yourself, so they never pass through the agent: ``` 0b key acme ``` It asks for each key, hidden. Or open the link it prints, or **Add key** on the dashboard. The keys are kept encrypted by 0bridge and added to each call. ## MCP servers ``` 0b connect notion 0b connect acme https://mcp.acme.com/mcp ``` Known services need no URL. Services that don't let apps register themselves (Slack) need a registered app. `0b connect slack` asks which: **0bridge's app** (the default: one click, or [0bridge.dev/slack/install](/slack/install)), or **your own app** in that workspace (0b opens a filled-in "create app" page, then asks for its Client ID and Secret). Until 0bridge is in the Slack Marketplace, Slack's MCP server takes only a workspace's own app, so 0bridge's app works through Slack's Web API as you: search, channels, threads, people, posting and reactions, with channel history once a minute. Your own app gets Slack's MCP server in full. In your terminal you pick from the list; agents and scripts choose with `--app 0bridge` or `--app own`. ## APIs ``` 0b connect google-calendar 0b connect acme --api https://api.acme.com/v1 --auth header:X-API-Key ``` For an API, 0bridge keeps the key and adds it to each call; your agents never see it. A known API (Google Calendar) comes with its own tools. Any other gets two tools that can only call paths under its base URL: `acme__get` for reads and `acme__request` for changes, so your AI tool can ask before each change. `--auth` is `bearer` (default), `basic`, `header:` or `query:`; the key is asked for, never taken from the command line. ### Mail (IMAP) ``` 0b connect imap --label personal ``` Reads a mailbox over IMAP with an app password: Gmail and Google Workspace (`imap.gmail.com`, an app password from Google Account › Security › 2-Step Verification › App passwords), or any IMAP server over TLS. It asks for the server, the address and the password, the password hidden; label each mailbox so you can connect several. Your agents get `imap__personal__list_messages` (the newest mail: date, sender, subject, a line of the text), `search_messages` (sender, recipient, subject, text, dates, unread), `read_message` (the body as text, attachments by name) and `list_mailboxes`. It only reads: mailboxes are opened read-only and nothing is marked read, moved or deleted. ## What agents get Every connection has its own page on the dashboard (click its name under **Connections**), or in your terminal: ``` 0b connection linear --label neotax 0b connection linear --label neotax read-only on 0b connection linear --label neotax tool off save_issue delete_comment 0b connection google-calendar describe "Work calendar" 0b connection google-calendar tags work,acme ``` - **Read-only**: agents get only the tools that read. A tool counts as one when its server marks it read-only; where the server doesn't say, when its name plainly reads (`get_`, `list_`, `search_`, `read_`, `fetch_`, `find_`, `query_`, `describe_`, `view_`, `show_`, after the service's own name, so `slack_read_channel` too). Anything else, including `export_` and `download_`, is hidden. `0b connect --read-only` connects it that way from the start. - **Tools on and off**: turn single tools off. A tool that's off, or that changes data on a read-only connection, disappears from every AI tool on your bridge, and calling it anyway is refused with the reason. An app lists tools when it connects or a chat starts and keeps that list: ChatGPT until you refresh it ([ChatGPT](/docs/clients/chatgpt)). - **Description and tags**: what the connection is for, in your words. Agents read them in its tools and in `bridge__connections`, so with two Google calendars they pick the work one. `-` clears either. - **Signed in as**: the account or workspace a connection is signed into, where the service says so: an OpenID sign-in's email, Slack's workspace, Google's email, or the service's own "who am I" tool (Linear), asked once after connecting. Shown on the dashboard, in `0b connection` and to agents in `bridge__connections`. ## Accounts and names - `0b rename slack --label old new` changes a label; the sign-in is kept. - `0b disconnect slack --label acme` removes a connection and its tokens. - A connection can be limited to projects, so it only shows there. See [Projects](/docs/projects).