Connecting software
MCP, REST or a database — and what happens to your credentials.
Three kinds of connection: an MCP server, a REST API (from an OpenAPI document or endpoints you describe), or a database.
What happens to your credentials
They are encrypted before they are stored, with a key that is itself encrypted. They are decrypted only at the moment a call is made, inside the connector.
They never appear in a prompt, a log, an audit record or an execution trace. The model is never told them and could not use them if it were — it names tools, and the platform makes the calls.
Nobody, including a platform administrator, can read them back.
What we refuse to connect to
URLs are checked on save and again on every single request, including redirects. Private addresses, loopback, and cloud metadata endpoints are refused. A host that resolves publicly today can resolve somewhere private tomorrow, which is why it is re-checked every time rather than once.
Database connections
Queries are validated structurally: one statement, an allow-listed leading keyword, no schema changes anywhere, and no UPDATE or DELETE without a WHERE. Row and time limits apply on every call.