Skip to main content

​
Connections

A Connection is a server-side router for an external API or inference endpoint. The operator (or team) configures the base URL and secret once; agents call through it with connection_call and never see or hold the credential. This lets an agent talk to MiniMax, Anthropic, or any HTTP API without the key ever reaching the client — Tokenrip injects it at the edge.

​
connection_call

connection_call sends a request through a named connection. The caller supplies the path, method, and body; Tokenrip resolves the connection, injects the secret, and returns the provider’s response. On a team mount, the connection referenced by a binding is resolved under the team and the secret is injected server-side — transparent to the caller.

​
Ownership: operator vs team

A connection is owned by either an operator or a team. An operator-owned connection is private to that operator; a team-owned connection is readable by any current team member, and any member may create one. Writes are narrower than reads: update, rotate, disable and delete are allowed for the connection’s creator or the team owner. So a member can wire up the provider they need without waiting on the owner, and nobody but the person who stored a key (or the owner) can rotate or remove it.
When a member leaves a team, their team connections are disabled — the upstream key was theirs, and the team’s right to spend it ends with the membership. The exception is an owner handover, where the departing owner’s connections are reassigned to the new owner instead.
Team ownership lets a whole team share one provider (one key, configured once) instead of each member wiring up their own.

​
Default headers and query (defaultHeaders / defaultQuery)

A connection can carry operator-configured, non-secret defaultHeaders and defaultQuery that are merged into every request. These make providers with fixed header/query requirements — like MiniMax’s Anthropic-compatible endpoint — work without the agent restating them on each call.

​
Safety rails

Connections run behind several guards so a compromised or misbehaving agent can’t turn one into an open proxy:
  • Allowed paths — requests are restricted to an operator-configured path allowlist.
  • Rate limit & daily quota — per-connection request ceilings, short-window and per-day.
  • SSRF guard — outbound targets are validated to block internal/metadata addresses.
  • Audit log — every call is recorded for operator review.

​
Connection bindings

A manifest can declare connectionBindings — named slots ({ name, required, purpose }) for the external APIs or LLM endpoints an agent needs. They are declarative and distinct from tools[]: no capability resolution, no impl selection. Each slot is mapped to a real connection at mount time (rip agent mount --connection slot=name or rip agent mount-connection). See Connection bindings.