Features · Connectors
Tools, marked safe.
The agent can only use what you gave it.
Connectors, and the one rule.
A connector is an MCP server the agent may call: Geenius OS through its bot door, or any MCP server by https address. Its tool names are namespaced with the connector id. Web fetch and web search are safe. The outbound webhook is always risky. For connector tools, you list the ones that are read-only; every other tool of the connector asks first.
- Connector secrets are typed in the web app and stored encrypted in the agent
- The hub keeps only a hint
- A tool that is switched off is refused before any question of risk
What asks first.
The approval gate reads only the risk rule. Unknown tools are risky, a tool the config does not offer is refused, and nothing an agent reads from the web can change that: content from tools, pages and messages is treated as data.
- One function decides
- It is the same for chat and for schedules
- It cannot be argued with by a web page
Questions
About connectors.
What counts as risky?
Every connector tool unless you marked it read-only, a webhook always, and any tool the rule does not know. Web fetch and web search are safe.
Where do connector secrets live?
They are typed in the web app and stored encrypted in the agent's own runtime; the hub keeps only a hint, and nothing returns the value.
Can a web page tell the agent what to do?
No. Text from tools, web pages and messages is treated as data, never as instructions, and risky actions still wait.