Existing MCP connections

The private hub is moving from a synthetic fixture to an operator-approved connection catalog. The catalog does not let callers supply endpoints, commands, secret paths, workspace IDs or arbitrary tool names. Each enabled operation maps to a distinct exact-path OpenBao AppRole. MFA still gates browser execution.

Current connection inventory

This inventory excludes browser automation infrastructure and documentation-only connectors. Disabled cards explain the actual blocker rather than reporting a successful deployment. Private URLs, inventories and credential values are not part of this document.

Import and verification

Run python3 deploy/openbao/connect-existing.py --plan first. It identifies existing source configuration without printing credentials. The owner then runs python3 deploy/openbao/connect-existing.py in their own terminal and enters the recovery-file passphrase. It checks the private IAP tunnel first and restores the same authorized tunnel if port 8821 is not listening, using the local Google login and a 30-minute SSH-key authorization. An occupied but unverified port or TLS validation failure stops the import. Automatic tunnel recovery was exercised against the existing VM. It uses verified IAP TLS connectivity, decrypts the administrative token in memory, and creates exact-path grants for ready connections. Existing differing secret values require explicit rotation; reruns may reuse an identical imported value. It does not remove original local credentials, re-enroll MFA, start stopped services or create cloud resources.

The script writes a private connected.json and an issuer token valid for 24 hours, then runs secrets --config FILE --check. This operator-only diagnostic requires access to private configuration; it does not create an unauthenticated web route. The UI must be restarted explicitly with the connected configuration after checks pass. A restart invalidates existing browser sessions.

Each run obtains a one-use SecretID (at most 60 seconds), reads only its bound versioned secret, and revokes the OpenBao workload token before invoking MCP. Provider credentials themselves are not short-lived merely because their OpenBao lease is short-lived. Their provider-side scope and rotation still apply.

Execution boundaries

S3 secrets are a strictly keyed JSON bundle injected into the child environment. Docker receives environment variable names, not secret values in command-line arguments. The container image is immutable, cannot pull at run time, has no host mounts, a read-only filesystem, dropped capabilities and resource limits. Every run uses a random container name and attempts bounded cleanup, including after failure. Host/Docker administrators can inspect container environment values; cleanup can fail if the Docker daemon becomes unavailable.

Existing local HTTP processors receive their own bearer token from OpenBao. Requests reject redirects and never send the bearer header to another endpoint. Unencrypted HTTP is accepted only for literal loopback IPs; remote endpoints require verified HTTPS. Response sizes and timeouts are bounded. Provider keys inside audio/video services have not been migrated by moving their MCP bearer tokens. A separate service-side integration is needed for those provider keys.

The UI reports operation completion, duration and a reference, not raw provider bodies or bucket names. These are connection checks, not an upload/transcription workflow. Media upload, durable job status, results, provider-secret migration, issuer renewal and deployment of currently stopped services remain rollout work.