# Connections and operations

> A connection links Mindset to one outside system and holds its credential. Operations are the single reads and writes agents make through it.

**Skill for your coding agent:** [`mindset-connect/SKILL.md`](https://docs.mindset.ai/skills/mindset-connect/SKILL.md)

**Skill for your coding agent:** [`mindset-slack-connection/SKILL.md`](https://docs.mindset.ai/skills/mindset-slack-connection/SKILL.md)

**Skill for your coding agent:** [`mindset-postmark-email-connection/SKILL.md`](https://docs.mindset.ai/skills/mindset-postmark-email-connection/SKILL.md)

Builders work from a coding agent and operators from an AI client, both through the MCP server, or in the Studio. In Mindset, an agent is a prompt and a model, held to an order by a script when needed. It uses connections to outside systems, operations on them, functions and widgets. Every change is a version, and every execution is a run. Every piece sits on one security and compliance layer: the org sets its posture once, and every agent works under it, with the audit trail and, once an admin turns it on, personal data redaction. The platform runs in your own cloud (AWS, GCP or Azure) or is hosted by Mindset. Your app reaches agents through the SDK, your server through the API, and people through the Hub and schedules. Highlighted: Connection, Operation.

A **connection** links Mindset to one outside system and holds its address and credential. Mindset adds the credential to each call, so it never reaches the agent or the model. There are seven types: HTTP API, MCP server, AI model, Postgres database, Google Sheet, Knowledge base and StackOne. What each asks for is on [Connection types](https://docs.mindset.ai/docs/connection-types).

An **operation** is a single action on a connection, with fixed parameters, marked **read** or **write**. Operations are an agent's only way into a system, so a connection's operations are the complete list of what agents can do there.

## Why it matters

You don't write credential handling, and no prompt can get an agent to reveal a credential it never sees. You can read a connection's operations, and approve its writes, before anything runs.

> **Info:** Operations are where your org's [compliance rules](https://docs.mindset.ai/docs/compliance) meet your systems. Each write follows the org's approval setting, and every call is recorded in the run.

The invoice agent calls an operation, such as get_invoice. The operation runs on a connection, which adds the credential and calls the finance system.

The invoice exceptions agent uses the finance system (an HTTP API) and the supplier contracts knowledge base. On the finance system:

| Operation                        | Kind  | Available to         | Assigned                              |
| -------------------------------- | ----- | -------------------- | ------------------------------------- |
| `get_invoice`                    | Read  | Agents and functions | The agent                             |
| `get_purchase_order_for_invoice` | Read  | Agents and functions | The agent and the comparison function |
| `get_supplier`                   | Read  | Functions            | Nobody yet                            |
| `register_supplier_query`        | Write | Agents               | The agent                             |

## Read or write

A read needs no consent. A write needs consent once per operation, which your org gives automatically by default. See [Security and approval](https://docs.mindset.ai/docs/security-model).

An HTTP API operation is a read when its method is GET and a write otherwise, unless its access was stated when it was registered. An MCP tool's access is resolved in this order:

1. **An admin's choice** is final. Later discoveries never change it.
2. **The server's own hints.** `destructiveHint: true` makes it a write. Otherwise `readOnlyHint: true` makes it a read, and `readOnlyHint: false` makes it a write.
3. **A model's reading** of the tool's name and description, kept only when confident.
4. Anything still unanswered is treated as a write.

An admin can correct any marking with the tool's **Access** select. When in doubt, mark it a write.

## From registered to callable

An agent can call an operation only when every check passes:

| Check          | Passes when                                                                                       |
| -------------- | ------------------------------------------------------------------------------------------------- |
| **Connection** | It passed its connection test and is enabled                                                      |
| **Lifecycle**  | The operation is enabled                                                                          |
| **Consent**    | Not required, or granted. A pending write is refused, not queued                                  |
| **Exposure**   | **Available to agents** is ticked, which needs a description on the operation and every parameter |
| **Assignment** | The operation is on the agent's **Resources** tab, in its active version                          |

The first three are checked on every call, so switching one off stops the operation at once. Assignment changes with the next [agent version](https://docs.mindset.ai/docs/versions-and-going-live). Separately, an **Untested** operation can stop a script or function going live. See [Versions, testing and going live](https://docs.mindset.ai/docs/versions-and-going-live#the-go-live-gate).

## Limits

- Only remote MCP servers can be connected. A local (stdio) MCP server can't.
- An HTTP API that needs an OAuth sign-in can't be connected yet. MCP servers with OAuth sign-in work.
- A connection keeps no history. A change applies straight away, and to undo it you change it back.

> **Warning:** A credential pointed at the wrong account returns valid data, and nothing errors. Check one value against what the system's owners see on their own screen.

To connect one, see [Connect a system](https://docs.mindset.ai/docs/connect-a-system), or [Post to Slack or send email](https://docs.mindset.ai/docs/post-to-slack-or-send-email).