Skip to main content
Connections brings gateway accounts and direct model credentials into one workspace view. Select an account to review its access checks, model resources, routing and recorded activity. Workspace administrators manage credentials; members use the resources their work is already permitted to access. A saved credential has not necessarily passed an access check. An old successful check is shown as history, and unavailable inventory remains unavailable rather than an empty success. Model pricing and evidence status remain separate facts. The catalog opens guided setup for installed connector implementations. A catalog entry does not establish live compatibility. Native sources require a saved account, an actual discovery result and a reviewed resource grant before use. Databricks guided setup covers model serving. Slack setup covers notifications. Deployment-local execution requires an operator-installed environment binding for the exact workspace, connector and account. Entering a private address or enrolling a remote runner does not establish execution. Replacing a direct credential updates EvalGate’s stored key. Revoke the old key with the provider separately. Removing EvalGate access does not delete an upstream account, index, collection or model. This surface is a source candidate until its deployment is verified. Native resource grants and bounded connector operations are implemented in this candidate; account authorization and deployment acceptance remain prerequisites. One-time budget exceptions are not enabled. Existing runtime policy, reservations and evidence services continue to govern model calls. Automation uses the same read contracts:
The TypeScript and Python OpenAPI clients expose listConnections and getConnectionCatalog. MCP clients use connections_list and connections_catalog. None of these reads returns a secret or grants permission to read content or invoke a model.

​
Native source setup

Open Connections → Add a connection, select a connector and enter its exact account scope. Save or reuse its credential, then save the account setup. On the account page, discover resources, select the ones to permit and review the grant. Child resources require their own discovery and review. Discovery metadata alone does not authorize all documents, tenants, namespaces or models in an account. Older configuration-only drafts remain visible. If they lack the current execution fields, create a new reviewed setup with those fields; repairing a credential reference does not edit the account’s configuration. Configured resources are labeled separately from resources observed through the provider. Empty, partial and unavailable responses remain distinct. Reads and searches return bounded previews; an incomplete result does not establish that the entire source has been checked. Response text is returned to the current request; operation receipts retain metadata and hashes rather than document bodies or query text. PDF, Office, images and other binary ingestion are not silently treated as text. Use EvalGate’s supported document-ingestion path for those formats. S3 directory buckets/access points/Outposts, sovereign SharePoint clouds and remote private worker dispatch require additional native qualification. PostgreSQL pgvector similarity and arbitrary database SQL are not enabled here. PostgreSQL previews represent non-safe-integer numeric values as strings to preserve their exact source lexemes. PostgreSQL operations run read only with a ten-second statement timeout. Cancelling a request closes local connections; if the upstream server refuses cancellation, the statement timeout remains the server-work bound.

​
Credentials and runtime access

Credentials are stored by the existing canonical credential owner, with the deployment’s configured encryption and erasure-ledger requirements. Secrets do not belong in account fields or URLs. Source access uses the provider’s own ACLs on every operation. Paused/revoked roots, rotated credentials and changed resource selections require a fresh review. Expired user OAuth access tokens must be replaced; automatic rotating-refresh-token persistence is not implemented. Kong, Portkey, Cloudflare and Vertex model discovery and model traffic use independent credential references. Register a runtime gateway with the exact allowed model IDs, then bind it to the account with Model or tool execution purpose. Management tokens are never reused as an implicit runtime fallback. Cloudflare runtime credentials use JSON {"apiKey":"…","gatewayId":"…"} with the exact account AI v1 base URL. Vertex runtime uses a current OAuth access token and its exact regional endpoints/openapi base. Calls remain subject to the canonical model policy, pricing, reservations and evidence requirements. Operators must also configure the existing reviewed gateway upstream/provider bindings and physical request contracts, including verified liability and a finite daily budget. Missing pricing or transport review blocks a call; source discovery does not create a budget exception. See the model-provider deployment guide for those canonical controls. An invocation whose response is lost has an uncertain outcome. Use the read-only receipt lookup with the same operation identity; do not create a new identity as an automatic retry. Credential saves also need inventory inspection after a lost response because their current save contract cannot deduplicate that write.

​
Shared native operations

The web flow calls these same authenticated contracts used by the generated TypeScript/Python OpenAPI clients and evalgate api: Mutations require a UUID idempotencyKey, expectedRevision, expectedAuthorityEpoch and expectedSelectionEpoch from the current runtime review. Use a snapshot’s snapshotId plus its actual nativeIds to grant access. Use parentGrantId to discover children and grantId to execute. Continuations are opaque receipt IDs bound to the same account, principal, operation, query, selection and authority; never pass a raw provider cursor. Expired or changed reviews return a conflict and require fresh discovery. Content is not replayed from receipts. Read/search/invoke receipt lookup recovers operation identity, state and timestamps; provider task details and content are not replayed. An A2A task state is the observation returned with the original send. EvalGate does not poll or continue that task; inspect it with the upstream provider. Current resource review is bounded to1000 grants. Granting a page advances the selection epoch and clears its old continuation; restart discovery to review another page. Shared multi-page approval and a searchable grant inventory are not enabled. Discover the exact generated operation names with evalgate api --list-operations --json or the OpenAPI operation inventory. These source operations do not change the released public MCP management boundary or publish a new SDK package.

​
Deployment-local sources

An operator can install EVALGATE_CONNECTOR_ENVIRONMENT_BINDINGS as a JSON array in the self-hosted server environment. Each binding contains an id UUID, positive version, organizationId, driverId, exact accountScope, environment (dev, staging or prod), secret, and an addresses map from exact service origins to approved IP addresses. The setup UI receives only the nonsecret environment-secret:UUID:version reference and scope metadata. The address registry must include every service origin that the selected protocol uses, including fixed OAuth and approved download origins. An unlisted origin is refused even if its DNS addresses are public. For PostgreSQL, use a postgresql://USER:PASSWORD@HOST:PORT/DATABASE secret with no query/hash and a read-only upstream role. The addresses entry uses the same postgresql://HOST:PORT origin. DNS answers must belong to the approved address set; TLS still verifies the original host. Bindings cannot substitute a shared application database credential or another workspace/account’s authority.