@absuitecore/connector-starter

Connector registry, credential verification and deterministic connector scaffolding.

What it does

• Registry — GitHub, Slack, Discord, Linear, Notion and a generic webhook. Each declares the environment it needs and reports honestly whether it is configured.
• Verification — checks credentials with a cheap, read-only call. Clicking "test" never posts a message or opens an issue as a side effect.
• Actions — execute real connector operations, with required inputs validated before any network call.
• Scaffolding — turns a description into a YAML manifest and compilable TypeScript. Deterministic and rule-based: no API key, and the same description always produces the same output, which matters when the result gets committed.

Running

CAPKIT_HMAC_SECRET=$(openssl rand -hex 32) pnpm --filter @absuitecore/connector-starter dev

API

# What is available, and what is configured?
curl localhost:8084/connectors

# Verify credentials (read-only)
curl -X POST localhost:8084/connectors/github/verify -H "Authorization: Bearer $TOKEN"

# Run an action
curl -X POST localhost:8084/connectors/github/actions/listIssues \
  -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
  -d '{"owner":"iamGodofall","repo":"ABSuite-core"}'

# Generate a connector
curl -X POST localhost:8084/generate -H 'Content-Type: application/json' \
  -d '{"prompt":"Read GitHub issues and post them to Slack every 15 minutes"}'

Required scopes: connector:read, connector:execute.

Generation returns a manifest, ready-to-compile typescript, and the parsed spec — including a suggested Edge-Run cron schedule when the description implies a cadence.

Security

Generic webhook targets must be https, and must not carry credentials in the URL — those end up in logs.

A webhook URL cannot point inward. webhook.send takes its target from the caller, so without a guard a connector:execute scope would also mean fetch http://169.254.169.254/ and hand back the body — the cloud instance metadata service, and how a machine's IAM credentials are stolen. Loopback, private, link-local, unique-local, carrier-grade NAT and the unspecified address are all refused, by resolved address rather than by the text of the hostname.

Redirects are checked hop by hop, and Authorization is dropped when a redirect crosses an origin. Checking only the URL the caller supplied is no protection at all against a 302 to an internal address, and letting credentials follow one turns a redirect into a way to harvest the caller's own tokens.

Set ABSUITE_ALLOW_PRIVATE_WEBHOOKS=true if your webhook receiver genuinely lives on an internal address. The escape hatch exists deliberately: a control that breaks a real deployment gets patched out, and then protects nobody.

Connector credentials are read from the environment, are never returned in an API response, and do not appear in delivery-failure errors — a webhook URL is itself a credential.

Configuration

All connector credentials are optional — each connector reports its own state.

| Variable | Connector | |---|---| | GITHUB_TOKEN | GitHub | | SLACK_BOT_TOKEN or SLACK_WEBHOOK_URL | Slack | | DISCORD_WEBHOOK_URL or DISCORD_BOT_TOKEN | Discord | | LINEAR_API_KEY | Linear | | NOTION_TOKEN | Notion |

Known limitations

Scaffolding is rule-based keyword analysis, not a language model. It reliably detects common integrations, verbs and cadences, but it will not infer intent from an unusual description. It is a starting point to edit, not a finished connector.

Part of ABSuite

The black box for AI systems — record what happened, prove it happened, preserve the evidence.

| | | |---|---| | Source | https://github.com/iamGodofall/ABSuite-core | | Verify a trace in your browser | https://iamgodofall.github.io/ABSuite-core/verify.html | | Getting started | GETTING-STARTED.md | | Reporting a vulnerability | SECURITY.md — never a public issue | | What this project refuses to build | PRINCIPLES.md |

Published from CI with a signed Sigstore provenance attestation — check it with npm audit signatures rather than taking our word for it.

MIT licensed.