Nimbus MCP Servers

Standalone, MCP-standard Nimbus connectors — usable by any MCP client (Claude Code, Cursor, Claude Desktop, …), not just the Nimbus gateway.

All 94 connectors ship in one package, @nimbus-dev/connectors, each runnable standalone over stdio with credentials supplied from the environment.

npx @nimbus-dev/connectors github

You need Bun 1.2 or newer on your PATH: the package ships TypeScript, and its nimbus-connector bin runs under Bun.

What you get, and what you do not

Run standalone, a connector gives you:

• Consent before every mutation. A write tool asks your MCP client to put the exact operation and parameters in front of you, and does nothing unless you approve.
• A write-scope allow-list, enforced by the server and unreachable by the model.
• A mutation budget per session, which caps a runaway agent loop.
• A local, hash-chained, append-only audit log, when NIMBUS_MCP_AUDIT_LOG is set — one file can serve every connector you run, within the bounds Configuration lists.

It does not give you the process sandbox, OS-keychain credential storage, the egress ledger, or owner-controlled consent. Those are properties of the Nimbus gateway and no published package can supply them. NOTICE states the tiering that notice asks you to preserve.

Writes depend on your client

Reads work everywhere. Writes require your client to implement the MCP elicitation capability, because that is the only way a server can put a consent prompt in front of you. Without it, write tools are not registered at all rather than offered ungated — deliberate, not a defect: a tool the model cannot see is one it cannot call without a human.

Claude Desktop does not implement elicitation today, so you get reads only there. Claude Code and Cursor do, per their vendor docs.

Checking your own client takes one query: ask it to list the connector's tools. If the write tools are absent, your client does not implement elicitation.

Full matrix, versions tested, and the provenance of each claim: Client support.

Configuration

{
  "mcpServers": {
    "nimbus-github": {
      "command": "npx",
      "args": ["-y", "@nimbus-dev/connectors", "github"],
      "env": {
        "GITHUB_PAT": "ghp_...",
        "NIMBUS_MCP_GITHUB_WRITE_SCOPE": "repo:acme/api",
        "NIMBUS_MCP_AUDIT_LOG": "/absolute/path/to/nimbus-mcp-audit.jsonl"
      }
    }
  }
}

Credentials come from the environment. There is no Vault outside the gateway, so whoever writes this config holds the secret. Every variable, and the three behaviours that look like bugs and are not, are in Configuration.

Each connector has its own README at connectors/<id>/README.md. Most list their tools and credentials, but some — github, slack and jira among them — are still only a short gateway quickstart. Until they are filled in, let the connector tell you: a tool called without its credential refuses before sending anything, with an error naming the variable to set (GITHUB_PAT is not set). Those that drive a CLI — aws, azure, gcp, kubernetes, iac — use that tool's own credentials and configuration instead.

Documentation

| Page | Read it when | | --- | --- | | Architecture | You want the layout, or how a connector is put together. | | Client support | Write tools are missing, or you need to know if your client can approve a mutation. | | Configuration | You are wiring a connector into a client. | | Standalone launcher | You want nimbus-connector: eligibility, exit codes, refusals. | | Adding a connector | You are writing or changing a connector. | | Publishing | You are cutting a release. |

Development

bun install
bun run check   # lint, typecheck, the four connector audits, full suite

CI runs the same gates on Ubuntu, macOS and Windows — platform equality is a Nimbus non-negotiable.

See CONTRIBUTING before opening a PR, and SECURITY before reporting a vulnerability — it states what this package does and does not claim, which is the difference between a security report and a documentation question.

Relationship to the Nimbus monorepo

The connectors are developed here and consumed by the gateway from npm. The gateway's per-connector sync and indexing intelligence stays in nimbus-agent/Nimbus — this repo holds the MCP tool surface, which is the part that is useful without a gateway. Adding a connector therefore touches both repos.

Not to be confused with nimbus-mcp, which exposes your local Nimbus index and agents to an MCP client. This repo is the other direction: the connectors that reach your tools.

History

This repo was a scaffold from 2026-06-18 until the connectors landed. Its original README posed three "decisions to make first" — share-vs-vendor-vs-fork, the credential model outside the Vault, and the AGPL implications for downstream clients. All three were answered before the move: the connectors are consent-gated standalone, credentials come from the environment, and NOTICE states the tiering. It also proposed a package per connector; one package was chosen instead, because 94 packages means 94 releases and forces shared/ to become a versioned dependency that 212 shipped connector source files import by relative path.

License

AGPL-3.0-only, and NOTICE records the security tiering — please preserve it. "Nimbus" is a trademark of the Nimbus project; this licence grants no trademark rights, and a modified version that removes these protections must not be described as Nimbus-grade.