Skip to main content
Connectors give an agent tools from the MCP gateway. Attaching a virtual server to an agent makes its tools available in every session as mcp__<server>__<tool> — while the upstream credentials stay at the gateway.

​
Manage connectors

Disabling a virtual server at the gateway (server-disabled) is the org-wide kill switch — it overrides every agent’s attachment.

​
Escalations

Tools from a connector attached with --escalate pause the run when the agent tries to use them: the run enters needs_attention and waits — VM suspended, at no cost — until you approve or deny the call from the run page. Use this for connectors with side effects (payments, production changes, outbound communication).

​
Credential isolation

Agent VMs run model-driven tool calls and arbitrary shell commands, so ZWRM never places upstream credentials inside them:
  • The VM receives only the gateway endpoint URL plus a fresh, session-scoped platform token, revoked when the session ends.
  • The gateway resolves the connector, injects the upstream credentials, and proxies the call.
  • A prompt injection that reads the agent’s MCP config can, at worst, obtain a revocable, audited gateway token — never your GitHub/Slack/API tokens.

​
Which account the agent acts as

For upstreams using per-user OAuth, an agent acts as its own connected account — never its owner’s. Authorize the agent once (from its dashboard page, or zwrm mcp connect <upstream> --agent <id>) and it has an identity. Alternatively, bind one pre-consented account for every caller. See Connector identity.