Secrets and egress

Secrets

• Config has no secrets. cengrid.config.jsonc is committed and cengrid check rejects secret-shaped values in env. Values go in a gitignored .env, and cengrid secrets push uploads them to Fly secrets or AWS Secrets Manager without printing them.
• .env.example lists names only. init renders the computed set of secret names and descriptions for your enabled services. Never put values in it.
• Credentials live in the encrypted keychain. Connection tokens, OAuth tokens and refresh tokens are encrypted with CONNECTOR_SECRET_KEY. Keep the same key across restarts, because without it saved secrets cannot be decrypted.
• Secrets are write-only. Forms never read a saved secret back. Leaving a secret field blank keeps the saved value.
• Brokered secrets stay in core. Connections attach the credential in core, so the secret never enters the sandbox. Personal OAuth tokens for skills such as Google and Linear are an exception: they are exposed in the owner’s sandbox as VAULT_TOKEN_<HOST> variables, and the skills tell the agent never to log or reuse them.
• cengrid doctor treats missing and placeholder required values as failures and reports absent optional ones without blocking.

Do not put secrets in plugin repositories

Plugin import discards repository credentials, rejects .env files, and keeps MCP and API tokens out of manifests. Tokens belong to configured connections, not plugin files. Additional-header values on a connection are public configuration, so never put a secret there.

Egress

Egress policy decides which hosts the agent’s network calls and brokered requests may reach.

• Set it for the organisation and for connection scopes in the console (Egress, and Governance → Security → Egress policy).
• An empty allowlist allows all hosts unless a host is denied. A non-empty list allows only listed hosts, matched by suffix.
• It applies to API and MCP calls, Git requests, MCP discovery and connection tests. The host of a token endpoint, such as oauth2.googleapis.com, is checked when a connection is saved.
• The turn’s contextual policy (its scope and audience) applies to calls too. Background MCP discovery runs without a turn, so restrictions that should apply to it must be set on the organisation or connection scope.
• Private-network protection applies in addition. Personal endpoints require HTTPS and public addresses.

A scope whose network settings or security posture restrict egress installs environment items directly, instead of restoring a prepared bundle.

Note

Tool descriptors in a deployment layer can declare egress hosts. They are validated as host names and checked for dangerous wildcards, but runtime enforcement of that field is not claimed in contract v1.

Audit

Every API call and Git request through a connection is recorded durably with the connection, scope, principal, outcome and upstream status. Admin content reads are authorised by scope and audited, plugin removal is recorded as plugin.remove, and Open web UI as this person is audited. See Audit in the admin console.