API connections and the vault

A connection is an upstream HTTPS API that Claude can call with a secret it never sees — the engine or the probe injects the credential at call time. You register connections from the dashboard’s Connections page (the browser counterpart of the store_connection / connection_egress tools).

What a connection holds

• A label and a system (r1, sz, cp, or generic).
• An endpoint host and port.
• An auth-injection kind — bearer, basic, header, or query.
• An optional flag to tolerate a self-signed TLS cert (for on-prem controllers).
• A storage mode for the secret (below).

Storage modes

Where the secret lives decides what the connection can reach and how it survives a probe outage:

Mode	Where the secret lives	Reaches	Survives probe offline?
cloud	AES-256-GCM-encrypted in the cloud	Public endpoints only	Yes
probe_vault	Sealed end-to-end to the probe, on the probe only	LAN endpoints too	No
probe_vault_fallback	Probe vault plus a standing encrypted cloud copy	LAN + public	Yes

Use probe_vault when the credential must never leave the LAN and the target is a private/on-prem controller. Use cloud for public SaaS APIs. Use the fallback mode when you want LAN reach but also want egress to keep working if the probe drops.

The post-quantum probe vault

When you provision a probe_vault secret, your browser fetches the probe’s hybrid recipient keys (P-256 ECDH + ML-KEM-768), seals the secret locally, and posts only ciphertext. The cloud relays the sealed envelope to the probe and never sees the plaintext. On the probe, vault secrets are held encrypted with AES-256-GCM.

Break glass — temporary cloud access

A pure probe_vault connection stops working when the probe is offline, because the secret only exists on the probe. Break glass pushes an explicit, time-boxed encrypted cloud copy so connection_egress keeps working during an outage.

• You trigger it from the dashboard with a TTL — 15, 30, or 60 minutes (60 is the max).
• The copy is treated as gone the moment it expires, and a background sweep purges expired copies.
• Break glass is a dashboard-only action (session-authenticated browser → engine). It is deliberately not an MCP tool, so secrets never pass through the model channel.

Note

Break glass requires the engine to reach the upstream API directly (the cloud can’t reach the LAN), so it only helps for connections whose endpoint is publicly reachable.

Calling a connection

connection_egress makes the call. The secret is injected on the probe for the vault modes and in the cloud for cloud mode; either way it never enters the program Claude wrote. Responses are capped at 8 MiB and the upstream timeout is caller-set but capped at 9 seconds.

If a probe_vault connection is called while the probe is offline and no break-glass copy exists, the call returns no_cloud_secret — that error means “there is nowhere left to get the credential”, not that the connection is misconfigured.

The vault holds up to 128 entries per probe.

Next steps

Probe tools reference The connection and vault functions, and what each one returns.

Security model How secrets are encrypted at rest and sealed in transit.

Limits and budgets Egress timeouts, response caps, and the vault entry limit.