Skip to main content
Most MCP servers worth connecting want to know who you are. Splox holds that credential for you: your harness never sees it, and neither does the agent. This page is what happens between clicking Connect and having a working tool.

​
Two kinds of authentication

A catalog entry declares which one it uses in auth_type.
You are sent to the provider, you approve the scopes there, and you come back to Splox with a token it stores. The screen says it plainly: “You will be redirected to Linear to authorize access. We never see your password.”The scopes are fixed by the catalog entry, not by you. Reddit’s, for example:
Read that line before connecting. submit and vote are the ones that mean an agent can post as you.
Connecting X (Twitter) with API keys

A manual entry asks for the provider's own credential names

For a server of your own, “manual” means HTTP headers: you add Authorization: Bearer … or X-Api-Key: … yourself in the Add MCP server form.

​
Where the secret lives

With the platform, in one row per connection. The list endpoint the app calls tells you whether there is a credential and when it expires, and never what it is:
That is the whole security story, and it is short on purpose:
  • The credential is attached to the connection, not to a harness or an agent. Publishing a version, cloning a harness or handing it to somebody else moves no secret.
  • A run calls the tool; the platform attaches the credential on the way out. The model is never shown it, so it cannot be leaked in a transcript or a run’s events.
  • Two accounts on the same provider are two connections with two names.

​
Changing a credential

Click the connected server. The form comes back pre-filled with the name and empty credential fields — “Update your credentials below. Leave fields blank to keep existing values.” Fill only what rotated and press Update connection.

​
Revoking

The trash icon on the card removes the connection.
It leaves your list immediately, and an agent whose tools entry names that uuid is left with a source that has nothing behind it — so remove the entry from programs/<name>/main.py too. Access you granted at the provider’s own site is revoked there, in the provider’s settings; deleting the connection here does not sign you out over there.

​
Environment secrets

A different thing on a nearby screen. Connections → Secrets holds key/value pairs that are injected as environment variables into your agent’s sandbox — for the agent and its sub-agents, in every chat.
The Secrets tab of the Splox Connections screen

Connections → Secrets: key/value, encrypted, never shown again

Use these for the credentials that are not an MCP server’s: a bot token, an API key your own tools/ file needs, anything a script on the machine reads. The value is write-once — after saving, the screen shows the key and not the value. The agent is told the names and reads the values from the environment:
The key names travel to the agent in ~/tools/catalog.json under env_secrets, which is how a prompt can say “you have a Telegram token” without ever printing one.
An environment variable is readable by anything running in that sandbox, including a shell command the model writes. That is the trade for making it usable from code. A secret that must never be in a sandbox belongs in an MCP connection instead, where the platform attaches it outside the machine.

​
Model providers

The Providers tab on the same screen is not about tools at all — it is where you attach your own OpenAI, Anthropic, Gemini or ChatGPT account so agents can run on it instead of on the platform’s. See Models and LLM endpoints.