@nimbus-dev/connectors 0.1.0

package/connectors/localdb/src/tools.ts

@@ -0,0 +1,67 @@
+import { z } from "zod";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import {
+  filterSavedQueries,
+  getSavedQuery,
+  type SavedQuery,
+  scanSavedQueries,
+} from "./sql-scan.ts";
+
+/**
+ * Local DB Schema Indexing MCP tool surface. Reads saved `.sql` queries from the
+ * configured local DB-tool scripts dir — a pure filesystem read. No database is
+ * connected to and no query is executed; the SQL TEXT is returned for recall.
+ */
+export const LOCALDB_TOOL_NAMES = ["localdb_list", "localdb_get", "localdb_search"] as const;
+
+function toEnvelope(q: SavedQuery): Record<string, unknown> {
+  return {
+    relativePath: q.relativePath,
+    title: q.title,
+    sizeBytes: q.sizeBytes,
+    lineCount: q.lineCount,
+    sql: q.preview,
+  };
+}
+
+/**
+ * Register the read-only local-DB saved-query tools onto the given registrar.
+ * Shared between `server.ts` (live) and the contract test (introspection).
+ */
+export function registerLocaldbTools(reg: ZodToolRegistrar): void {
+  reg(
+    "localdb_list",
+    "List saved SQL queries read from the configured local DB-tool scripts directory (DBeaver/DataGrip/pgAdmin). Returns each query's relative path, title, size, line count, and SQL text. A pure filesystem read — no database is connected to and no query is executed.",
+    z.object({ limit: z.number().int().min(1).max(500).optional() }),
+    async (p) => {
+      const all = await scanSavedQueries();
+      const limit = p.limit ?? 100;
+      return jsonResult({ items: all.slice(0, limit).map(toEnvelope) });
+    },
+  );
+
+  reg(
+    "localdb_get",
+    "Fetch one saved SQL query by its relative path (within the configured scripts dir). Returns the SQL text + metadata. Never connects to a database.",
+    z.object({ relativePath: z.string().min(1).max(1024) }),
+    async (p) => {
+      const q = await getSavedQuery(p.relativePath);
+      return jsonResult(q === null ? { item: null } : { item: toEnvelope(q) });
+    },
+  );
+
+  reg(
+    "localdb_search",
+    "Substring search over saved SQL queries (matches the title, relative path, and SQL text). Returns the same view as localdb_list. Searches local files only.",
+    z.object({
+      query: z.string().min(1).max(500),
+      limit: z.number().int().min(1).max(500).optional(),
+    }),
+    async (p) => {
+      const all = await scanSavedQueries();
+      const matches = filterSavedQueries(all, p.query).slice(0, p.limit ?? 100);
+      return jsonResult({ matches: matches.map(toEnvelope) });
+    },
+  );
+}

package/connectors/looker/nimbus.extension.json

@@ -0,0 +1,16 @@
+{
+  "id": "com.nimbus.looker",
+  "displayName": "Looker",
+  "version": "0.1.0",
+  "description": "Looker connector. Indexes Looker dashboards and LookML views as `looker:dashboard` and `looker:data_model` items in the local index and exposes read tools (`looker_list`, `looker_get`, `looker_search`) plus HITL-gated write tools (`looker_datagroup_trigger`, `looker_schedule_run_once`). Uses the Looker API 4.0 with OAuth2 client-credentials auth (POST /api/4.0/login). The per-tenant base URL is supplied via the `looker.base_url` vault key and its hostname is added to the sandbox network list at spawn time by `phase3AddLookerMcp`, so the static manifest network list is intentionally empty. LookML view sql_table_name fields are normalized via normalizeDataModelKey to produce cross-connector lineage edges (Looker→dbt).",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": [],
+    "filesystem": { "read": [], "write": [] }
+  },
+  "hitlRequired": ["write"],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.5.0"
+}

package/connectors/looker/src/search-filter.ts

@@ -0,0 +1,22 @@
+import {
+  asRecord,
+  makeQueryFilter,
+  type SearchMatchOptions,
+} from "../../../shared/search-filter.ts";
+
+export type LookerSearchMatchOptions = SearchMatchOptions;
+
+function stringAt(row: Record<string, unknown>, key: string): string {
+  const v = row[key];
+  return typeof v === "string" ? v : "";
+}
+
+function fieldsOf(item: unknown): readonly string[] | null {
+  const row = asRecord(item);
+  if (row === undefined) {
+    return null;
+  }
+  return [stringAt(row, "title"), stringAt(row, "id")];
+}
+
+export const filterLookerDashboards = makeQueryFilter(fieldsOf);

package/connectors/looker/src/server.ts

@@ -0,0 +1,254 @@
+import { z } from "zod";
+import { type ConsentServer, createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
+import { searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { fetchWithTimeout, mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import {
+  runReadOnlyMcpConnector,
+  type ZodToolRegistrar,
+} from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterLookerDashboards } from "./search-filter.ts";
+
+function trimTrailingSlash(s: string): string {
+  return s.endsWith("/") ? s.slice(0, -1) : s;
+}
+
+function apiBase(): string {
+  const v = process.env["LOOKER_BASE_URL"]?.trim();
+  if (v === undefined || v === "") {
+    throw new Error("LOOKER_BASE_URL is not set");
+  }
+  return trimTrailingSlash(v);
+}
+
+function clientId(): string {
+  const v = process.env["LOOKER_CLIENT_ID"]?.trim();
+  if (v === undefined || v === "") {
+    throw new Error("LOOKER_CLIENT_ID is not set");
+  }
+  return v;
+}
+
+function clientSecret(): string {
+  const v = process.env["LOOKER_CLIENT_SECRET"]?.trim();
+  if (v === undefined || v === "") {
+    throw new Error("LOOKER_CLIENT_SECRET is not set");
+  }
+  return v;
+}
+
+async function lookerLogin(): Promise<string> {
+  const base = apiBase();
+  const body = `client_id=${encodeURIComponent(clientId())}&client_secret=${encodeURIComponent(clientSecret())}`;
+  const res = await fetchWithTimeout(`${base}/api/4.0/login`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded",
+      Accept: "application/json",
+    },
+    body,
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Looker login ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  const parsed = JSON.parse(text) as unknown;
+  const root =
+    parsed !== null && typeof parsed === "object" && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : null;
+  const token = typeof root?.["access_token"] === "string" ? root["access_token"] : null;
+  if (token === null || token === "") {
+    throw new Error("Looker login response missing access_token");
+  }
+  return token;
+}
+
+/** GET a Looker collection as a bare array. With a `page`, adds `?limit&offset`; else the default page. */
+async function getArray(
+  token: string,
+  path: string,
+  page?: { limit: number; offset: number },
+): Promise<unknown[]> {
+  const base = apiBase();
+  const qs = page === undefined ? "" : `?limit=${page.limit}&offset=${page.offset}`;
+  const res = await fetchWithTimeout(`${base}${path}${qs}`, {
+    headers: { Authorization: `Bearer ${token}`, Accept: "application/json" },
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Looker ${path} ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  const parsed = JSON.parse(text) as unknown;
+  return Array.isArray(parsed) ? parsed : [];
+}
+
+async function listDashboards(token: string): Promise<unknown[]> {
+  return getArray(token, "/api/4.0/dashboards");
+}
+
+/** Resolve an opaque offset cursor; null / "" / undefined → 0. */
+function offsetCursor(cursor: string | null | undefined): number {
+  return cursor === null || cursor === undefined || cursor === ""
+    ? 0
+    : Math.max(0, Number.parseInt(cursor, 10) || 0);
+}
+
+export function registerLookerTools(reg: ZodToolRegistrar, server: unknown): void {
+  // Despite the read-only helper's name, this connector exposes write tools. The consent
+  // kit needs the real server, which the helper now passes through as its second argument.
+  const registerWriteTool = createWriteToolRegistrar(server as ConsentServer, {
+    connector: "looker",
+    scopeEnv: "NIMBUS_MCP_LOOKER_WRITE_SCOPE",
+    scopeKinds: ["resource"],
+  });
+
+  reg(
+    "looker_list",
+    "List Looker dashboards (`GET /api/4.0/dashboards`). Requires a client-credentials login first. Paginated: `cursor` (opaque offset) + `limit` (default 200, max 500) → `{ items, nextCursor }`.",
+    z.object({
+      cursor: z.string().nullable().optional(),
+      limit: z.number().int().min(1).max(500).optional(),
+    }),
+    async (p) => {
+      const limit = p.limit ?? 200;
+      const offset = offsetCursor(p.cursor);
+      const token = await lookerLogin();
+      const items = await getArray(token, "/api/4.0/dashboards", { limit, offset });
+      return jsonResult({
+        items,
+        nextCursor: items.length === limit ? String(offset + limit) : null,
+      });
+    },
+  );
+
+  reg(
+    "looker_models_list",
+    "List LookML models (`GET /api/4.0/lookml_models`) for dashboard→table lineage. Paginated: `cursor` (opaque offset) + `limit` (default 200, max 500) → `{ items, nextCursor }`. Returns raw models (explores/views nested); the gateway flattens them.",
+    z.object({
+      cursor: z.string().nullable().optional(),
+      limit: z.number().int().min(1).max(500).optional(),
+    }),
+    async (p) => {
+      const limit = p.limit ?? 200;
+      const offset = offsetCursor(p.cursor);
+      const token = await lookerLogin();
+      const items = await getArray(token, "/api/4.0/lookml_models", { limit, offset });
+      return jsonResult({
+        items,
+        nextCursor: items.length === limit ? String(offset + limit) : null,
+      });
+    },
+  );
+
+  reg(
+    "looker_get",
+    "Fetch one Looker dashboard by its id. Throws when no dashboard with that id exists.",
+    z.object({
+      id: z.string().min(1),
+    }),
+    async (p) => {
+      const token = await lookerLogin();
+      const dashboards = await listDashboards(token);
+      const found = dashboards.find((d) => {
+        const obj =
+          d !== null && typeof d === "object" && !Array.isArray(d)
+            ? (d as Record<string, unknown>)
+            : null;
+        return obj?.["id"] === p.id;
+      });
+      if (found === undefined) {
+        throw new Error(`Looker dashboard not found: ${p.id}`);
+      }
+      return jsonResult(found);
+    },
+  );
+
+  reg(
+    "looker_search",
+    "Substring search across Looker dashboards. Matches the query (case-insensitive) against dashboard title and id. Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(200),
+    async (p) => {
+      const token = await lookerLogin();
+      const dashboards = await listDashboards(token);
+      const matches = filterLookerDashboards(dashboards, { query: p.query, limit: p.limit });
+      return jsonResult({ matches });
+    },
+  );
+
+  registerWriteTool(
+    "looker_datagroup_trigger",
+    {
+      mutates: "looker.datagroup.trigger",
+      recoverable: true,
+      scopeTargetOf: (p) => ({ kind: "resource", value: p.datagroupId }),
+    },
+    "Invalidate a Looker datagroup to force a PDT/cache rebuild (`PATCH /api/4.0/datagroups/{datagroupId}`). Sets `stale_before` to the current epoch so all cached results are considered stale. Requires HITL approval.",
+    z.object({
+      datagroupId: z.string().min(1),
+    }),
+    async (p) => {
+      const token = await lookerLogin();
+      const base = apiBase();
+      const epochSeconds = Math.floor(Date.now() / 1000);
+      const res = await fetchWithTimeout(
+        `${base}/api/4.0/datagroups/${encodeURIComponent(p.datagroupId)}`,
+        {
+          method: "PATCH",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+            Accept: "application/json",
+          },
+          body: JSON.stringify({ stale_before: epochSeconds }),
+        },
+      );
+      const text = await res.text();
+      if (!res.ok) {
+        throw new Error(`Looker datagroup trigger ${res.status}: ${text.slice(0, 400)}`);
+      }
+      return jsonResult({ status: "ok", datagroupId: p.datagroupId });
+    },
+  );
+
+  registerWriteTool(
+    "looker_schedule_run_once",
+    {
+      mutates: "looker.schedule.run_once",
+      recoverable: true,
+      scopeTargetOf: (p) => ({ kind: "resource", value: p.scheduledPlanId }),
+    },
+    "Run a Looker scheduled plan immediately (`POST /api/4.0/scheduled_plans/{scheduledPlanId}/run_once`). Triggers a one-off execution of the plan outside its normal schedule. Requires HITL approval.",
+    z.object({
+      scheduledPlanId: z.string().min(1),
+    }),
+    async (p) => {
+      const token = await lookerLogin();
+      const base = apiBase();
+      const res = await fetchWithTimeout(
+        `${base}/api/4.0/scheduled_plans/${encodeURIComponent(p.scheduledPlanId)}/run_once`,
+        {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${token}`,
+            "Content-Type": "application/json",
+            Accept: "application/json",
+          },
+          body: JSON.stringify({}),
+        },
+      );
+      const text = await res.text();
+      if (!res.ok) {
+        throw new Error(`Looker schedule run_once ${res.status}: ${text.slice(0, 400)}`);
+      }
+      return jsonResult({ status: "queued", scheduledPlanId: p.scheduledPlanId });
+    },
+  );
+}
+
+// Exported so the bundled-connector registry can start this server explicitly: `import.meta.main`
+// is false under an import, and the module must stay importable by tests without connecting stdio.
+export async function startConnector(): Promise<void> {
+  await runReadOnlyMcpConnector("nimbus-looker", registerLookerTools);
+}
+
+if (import.meta.main) await startConnector();

package/connectors/mendeley/nimbus.extension.json

@@ -0,0 +1,15 @@
+{
+  "id": "com.nimbus.mendeley",
+  "displayName": "Mendeley",
+  "version": "0.1.0",
+  "description": "Mendeley connector (read-only). Surfaces the metadata of the user's Mendeley reference library as `mendeley:reference` items in the local index — the title, the author list, the publication year, the source/publication, the document type, keywords, the DOI/identifiers, the source URL, and a truncated abstract. Binary PDF attachments are never fetched or parsed. Useful for research questions (\"what did I save about retrieval-augmented generation?\") without leaving Nimbus. Authenticates via the Elsevier OAuth2 authorization-code flow (confidential client); the user supplies their own NIMBUS_OAUTH_MENDELEY_CLIENT_ID / _SECRET. The SaaS host (api.mendeley.com) is fixed. The /documents endpoint paginates via RFC 5988 Link headers (rel=\"next\"); the connector walks a single page-capped forward pass per cycle and supports modified_since incremental pulls.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["api.mendeley.com"]
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/mendeley/src/search-filter.ts

@@ -0,0 +1,68 @@
+import {
+  asObjectish,
+  makeQueryFilter,
+  type SearchMatchOptions,
+  stringField,
+} from "../../../shared/search-filter.ts";
+
+export type MendeleySearchMatchOptions = SearchMatchOptions;
+
+function nonEmptyString(v: unknown): string | null {
+  return typeof v === "string" && v !== "" ? v : null;
+}
+
+function authorName(a: unknown): string | null {
+  if (a === null || typeof a !== "object") {
+    return null;
+  }
+  const row = a as Record<string, unknown>;
+  const parts = [nonEmptyString(row["first_name"]), nonEmptyString(row["last_name"])].filter(
+    (p): p is string => p !== null,
+  );
+  return parts.length > 0 ? parts.join(" ") : null;
+}
+
+function authorNames(doc: Record<string, unknown>): string {
+  const authors = doc["authors"];
+  if (!Array.isArray(authors)) {
+    return "";
+  }
+  const names: string[] = [];
+  for (const a of authors) {
+    const name = authorName(a);
+    if (name !== null) {
+      names.push(name);
+    }
+  }
+  return names.join(" ");
+}
+
+function keywordNames(doc: Record<string, unknown>): string {
+  const keywords = doc["keywords"];
+  return Array.isArray(keywords)
+    ? keywords.filter((k): k is string => typeof k === "string").join(" ")
+    : "";
+}
+
+function doi(doc: Record<string, unknown>): string {
+  const ids = asObjectish(doc["identifiers"]);
+  return ids === undefined ? "" : stringField(ids, "doi");
+}
+
+function fieldsOf(item: unknown): readonly string[] | null {
+  const doc = asObjectish(item);
+  if (doc === undefined) {
+    return null;
+  }
+  return [
+    stringField(doc, "title"),
+    stringField(doc, "type"),
+    stringField(doc, "abstract"),
+    stringField(doc, "source"),
+    doi(doc),
+    authorNames(doc),
+    keywordNames(doc),
+  ];
+}
+
+export const filterMendeleyDocuments = makeQueryFilter(fieldsOf);

package/connectors/mendeley/src/server.ts

@@ -0,0 +1,59 @@
+import { z } from "zod";
+import { matchesResult } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterMendeleyDocuments } from "./search-filter.ts";
+
+const BASE = "https://api.mendeley.com";
+const DOC_ACCEPT = "application/vnd.mendeley-document.1+json";
+
+function accessToken(): string {
+  const t = process.env["MENDELEY_ACCESS_TOKEN"]?.trim();
+  if (t === undefined || t === "") {
+    throw new Error("MENDELEY_ACCESS_TOKEN is not set");
+  }
+  return t;
+}
+
+async function mendeleyGet(path: string): Promise<unknown> {
+  const res = await fetch(`${BASE}${path}`, {
+    headers: { Authorization: `Bearer ${accessToken()}`, Accept: DOC_ACCEPT },
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    // Include the HTTP status so an expired token (401) surfaces explicitly to the
+    // gateway client; matches the zotero server's error shape.
+    throw new Error(`Mendeley ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+await runReadOnlyMcpConnector("nimbus-mendeley", (reg) => {
+  reg(
+    "mendeley_list",
+    "List the user's Mendeley library documents (`GET /documents?view=all&limit=100`). Returns the raw JSON array of document objects — each is `{ id, title, type, authors, year, source, identifiers: { doi, ... }, keywords, abstract, last_modified, websites, ... }`.",
+    z.object({}),
+    async () => {
+      return jsonResult(await mendeleyGet(`/documents?view=all&limit=100`));
+    },
+  );
+
+  reg(
+    "mendeley_get",
+    "Fetch one Mendeley document by its id (`GET /documents/{id}?view=all`). Returns the document object directly (NOT wrapped in an array). Throws when no match is found.",
+    z.object({ id: z.string().min(1) }),
+    async (p) => {
+      return jsonResult(await mendeleyGet(`/documents/${encodeURIComponent(p.id)}?view=all`));
+    },
+  );
+
+  reg(
+    "mendeley_search",
+    "Substring search across the first page of the user's library documents. Matches the query against the title, document type, abstract, source, DOI, formatted author names, and keywords (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    z.object({ query: z.string().min(1), limit: z.number().int().min(1).max(100).optional() }),
+    async (p) => {
+      const root = await mendeleyGet(`/documents?view=all&limit=100`);
+      return matchesResult(root, filterMendeleyDocuments, p);
+    },
+  );
+});

package/connectors/mercury/nimbus.extension.json

@@ -0,0 +1,15 @@
+{
+  "id": "com.nimbus.mercury",
+  "displayName": "Mercury",
+  "version": "0.1.0",
+  "description": "Mercury business-banking connector (read-only). Surfaces the user's bank accounts as `mercury:account` items in the local index — account name, status (active/archived), type/kind (checking/savings), the last 4 digits of the account number (the full number is never stored), routing number, available + current USD balances, the legal business name, and the open date. Useful for answering banking questions (\"what's my checking balance?\", \"which accounts are archived?\") without leaving Nimbus. Bearer API-token auth. The SaaS host (api.mercury.com) is fixed. Mercury balances are USD major units (dollars, not cents) and `createdAt` is ISO-8601 (converted to epoch-ms on index). Transactions / bills / statements and the wire / ACH (HITL) writes are deferred follow-ups.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["api.mercury.com"]
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/mercury/src/search-filter.ts

@@ -0,0 +1,11 @@
+import {
+  fieldsFromKeys,
+  makeQueryFilter,
+  type SearchMatchOptions,
+} from "../../../shared/search-filter.ts";
+
+export type MercurySearchMatchOptions = SearchMatchOptions;
+
+export const filterMercuryAccounts = makeQueryFilter(
+  fieldsFromKeys(["id", "name", "status", "type", "kind", "legalBusinessName"]),
+);

package/connectors/mercury/src/server.ts

@@ -0,0 +1,61 @@
+import { z } from "zod";
+import { matchesResult, searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterMercuryAccounts } from "./search-filter.ts";
+
+const BASE = "https://api.mercury.com";
+
+function apiToken(): string {
+  const t = process.env["MERCURY_TOKEN"]?.trim();
+  if (t === undefined || t === "") {
+    throw new Error("MERCURY_TOKEN is not set");
+  }
+  return t;
+}
+
+function authHeader(): Record<string, string> {
+  return { Authorization: `Bearer ${apiToken()}`, Accept: "application/json" };
+}
+
+async function mercuryGet(path: string): Promise<unknown> {
+  const res = await fetch(`${BASE}${path}`, { headers: authHeader() });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Mercury ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+await runReadOnlyMcpConnector("nimbus-mercury", (reg) => {
+  reg(
+    "mercury_list",
+    "List the user's Mercury bank accounts (`GET /api/v1/accounts`). Returns the `{ accounts: [...] }` envelope. There is no pagination — Mercury returns the full account list in one call.",
+    z.object({}),
+    async () => {
+      return jsonResult(await mercuryGet(`/api/v1/accounts`));
+    },
+  );
+
+  reg(
+    "mercury_get",
+    "Fetch one Mercury account by its id (`GET /api/v1/account/{id}`, note the singular `account` in the path). Returns the account object directly. Throws when no match is found.",
+    z.object({
+      id: z.string().min(1),
+    }),
+    async (p) => {
+      return jsonResult(await mercuryGet(`/api/v1/account/${encodeURIComponent(p.id)}`));
+    },
+  );
+
+  reg(
+    "mercury_search",
+    "Substring search across the user's Mercury accounts. Matches the query against id, name, status, type, kind, and the legal business name (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(100),
+    async (p) => {
+      const root = await mercuryGet(`/api/v1/accounts`);
+      const accounts = (root as { accounts?: unknown[] } | null)?.accounts;
+      return matchesResult(accounts, filterMercuryAccounts, p);
+    },
+  );
+});

package/connectors/metabase/nimbus.extension.json

@@ -0,0 +1,16 @@
+{
+  "id": "com.nimbus.metabase",
+  "displayName": "Metabase",
+  "version": "0.1.0",
+  "description": "Metabase connector (read-only). Surfaces Metabase dashboards — name, description, collection, creator, archived flag, card count, created/updated timestamps — into the local index as `metabase:dashboard` items, with the dashboard's collection name resolved from a single `GET /api/collection` call. Metabase API-key auth (sent as the `x-api-key` request header, NOT `Authorization`). Metabase has no universal SaaS host: the server host is supplied via the `metabase.url` vault key and added to the sandbox network list at spawn time by `phase3AddMetabaseMcp`, so the static manifest network list is intentionally empty. v1 indexes dashboards only — saved questions (cards) and collections-as-items are a deferred follow-up. No write tools.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": [],
+    "filesystem": { "read": [], "write": [] }
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/metabase/src/search-filter.ts

@@ -0,0 +1,22 @@
+import {
+  asRecord,
+  makeQueryFilter,
+  type SearchMatchOptions,
+} from "../../../shared/search-filter.ts";
+
+export type MetabaseSearchMatchOptions = SearchMatchOptions;
+
+function stringAt(row: Record<string, unknown>, key: string): string {
+  const v = row[key];
+  return typeof v === "string" ? v : "";
+}
+
+function fieldsOf(item: unknown): readonly string[] | null {
+  const row = asRecord(item);
+  if (row === undefined) {
+    return null;
+  }
+  return [stringAt(row, "name"), stringAt(row, "description")];
+}
+
+export const filterMetabaseDashboards = makeQueryFilter(fieldsOf);