@nimbus-dev/connectors 0.1.0

package/connectors/readwise/src/server.ts

@@ -0,0 +1,92 @@
+import { z } from "zod";
+import { matchesResult, searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterReadwiseBooks, filterReadwiseHighlights } from "./search-filter.ts";
+
+const BASE = "https://readwise.io";
+
+function apiToken(): string {
+  const t = process.env["READWISE_TOKEN"]?.trim();
+  if (t === undefined || t === "") {
+    throw new Error("READWISE_TOKEN is not set");
+  }
+  return t;
+}
+
+function authHeader(): Record<string, string> {
+  return { Authorization: `Token ${apiToken()}`, Accept: "application/json" };
+}
+
+async function readwiseGet(path: string): Promise<unknown> {
+  const res = await fetch(`${BASE}${path}`, { headers: authHeader() });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Readwise ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+await runReadOnlyMcpConnector("nimbus-readwise", (reg) => {
+  reg(
+    "readwise_list",
+    "List the user's Readwise highlights (`GET /api/v2/highlights/?page_size=1000`). Returns the DRF `{ count, next, previous, results: [...] }` envelope — `results` holds the highlight objects and `next` is the next-page URL (null on the last page).",
+    z.object({}),
+    async () => {
+      return jsonResult(await readwiseGet(`/api/v2/highlights/?page_size=1000`));
+    },
+  );
+
+  reg(
+    "readwise_get",
+    "Fetch one Readwise highlight by its id (`GET /api/v2/highlights/{id}/`). Returns the highlight object directly. Throws when no match is found.",
+    z.object({
+      id: z.string().min(1),
+    }),
+    async (p) => {
+      return jsonResult(await readwiseGet(`/api/v2/highlights/${encodeURIComponent(p.id)}/`));
+    },
+  );
+
+  reg(
+    "readwise_search",
+    "Substring search across the user's Readwise highlights (first page only). Matches the query against the highlight text, the user's note, color, location_type, and tag names (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(100),
+    async (p) => {
+      const root = await readwiseGet(`/api/v2/highlights/?page_size=1000`);
+      const results = (root as { results?: unknown[] } | null)?.results;
+      return matchesResult(results, filterReadwiseHighlights, p);
+    },
+  );
+
+  reg(
+    "readwise_books_list",
+    "List the user's Readwise books/articles (`GET /api/v2/books/?page_size=1000`) — the parent records a highlight's `book_id` points at. Returns the same DRF `{ count, next, previous, results: [...] }` envelope as `readwise_list`; `results` holds the book objects (`id`, `title`, `author`, `category`, `source`, `num_highlights`, `highlights_url`, `source_url`, `asin`, `tags`, `document_note`).",
+    z.object({}),
+    async () => {
+      return jsonResult(await readwiseGet(`/api/v2/books/?page_size=1000`));
+    },
+  );
+
+  reg(
+    "readwise_book_get",
+    "Fetch one Readwise book/article by its id (`GET /api/v2/books/{id}/`). Note the id space is SEPARATE from the highlight id space — pass a highlight's `book_id`, not its `id`. Returns the book object directly. Throws when no match is found.",
+    z.object({
+      id: z.string().min(1),
+    }),
+    async (p) => {
+      return jsonResult(await readwiseGet(`/api/v2/books/${encodeURIComponent(p.id)}/`));
+    },
+  );
+
+  reg(
+    "readwise_books_search",
+    "Substring search across the user's Readwise books/articles (first page only). Matches the query against the title, author, category, source, the user's document note, and tag names (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(100),
+    async (p) => {
+      const root = await readwiseGet(`/api/v2/books/?page_size=1000`);
+      const results = (root as { results?: unknown[] } | null)?.results;
+      return matchesResult(results, filterReadwiseBooks, p);
+    },
+  );
+});

package/connectors/sagemaker/nimbus.extension.json

@@ -0,0 +1,15 @@
+{
+  "id": "com.nimbus.sagemaker",
+  "displayName": "Amazon SageMaker",
+  "version": "0.1.0",
+  "description": "Amazon SageMaker model-registry metadata connector (Tier-3, no-row-data). Indexes ML-model REGISTRY metadata only — model name, ARN, primary-container image reference, model-data S3 URL (a pointer string, not the bytes), execution-role ARN, and creation time — via the AWS CLI's SageMaker list-models and describe-model commands. Never invokes an endpoint and never fetches inference data, training data, or model-artifact bytes: there is no sagemaker-runtime invoke-endpoint and no predict/query/records path. Reuses the existing AWS credentials via the aws CLI. Read-only; no write tools.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["sts.amazonaws.com"]
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/sagemaker/src/server.ts

@@ -0,0 +1,6 @@
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { registerSagemakerTools } from "./tools.ts";
+
+await runReadOnlyMcpConnector("nimbus-sagemaker", (reg) => {
+  registerSagemakerTools(reg);
+});

package/connectors/sagemaker/src/tools.ts

@@ -0,0 +1,121 @@
+import { z } from "zod";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { nimbusSpawn } from "../../../shared/nimbus-spawn.ts";
+import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import { isSafeCliArg } from "../../../shared/safe-cli-arg.ts";
+
+/**
+ * A SageMaker model name passed as a value to the `aws sagemaker` CLI. Rejected
+ * at the schema boundary if it begins with `-` (argv flag smuggling) or contains
+ * control characters. Exported so the contract test can assert the guard rejects
+ * a `-`-prefixed value.
+ */
+export const cliArg = z
+  .string()
+  .min(1)
+  .refine(isSafeCliArg, { message: 'must not start with "-" or contain control characters' });
+
+/**
+ * Amazon SageMaker (Tier-3, metadata-only) MCP tool surface. ALL tools index
+ * model-REGISTRY metadata only (model name, ARN, primary-container image
+ * reference, model-data S3 URL pointer, execution-role ARN, creation time).
+ * NONE fetch inference / training / model-artifact data — there is NO
+ * `invoke-endpoint`, NO `sagemaker-runtime`, NO predict/query/records path. The
+ * names are introspected by the `assertNoRowDataTools` contract test, so they
+ * must never contain a row-data segment (invoke/predict/query/records/scan/…).
+ */
+export const SAGEMAKER_TOOL_NAMES = [
+  "sagemaker_list",
+  "sagemaker_get",
+  "sagemaker_search",
+] as const;
+
+const PAGE = "50";
+
+function isRecord(v: unknown): v is Record<string, unknown> {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+
+function strField(r: Record<string, unknown>, key: string): string {
+  const v = r[key];
+  return typeof v === "string" ? v : "";
+}
+
+function asArray(parsed: unknown, key: string): unknown[] {
+  if (!isRecord(parsed)) {
+    return [];
+  }
+  const arr = parsed[key];
+  return Array.isArray(arr) ? arr : [];
+}
+
+/**
+ * Run `aws sagemaker <args> --output json` and parse stdout. The AWS CLI reads
+ * AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY / AWS_DEFAULT_REGION / AWS_PROFILE
+ * natively from the process env injected at spawn time. Throws on non-zero exit.
+ */
+async function sagemakerCli(args: string[]): Promise<unknown> {
+  const { code, stdout, stderr } = await nimbusSpawn(
+    ["aws", "sagemaker", ...args, "--output", "json"],
+    {},
+  );
+  const out = stdout.trim();
+  const err = stderr.trim();
+  if (code !== 0) {
+    throw new Error(`aws sagemaker ${args[0] ?? ""} failed: ${err.slice(0, 400)}`);
+  }
+  return out === "" ? {} : (JSON.parse(out) as unknown);
+}
+
+function modelMatches(entry: unknown, q: string): boolean {
+  if (!isRecord(entry)) {
+    return false;
+  }
+  return strField(entry, "ModelName").toLowerCase().includes(q.toLowerCase());
+}
+
+/**
+ * Register the read-only, metadata-only SageMaker tools onto the given
+ * registrar. Shared between `server.ts` (live) and the contract test
+ * (introspection).
+ */
+export function registerSagemakerTools(reg: ZodToolRegistrar): void {
+  reg(
+    "sagemaker_list",
+    "List Amazon SageMaker models — METADATA ONLY (`aws sagemaker list-models`). Each entry carries `ModelName`, `ModelArn`, and `CreationTime`. Optionally filter by a `nameContains` substring on the model name. Never invokes an endpoint and never fetches inference / training / model-artifact data.",
+    z.object({
+      nameContains: cliArg.optional(),
+    }),
+    async (p) => {
+      const args = ["list-models", "--max-results", PAGE];
+      if (p.nameContains !== undefined) {
+        args.push("--name-contains", p.nameContains);
+      }
+      return jsonResult(await sagemakerCli(args));
+    },
+  );
+
+  reg(
+    "sagemaker_get",
+    "Fetch one Amazon SageMaker model's METADATA (`aws sagemaker describe-model`). Returns the model object including `ModelName`, `ModelArn`, `PrimaryContainer` (container `Image` reference + `ModelDataUrl` S3 pointer — a URI string, NOT the model bytes), `ExecutionRoleArn`, and `CreationTime`. No inference, training, or model-artifact data is returned — registry metadata only.",
+    z.object({
+      modelName: cliArg,
+    }),
+    async (p) => {
+      return jsonResult(await sagemakerCli(["describe-model", "--model-name", p.modelName]));
+    },
+  );
+
+  reg(
+    "sagemaker_search",
+    "Substring search over Amazon SageMaker model NAMES (case-insensitive) — METADATA ONLY. Returns a `{ matches: [...] }` envelope of `list-models` metadata entries whose `ModelName` contains the query. Never invokes an endpoint and never fetches inference / training / model-artifact data.",
+    z.object({
+      query: z.string().min(1),
+    }),
+    async (p) => {
+      const root = await sagemakerCli(["list-models", "--max-results", PAGE]);
+      const matches = asArray(root, "Models").filter((m) => modelMatches(m, p.query));
+      return jsonResult({ matches });
+    },
+  );
+}

package/connectors/salesforce/nimbus.extension.json

@@ -0,0 +1,15 @@
+{
+  "id": "com.nimbus.salesforce",
+  "displayName": "Salesforce",
+  "version": "0.1.0",
+  "description": "Salesforce connector (read-only). Surfaces a tenant's Opportunities as salesforce:opportunity items in the local index via the SOQL query API — GET <instance_url>/services/data/v60.0/query?q=<SOQL> over the Opportunity sObject — capturing each opportunity's name, stage, amount, close date, probability, type, and won/closed flags. Three-legged OAuth auth (Authorization: Bearer <token>; short-lived access token refreshed by the Gateway via the authorization-code-with-PKCE flow; never logged). The per-tenant API host (instance_url) is discovered at OAuth time and injected at spawn; the only fixed host declared here is login.salesforce.com (the authorize/token host) — the instance host is added to the sandbox manifest at spawn via the lazy-mesh extra-hosts path. SOQL query responses page via { records, done, nextRecordsUrl }, walked forward per cycle, page-capped. Read-only — hitlRequired is intentionally empty. Sparse structured opportunity metadata.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["login.salesforce.com"]
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/salesforce/src/search-filter.ts

@@ -0,0 +1,23 @@
+import {
+  asObjectish,
+  makeQueryFilter,
+  type SearchMatchOptions,
+  stringField,
+} from "../../../shared/search-filter.ts";
+
+export type SalesforceSearchMatchOptions = SearchMatchOptions;
+
+/**
+ * Salesforce Opportunity records are flat objects with PascalCase fields:
+ * `{ Id, Name, StageName, Amount, CloseDate, Type, ... }`. Match (case-insensitive
+ * substring) against the opportunity name, its stage, and its type.
+ */
+function fieldsOf(item: unknown): readonly string[] | null {
+  const row = asObjectish(item);
+  if (row === undefined) {
+    return null;
+  }
+  return [stringField(row, "Name"), stringField(row, "StageName"), stringField(row, "Type")];
+}
+
+export const filterSalesforceOpportunities = makeQueryFilter(fieldsOf);

package/connectors/salesforce/src/server.ts

@@ -0,0 +1,94 @@
+import { z } from "zod";
+import { searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterSalesforceOpportunities } from "./search-filter.ts";
+
+const API_VERSION = "v60.0";
+const OPPORTUNITY_FIELDS =
+  "Id, Name, StageName, Amount, CloseDate, Probability, Type, IsClosed, IsWon, LastModifiedDate, CreatedDate";
+
+function accessToken(): string {
+  const t = process.env["SALESFORCE_ACCESS_TOKEN"]?.trim();
+  if (t === undefined || t === "") {
+    throw new Error("SALESFORCE_ACCESS_TOKEN is not set");
+  }
+  return t;
+}
+
+function instanceUrl(): string {
+  let raw = process.env["SALESFORCE_INSTANCE_URL"]?.trim();
+  if (raw === undefined || raw === "") {
+    throw new Error("SALESFORCE_INSTANCE_URL is not set");
+  }
+  // Strip trailing slashes without a backtracking regex.
+  while (raw.endsWith("/")) {
+    raw = raw.slice(0, -1);
+  }
+  return raw;
+}
+
+function authHeader(): Record<string, string> {
+  return { Authorization: `Bearer ${accessToken()}`, Accept: "application/json" };
+}
+
+async function salesforceGet(path: string): Promise<unknown> {
+  const res = await fetch(`${instanceUrl()}${path}`, { headers: authHeader() });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Salesforce ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+function recordsFrom(root: unknown): unknown[] {
+  const records = (root as { records?: unknown } | null)?.records;
+  return Array.isArray(records) ? records : [];
+}
+
+function listQueryPath(limit: number): string {
+  const soql = `SELECT ${OPPORTUNITY_FIELDS} FROM Opportunity ORDER BY LastModifiedDate DESC LIMIT ${String(limit)}`;
+  return `/services/data/${API_VERSION}/query?q=${encodeURIComponent(soql)}`;
+}
+
+await runReadOnlyMcpConnector("nimbus-salesforce", (reg) => {
+  reg(
+    "salesforce_list",
+    "List the authenticated org's Salesforce Opportunities via the SOQL query API (GET <instance_url>/services/data/v60.0/query?q=SELECT ... FROM Opportunity ORDER BY LastModifiedDate DESC LIMIT N). Returns the { totalSize, done, records: [...], nextRecordsUrl? } envelope — `records` holds the Opportunity objects, each shaped { Id, Name, StageName, Amount, CloseDate, Probability, Type, IsClosed, IsWon, LastModifiedDate, CreatedDate }. `limit` (default 200) caps the single first-page request; when `done` is false a `nextRecordsUrl` cursor is present for the next page (the local Nimbus index has full coverage).",
+    z.object({
+      limit: z.number().int().min(1).max(2000).optional(),
+    }),
+    async (p) => {
+      return jsonResult(await salesforceGet(listQueryPath(p.limit ?? 200)));
+    },
+  );
+
+  reg(
+    "salesforce_get",
+    "Fetch one Salesforce Opportunity by its 15- or 18-character Id (GET <instance_url>/services/data/v60.0/sobjects/Opportunity/<id>). Returns the Opportunity object directly (NOT wrapped in `records`). Throws when no Opportunity with that id exists or is accessible.",
+    z.object({
+      id: z.string().min(1),
+    }),
+    async (p) => {
+      return jsonResult(
+        await salesforceGet(
+          `/services/data/${API_VERSION}/sobjects/Opportunity/${encodeURIComponent(p.id)}`,
+        ),
+      );
+    },
+  );
+
+  reg(
+    "salesforce_search",
+    "**Substring search over the FIRST PAGE only** (up to the queried limit of most-recently-modified Opportunities) of the authenticated org's Salesforce Opportunities. This tool runs the SOQL query once and matches the query locally (case-insensitive) against each opportunity's name, stage, and type. **Opportunities beyond the first page are not searchable here — query the local Nimbus index instead for full coverage.** Returns a { matches: [...] } envelope.",
+    searchToolInputSchema(2000),
+    async (p) => {
+      const root = await salesforceGet(listQueryPath(2000));
+      const matches = filterSalesforceOpportunities(recordsFrom(root), {
+        query: p.query,
+        limit: p.limit,
+      });
+      return jsonResult({ matches });
+    },
+  );
+});

package/connectors/semgrep/nimbus.extension.json

@@ -0,0 +1,15 @@
+{
+  "id": "com.nimbus.semgrep",
+  "displayName": "Semgrep",
+  "version": "0.1.0",
+  "description": "Semgrep AppSec Platform connector (SAST findings, rule matches, triage state). Read-only; surfaces severity, rule_id, file/line, repository, triage_state into the local index. Self-hosted Semgrep Enterprise instances are a known Task 14 runtime-merge follow-up — the SaaS host (semgrep.dev) is the only one in the static sandbox manifest today.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["semgrep.dev"]
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/semgrep/src/search-filter.ts

@@ -0,0 +1,31 @@
+import {
+  asObjectish,
+  makeQueryFilter,
+  type SearchMatchOptions,
+  stringField,
+} from "../../../shared/search-filter.ts";
+
+export type SemgrepSearchMatchOptions = SearchMatchOptions;
+
+function nestedString(row: Record<string, unknown>, parent: string, key: string): string {
+  const p = row[parent];
+  if (p === null || typeof p !== "object") {
+    return "";
+  }
+  return stringField(p as Record<string, unknown>, key);
+}
+
+function fieldsOf(item: unknown): readonly string[] | null {
+  const row = asObjectish(item);
+  if (row === undefined) {
+    return null;
+  }
+  return [
+    stringField(row, "rule_name"),
+    stringField(row, "rule_message"),
+    nestedString(row, "location", "file_path"),
+    nestedString(row, "repository", "name"),
+  ];
+}
+
+export const filterSemgrepFindings = makeQueryFilter(fieldsOf);

package/connectors/semgrep/src/server.ts

@@ -0,0 +1,108 @@
+import { z } from "zod";
+import { matchesResult, searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterSemgrepFindings } from "./search-filter.ts";
+
+const SEMGREP_API = "https://semgrep.dev/api/v1";
+const SEVERITIES = ["critical", "high", "medium", "low", "info"] as const;
+const STATUSES = ["open", "ignored", "fixed", "removed"] as const;
+
+function deploymentSlug(): string | undefined {
+  const v = process.env["SEMGREP_DEPLOYMENT_SLUG"]?.trim();
+  return v === undefined || v === "" ? undefined : v;
+}
+
+function authHeader(): Record<string, string> {
+  const t = process.env["SEMGREP_TOKEN"]?.trim();
+  if (t === undefined || t === "") {
+    throw new Error("SEMGREP_TOKEN is not set");
+  }
+  return { Authorization: `Bearer ${t}`, Accept: "application/json" };
+}
+
+async function semgrepGet(path: string): Promise<unknown> {
+  const res = await fetch(`${SEMGREP_API}${path}`, { headers: authHeader() });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Semgrep ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+function requireSlug(): string {
+  const slug = deploymentSlug();
+  if (slug === undefined) {
+    throw new Error("SEMGREP_DEPLOYMENT_SLUG is not set");
+  }
+  return slug;
+}
+
+await runReadOnlyMcpConnector("nimbus-semgrep", (reg) => {
+  reg(
+    "semgrep_list",
+    "List Semgrep deployments, or open findings for the configured deployment. When called without filters, returns the user's deployments (`/deployments`). Provide a `severity` or `status` filter to query findings under the deployment slug from `SEMGREP_DEPLOYMENT_SLUG` env.",
+    z.object({
+      severity: z.array(z.enum(SEVERITIES)).min(1).optional(),
+      status: z.array(z.enum(STATUSES)).min(1).optional(),
+      repository: z.string().min(1).optional(),
+      limit: z.number().int().min(1).max(500).optional(),
+    }),
+    async (p) => {
+      if (p.severity === undefined && p.status === undefined && p.repository === undefined) {
+        return jsonResult(await semgrepGet("/deployments"));
+      }
+      const slug = requireSlug();
+      const search = new URLSearchParams({
+        page_size: String(p.limit ?? 100),
+      });
+      if (p.severity !== undefined && p.severity.length > 0) {
+        search.set("severities", p.severity.join(","));
+      }
+      if (p.status !== undefined && p.status.length > 0) {
+        search.set("statuses", p.status.join(","));
+      }
+      if (p.repository !== undefined) {
+        search.set("repos", p.repository);
+      }
+      const path = `/deployments/${encodeURIComponent(slug)}/findings?${search.toString()}`;
+      return jsonResult(await semgrepGet(path));
+    },
+  );
+
+  reg(
+    "semgrep_get",
+    "Fetch one Semgrep finding by id from the configured deployment. Returns the matching finding envelope; throws when no match is found.",
+    z.object({
+      findingId: z.string().min(1),
+    }),
+    async (p) => {
+      const slug = requireSlug();
+      const search = new URLSearchParams({ ids: p.findingId, page_size: "1" });
+      const path = `/deployments/${encodeURIComponent(slug)}/findings?${search.toString()}`;
+      const root = await semgrepGet(path);
+      const findings = (root as { findings?: unknown[] } | null)?.findings;
+      if (!Array.isArray(findings) || findings.length === 0) {
+        throw new Error(`Semgrep: finding ${p.findingId} not found`);
+      }
+      return jsonResult(findings[0]);
+    },
+  );
+
+  reg(
+    "semgrep_search",
+    "Substring search across the deployment's open findings. Matches the query against `rule_name`, `rule_message`, `location.file_path`, and `repository.name` (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(200),
+    async (p) => {
+      const slug = requireSlug();
+      const search = new URLSearchParams({
+        statuses: "open",
+        page_size: "500",
+      });
+      const path = `/deployments/${encodeURIComponent(slug)}/findings?${search.toString()}`;
+      const root = await semgrepGet(path);
+      const findings = (root as { findings?: unknown[] } | null)?.findings;
+      return matchesResult(findings, filterSemgrepFindings, p);
+    },
+  );
+});

package/connectors/sentry/nimbus.extension.json

@@ -0,0 +1,15 @@
+{
+  "id": "com.nimbus.sentry",
+  "displayName": "Sentry",
+  "version": "0.1.0",
+  "description": "Sentry REST connector (issues, events, releases). Self-hosted Sentry (sentry.url) is a known Task 14 follow-up. Read-focused.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["sentry.io"]
+  },
+  "hitlRequired": [],
+  "syncInterval": 300,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/sentry/src/server.ts

@@ -0,0 +1,66 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+
+import {
+  createRegisterSimpleTool,
+  createZodToolRegistrar,
+  mcpJsonResult as jsonResult,
+} from "../../../shared/mcp-tool-kit.ts";
+
+function apiRoot(): string {
+  const u = process.env["SENTRY_URL"]?.trim() || "https://sentry.io";
+  return `${u.replace(/\/$/, "")}/api/0`;
+}
+
+function org(): string {
+  const o = process.env["SENTRY_ORG_SLUG"]?.trim();
+  if (o === undefined || o === "") {
+    throw new Error("SENTRY_ORG_SLUG is not set");
+  }
+  return o;
+}
+
+function headers(): Record<string, string> {
+  const t = process.env["SENTRY_AUTH_TOKEN"]?.trim();
+  if (t === undefined || t === "") {
+    throw new Error("SENTRY_AUTH_TOKEN is not set");
+  }
+  return { Authorization: `Bearer ${t}`, Accept: "application/json" };
+}
+
+async function sentryGet(path: string): Promise<unknown> {
+  const res = await fetch(`${apiRoot()}${path}`, { headers: headers() });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Sentry ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+const mcp = new McpServer({ name: "nimbus-sentry", version: "0.1.0" });
+const reg = createZodToolRegistrar(createRegisterSimpleTool(mcp));
+
+reg(
+  "sentry_issue_list",
+  "List unresolved issues for a project.",
+  z.object({ projectSlug: z.string().min(1), limit: z.number().int().min(1).max(100).optional() }),
+  async (p) => {
+    const lim = p.limit ?? 20;
+    return jsonResult(
+      await sentryGet(
+        `/projects/${org()}/${p.projectSlug}/issues/?query=is:unresolved&limit=${String(lim)}`,
+      ),
+    );
+  },
+);
+
+reg(
+  "sentry_release_list",
+  "List releases for a project.",
+  z.object({ projectSlug: z.string().min(1) }),
+  async (p) => jsonResult(await sentryGet(`/projects/${org()}/${p.projectSlug}/releases/`)),
+);
+
+const transport = new StdioServerTransport();
+await mcp.connect(transport);

package/connectors/slack/nimbus.extension.json

@@ -0,0 +1,15 @@
+{
+  "id": "com.nimbus.slack",
+  "displayName": "Slack",
+  "version": "0.1.0",
+  "description": "Slack connector (channels, messages, search). Mutations require Gateway HITL.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["slack.com", "api.slack.com", "wss-primary.slack.com", "wss-backup.slack.com"]
+  },
+  "hitlRequired": ["write", "delete"],
+  "syncInterval": 60,
+  "minNimbusVersion": "0.2.0"
+}