@nimbus-dev/connectors 0.1.0

package/connectors/vertex-ai/src/tools.ts

@@ -0,0 +1,145 @@
+import { z } from "zod";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { nimbusSpawn } from "../../../shared/nimbus-spawn.ts";
+import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
+import { isSafeCliArg } from "../../../shared/safe-cli-arg.ts";
+
+/**
+ * A value passed to the `gcloud ai` CLI (a Vertex AI region like `us-central1`
+ * or a model id). Rejected at the schema boundary if it begins with `-` (argv
+ * flag smuggling) or contains control characters. Exported so the contract test
+ * can assert the guard rejects a `-`-prefixed value.
+ */
+export const cliArg = z
+  .string()
+  .min(1)
+  .refine(isSafeCliArg, { message: 'must not start with "-" or contain control characters' });
+
+/**
+ * GCP Vertex AI (Tier-3, no-row-data) MCP tool surface. ALL tools index Vertex
+ * AI model REGISTRY metadata only (model resource name, display name, version
+ * id, region, create/update timestamps). NONE call inference / prediction —
+ * there is NO `gcloud ai endpoints predict`, NO `explain`, NO `raw-predict`, NO
+ * batch-prediction output read. The names are introspected by the
+ * `assertNoRowDataTools` contract test, so they must never contain a row-data
+ * segment (predict/query/records/results/scan/sample/…).
+ */
+export const VERTEX_AI_TOOL_NAMES = [
+  "vertex_ai_list",
+  "vertex_ai_get",
+  "vertex_ai_search",
+] as const;
+
+const DEFAULT_REGION = "us-central1";
+
+function isRecord(v: unknown): v is Record<string, unknown> {
+  return v !== null && typeof v === "object" && !Array.isArray(v);
+}
+
+function strField(r: Record<string, unknown>, key: string): string {
+  const v = r[key];
+  return typeof v === "string" ? v : "";
+}
+
+function asArray(parsed: unknown): unknown[] {
+  return Array.isArray(parsed) ? parsed : [];
+}
+
+/** The configured GCP project id, if `GOOGLE_CLOUD_PROJECT` is set at spawn. */
+function projectArgs(): string[] {
+  const project = process.env["GOOGLE_CLOUD_PROJECT"]?.trim();
+  return project !== undefined && project !== "" ? ["--project", project] : [];
+}
+
+/**
+ * Resolve the Vertex AI region: an explicit tool argument wins, else the
+ * `VERTEX_AI_REGION` env injected at spawn, else `us-central1`. The result is a
+ * raw, unguarded string — callers must pass it through `cliArg`/`isSafeCliArg`
+ * (or the schema) before handing it to gcloud.
+ */
+function resolveRegion(explicit?: string): string {
+  const e = (explicit ?? process.env["VERTEX_AI_REGION"])?.trim();
+  return e !== undefined && e !== "" ? e : DEFAULT_REGION;
+}
+
+/**
+ * Run `gcloud ai <args> --region <region> --format json` and parse stdout.
+ * gcloud reads Application Default Credentials from
+ * `GOOGLE_APPLICATION_CREDENTIALS` natively from the process env injected at
+ * spawn time. The `<region>` is `isSafeCliArg`-guarded before use (argv flag
+ * smuggling). Throws on non-zero exit.
+ */
+async function gcloudAi(args: string[], region: string): Promise<unknown> {
+  const regionPreview = region.slice(0, 64);
+  if (!isSafeCliArg(region)) {
+    throw new Error(`Invalid region: ${regionPreview}`);
+  }
+  const { code, stdout, stderr } = await nimbusSpawn(
+    ["gcloud", "ai", ...args, "--region", region, ...projectArgs(), "--format", "json"],
+    {},
+  );
+  const out = stdout.trim();
+  const err = stderr.trim();
+  if (code !== 0) {
+    throw new Error(`gcloud ai ${args[0] ?? ""} failed: ${err.slice(0, 400)}`);
+  }
+  return out === "" ? [] : (JSON.parse(out) as unknown);
+}
+
+function modelMatches(entry: unknown, q: string): boolean {
+  if (!isRecord(entry)) {
+    return false;
+  }
+  const needle = q.toLowerCase();
+  return (
+    strField(entry, "displayName").toLowerCase().includes(needle) ||
+    strField(entry, "name").toLowerCase().includes(needle)
+  );
+}
+
+/**
+ * Register the read-only, metadata-only Vertex AI tools onto the given
+ * registrar. Shared between `server.ts` (live) and the contract test
+ * (introspection).
+ */
+export function registerVertexAiTools(reg: ZodToolRegistrar): void {
+  reg(
+    "vertex_ai_list",
+    "List GCP Vertex AI models in a region — METADATA ONLY (`gcloud ai models list`). Each entry carries the model `name` (resource path), `displayName`, `versionId`, `createTime`, and `updateTime`. Optional `region` defaults to the configured region (else us-central1). Never calls inference / prediction; never fetches model outputs.",
+    z.object({
+      region: cliArg.optional(),
+    }),
+    async (p) => {
+      const region = resolveRegion(p.region);
+      return jsonResult(asArray(await gcloudAi(["models", "list"], region)));
+    },
+  );
+
+  reg(
+    "vertex_ai_get",
+    "Fetch one GCP Vertex AI model's METADATA (`gcloud ai models describe <model> --region <region>`). Returns the model object including `name`, `displayName`, `versionId`, and create/update timestamps. The `modelId` and `region` are guarded against argv flag smuggling before use. No inference, prediction, or model-output data is returned — registry metadata only.",
+    z.object({
+      modelId: cliArg,
+      region: cliArg.optional(),
+    }),
+    async (p) => {
+      const region = resolveRegion(p.region);
+      return jsonResult(await gcloudAi(["models", "describe", p.modelId], region));
+    },
+  );
+
+  reg(
+    "vertex_ai_search",
+    "Substring search over GCP Vertex AI model display names + resource names (case-insensitive) — METADATA ONLY. Returns a `{ matches: [...] }` envelope of `gcloud ai models list` metadata entries matching the query. Optional `region` defaults to the configured region (else us-central1). Never calls inference / prediction.",
+    z.object({
+      query: z.string().min(1),
+      region: cliArg.optional(),
+    }),
+    async (p) => {
+      const region = resolveRegion(p.region);
+      const models = asArray(await gcloudAi(["models", "list"], region));
+      const matches = models.filter((m) => modelMatches(m, p.query));
+      return jsonResult({ matches });
+    },
+  );
+}

package/connectors/wiz/nimbus.extension.json

@@ -0,0 +1,15 @@
+{
+  "id": "com.nimbus.wiz",
+  "displayName": "Wiz",
+  "version": "0.1.0",
+  "description": "Wiz cloud security platform connector (CSPM findings, misconfigurations, toxic combinations). Read-only; surfaces severity, status, type, source rule, entity, projects, description into the local index. Wiz uses OAuth client_credentials auth; the connector fetches a fresh access token at startup. Regional users override `wiz.api_url` + `wiz.auth_url` vault keys; the default sandbox manifest covers the public US-east tenant. Self-hosted / regional endpoint expansion is a known Task 14 runtime-merge follow-up.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["api.app.wiz.io", "auth.app.wiz.io"]
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/wiz/src/search-filter.ts

@@ -0,0 +1,50 @@
+import {
+  asObjectish,
+  makeQueryFilter,
+  type SearchMatchOptions,
+  stringField,
+} from "../../../shared/search-filter.ts";
+
+export type WizSearchMatchOptions = SearchMatchOptions;
+
+function nestedString(row: Record<string, unknown>, parent: string, key: string): string {
+  const p = row[parent];
+  if (p === null || typeof p !== "object") {
+    return "";
+  }
+  return stringField(p as Record<string, unknown>, key);
+}
+
+function projectNames(row: Record<string, unknown>): string {
+  const projects = row["projects"];
+  if (!Array.isArray(projects)) {
+    return "";
+  }
+  const names: string[] = [];
+  for (const p of projects) {
+    if (p === null || typeof p !== "object") {
+      continue;
+    }
+    const name = stringField(p as Record<string, unknown>, "name");
+    if (name !== "") {
+      names.push(name);
+    }
+  }
+  return names.join(" ");
+}
+
+function fieldsOf(item: unknown): readonly string[] | null {
+  const row = asObjectish(item);
+  if (row === undefined) {
+    return null;
+  }
+  return [
+    nestedString(row, "sourceRule", "name"),
+    stringField(row, "description"),
+    nestedString(row, "entity", "name"),
+    nestedString(row, "entity", "type"),
+    projectNames(row),
+  ];
+}
+
+export const filterWizIssues = makeQueryFilter(fieldsOf);

package/connectors/wiz/src/server.ts

@@ -0,0 +1,192 @@
+import { z } from "zod";
+
+import { searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterWizIssues } from "./search-filter.ts";
+
+const DEFAULT_API = "https://api.app.wiz.io/graphql";
+const DEFAULT_AUTH = "https://auth.app.wiz.io/oauth/token";
+const SEVERITIES = ["INFORMATIONAL", "LOW", "MEDIUM", "HIGH", "CRITICAL"] as const;
+const STATUSES = ["OPEN", "IN_PROGRESS", "RESOLVED", "REJECTED"] as const;
+
+function apiUrl(): string {
+  const v = process.env["WIZ_API_URL"]?.trim();
+  return v === undefined || v === "" ? DEFAULT_API : v;
+}
+
+function authUrl(): string {
+  const v = process.env["WIZ_AUTH_URL"]?.trim();
+  return v === undefined || v === "" ? DEFAULT_AUTH : v;
+}
+
+async function fetchAccessToken(): Promise<string> {
+  const clientId = process.env["WIZ_CLIENT_ID"]?.trim();
+  const clientSecret = process.env["WIZ_CLIENT_SECRET"]?.trim();
+  if (clientId === undefined || clientId === "") {
+    throw new Error("WIZ_CLIENT_ID is not set");
+  }
+  if (clientSecret === undefined || clientSecret === "") {
+    throw new Error("WIZ_CLIENT_SECRET is not set");
+  }
+  const body = new URLSearchParams({
+    grant_type: "client_credentials",
+    client_id: clientId,
+    client_secret: clientSecret,
+    audience: "wiz-api",
+  });
+  const res = await fetch(authUrl(), {
+    method: "POST",
+    headers: { "Content-Type": "application/x-www-form-urlencoded" },
+    body: body.toString(),
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Wiz auth ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  const parsed = JSON.parse(text) as { access_token?: string };
+  if (typeof parsed.access_token !== "string" || parsed.access_token === "") {
+    throw new Error("Wiz auth: missing access_token in response");
+  }
+  return parsed.access_token;
+}
+
+let cachedToken: string | undefined;
+async function getToken(): Promise<string> {
+  cachedToken ??= await fetchAccessToken();
+  return cachedToken;
+}
+
+async function wizGraphql<T>(query: string, variables: Record<string, unknown>): Promise<T> {
+  const token = await getToken();
+  const res = await fetch(apiUrl(), {
+    method: "POST",
+    headers: {
+      Authorization: `Bearer ${token}`,
+      "Content-Type": "application/json",
+      Accept: "application/json",
+    },
+    body: JSON.stringify({ query, variables }),
+  });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Wiz ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  const parsed = JSON.parse(text) as { data?: T; errors?: unknown };
+  if (parsed.errors !== undefined) {
+    throw new Error(`Wiz GraphQL error: ${JSON.stringify(parsed.errors).slice(0, 400)}`);
+  }
+  if (parsed.data === undefined) {
+    throw new Error("Wiz GraphQL: response missing `data` field");
+  }
+  return parsed.data;
+}
+
+const ISSUES_QUERY = `
+query Issues($first: Int!, $after: String, $filterBy: IssueFilters) {
+  issues(first: $first, after: $after, filterBy: $filterBy) {
+    nodes {
+      id
+      sourceRule { id name }
+      severity
+      status
+      type
+      createdAt
+      updatedAt
+      resolvedAt
+      description
+      remediation
+      entity { id name type }
+      projects { id name slug }
+    }
+    pageInfo { hasNextPage endCursor }
+  }
+}
+`;
+
+const SINGLE_ISSUE_QUERY = `
+query Issue($id: ID!) {
+  issue(id: $id) {
+    id
+    sourceRule { id name }
+    severity
+    status
+    type
+    createdAt
+    updatedAt
+    resolvedAt
+    description
+    remediation
+    entity { id name type }
+    projects { id name slug }
+  }
+}
+`;
+
+interface IssuesPage {
+  readonly issues: {
+    readonly nodes: readonly unknown[];
+    readonly pageInfo: { readonly hasNextPage: boolean; readonly endCursor: string | null };
+  };
+}
+
+await runReadOnlyMcpConnector("nimbus-wiz", (reg) => {
+  reg(
+    "wiz_list",
+    "List Wiz issues. Filters map to the `IssueFilters` GraphQL input — severity, status, and entity type are all optional. Defaults to open issues across all severities, capped at 100.",
+    z.object({
+      severity: z.array(z.enum(SEVERITIES)).min(1).optional(),
+      status: z.array(z.enum(STATUSES)).min(1).optional(),
+      entityType: z.string().min(1).optional(),
+      limit: z.number().int().min(1).max(500).optional(),
+    }),
+    async (p) => {
+      const filterBy: Record<string, unknown> = {};
+      filterBy["status"] = p.status ?? ["OPEN"];
+      if (p.severity !== undefined && p.severity.length > 0) {
+        filterBy["severity"] = p.severity;
+      }
+      if (p.entityType !== undefined) {
+        filterBy["entityType"] = p.entityType;
+      }
+      const data = await wizGraphql<IssuesPage>(ISSUES_QUERY, {
+        first: p.limit ?? 100,
+        after: null,
+        filterBy,
+      });
+      return jsonResult(data.issues);
+    },
+  );
+
+  reg(
+    "wiz_get",
+    "Fetch one Wiz issue by its id. Throws when no match is found.",
+    z.object({
+      issueId: z.string().min(1),
+    }),
+    async (p) => {
+      const data = await wizGraphql<{ issue: unknown }>(SINGLE_ISSUE_QUERY, {
+        id: p.issueId,
+      });
+      if (data.issue === null) {
+        throw new Error(`Wiz: issue ${p.issueId} not found`);
+      }
+      return jsonResult(data.issue);
+    },
+  );
+
+  reg(
+    "wiz_search",
+    "Substring search across open issues. Matches the query against `sourceRule.name`, `description`, `entity.name`, `entity.type`, and project names (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(200),
+    async (p) => {
+      const data = await wizGraphql<IssuesPage>(ISSUES_QUERY, {
+        first: 500,
+        after: null,
+        filterBy: { status: ["OPEN"] },
+      });
+      const matches = filterWizIssues(data.issues.nodes, { query: p.query, limit: p.limit });
+      return jsonResult({ matches });
+    },
+  );
+});

package/connectors/workday/nimbus.extension.json

@@ -0,0 +1,19 @@
+{
+  "id": "com.nimbus.workday",
+  "displayName": "Workday",
+  "version": "0.1.0",
+  "description": "Workday connector (read-only). Surfaces worker profile, job postings, and time-off requests from the Workday tenant as indexed items in the local index. Authenticates via OAuth2 authorization-code flow; the user supplies NIMBUS_OAUTH_WORKDAY_CLIENT_ID / _SECRET and NIMBUS_WORKDAY_TENANT. The tenant API host is injected at spawn via manifestWithExtraNetworkHosts.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": [],
+    "filesystem": {
+      "read": [],
+      "write": []
+    }
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.14.0"
+}

package/connectors/workday/src/search-filter.ts

@@ -0,0 +1,5 @@
+import { fieldsFromKeys, makeQueryFilter } from "../../../shared/search-filter.ts";
+
+export const filterWorkdayWorkers = makeQueryFilter(
+  fieldsFromKeys(["descriptor", "title", "team", "department", "location"]),
+);

package/connectors/workday/src/server.ts

@@ -0,0 +1,78 @@
+import { z } from "zod";
+import { searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import {
+  fetchWithTimeout,
+  mcpJsonResult as jsonResult,
+  requireProcessEnv,
+} from "../../../shared/mcp-tool-kit.ts";
+import {
+  runReadOnlyMcpConnector,
+  type ZodToolRegistrar,
+} from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterWorkdayWorkers } from "./search-filter.ts";
+
+function trimSlash(s: string): string {
+  return s.endsWith("/") ? s.slice(0, -1) : s;
+}
+
+function apiBase(): string {
+  const host = trimSlash(requireProcessEnv("WORKDAY_TENANT_HOST"));
+  const tenant = requireProcessEnv("WORKDAY_TENANT");
+  // Workday Staffing REST: /ccx/api/staffing/v6/<tenant>/workers
+  return `${host}/ccx/api/staffing/v6/${encodeURIComponent(tenant)}`;
+}
+
+function authHeader(): Record<string, string> {
+  return {
+    Authorization: `Bearer ${requireProcessEnv("WORKDAY_ACCESS_TOKEN")}`,
+    Accept: "application/json",
+  };
+}
+
+async function wdGet(path: string): Promise<unknown> {
+  const res = await fetchWithTimeout(`${apiBase()}${path}`, { headers: authHeader() });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Workday ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+function workersFrom(root: unknown): unknown[] {
+  const d = (root as { data?: unknown } | null)?.data;
+  return Array.isArray(d) ? d : [];
+}
+
+export function registerWorkdayTools(reg: ZodToolRegistrar): void {
+  reg(
+    "workday_list",
+    "List Workday workers (`GET /workers?limit=100`). Returns `{ data: [...] }` of worker objects (id, descriptor, title, team, department, location).",
+    z.object({ limit: z.number().int().min(1).max(100).optional() }),
+    async (p) => jsonResult(await wdGet(`/workers?limit=${p.limit ?? 100}`)),
+  );
+
+  reg(
+    "workday_get",
+    "Fetch one Workday worker by id (`GET /workers/{id}`).",
+    z.object({ id: z.string().min(1) }),
+    async (p) => jsonResult(await wdGet(`/workers/${encodeURIComponent(p.id)}`)),
+  );
+
+  reg(
+    "workday_search",
+    "Substring search across the first page of Workday workers (descriptor/title/team/department/location). Returns `{ matches: [...] }`.",
+    searchToolInputSchema(100),
+    async (p) => {
+      const root = await wdGet(`/workers?limit=100`);
+      return jsonResult({
+        matches: filterWorkdayWorkers(workersFrom(root), { query: p.query, limit: p.limit }),
+      });
+    },
+  );
+}
+
+export async function startConnector(): Promise<void> {
+  await runReadOnlyMcpConnector("nimbus-workday", registerWorkdayTools);
+}
+
+if (import.meta.main) await startConnector();

package/connectors/workday/src/tools.ts

@@ -0,0 +1 @@
+export const WORKDAY_TOOL_NAMES = ["workday_list", "workday_get", "workday_search"] as const;

package/connectors/zendesk/nimbus.extension.json

@@ -0,0 +1,16 @@
+{
+  "id": "com.nimbus.zendesk",
+  "displayName": "Zendesk",
+  "version": "0.1.0",
+  "description": "Zendesk Support connector (read-only). Surfaces the user's Zendesk tickets as `zendesk:ticket` items in the local index — the subject, the plain-text description (the first comment), status (new/open/pending/hold/solved/closed), priority, type, requester/assignee/group/organization ids, tags, and the originating via-channel. Useful for correlating customer support history with code/PR changes (\"which tickets reference the checkout regression?\") without leaving Nimbus. HTTP Basic auth: the username is `<email>/token` and the password is the API token (`Authorization: Basic base64(<email>/token:<api_token>)`; never logged). Zendesk is per-tenant: the user supplies the full base URL `https://<subdomain>.zendesk.com` via the `zendesk.url` vault key, and that host is added to the sandbox network list at spawn time by `phase3AddZendeskMcp`, so the static manifest network list is intentionally empty. Zendesk cursor-paginates `/api/v2/tickets.json` (`page[size]=100`), following `meta.after_cursor` while `meta.has_more` is true. `created_at` / `updated_at` are ISO-8601 (converted to epoch-ms on index). v1 indexes tickets only — comments, users, organizations, and Help Center articles are deferred follow-ups; reply/solve/assign HITL writes are deferred.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": [],
+    "filesystem": { "read": [], "write": [] }
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/zendesk/src/search-filter.ts

@@ -0,0 +1,11 @@
+import {
+  fieldsFromKeys,
+  makeQueryFilter,
+  type SearchMatchOptions,
+} from "../../../shared/search-filter.ts";
+
+export type ZendeskSearchMatchOptions = SearchMatchOptions;
+
+export const filterZendeskTickets = makeQueryFilter(
+  fieldsFromKeys(["subject", "description", "status", "priority", "type"], { tags: true }),
+);

package/connectors/zendesk/src/server.ts

@@ -0,0 +1,77 @@
+import { z } from "zod";
+import { matchesResult, searchToolInputSchema } from "../../../shared/mcp-search-tool.ts";
+import {
+  encodeBasicAuthHeader,
+  mcpJsonResult as jsonResult,
+} from "../../../shared/mcp-tool-kit.ts";
+import { runReadOnlyMcpConnector } from "../../../shared/run-read-only-mcp-connector.ts";
+import { filterZendeskTickets } from "./search-filter.ts";
+
+function trimTrailingSlash(s: string): string {
+  return s.endsWith("/") ? s.slice(0, -1) : s;
+}
+
+function baseUrl(): string {
+  const v = process.env["ZENDESK_URL"]?.trim();
+  if (v === undefined || v === "") {
+    throw new Error("ZENDESK_URL is not set");
+  }
+  return trimTrailingSlash(v);
+}
+
+function authHeader(): Record<string, string> {
+  const email = process.env["ZENDESK_EMAIL"]?.trim();
+  if (email === undefined || email === "") {
+    throw new Error("ZENDESK_EMAIL is not set");
+  }
+  const token = process.env["ZENDESK_API_TOKEN"]?.trim();
+  if (token === undefined || token === "") {
+    throw new Error("ZENDESK_API_TOKEN is not set");
+  }
+  return {
+    Authorization: encodeBasicAuthHeader(`${email}/token`, token),
+    Accept: "application/json",
+  };
+}
+
+async function zendeskGet(path: string): Promise<unknown> {
+  const res = await fetch(`${baseUrl()}${path}`, { headers: authHeader() });
+  const text = await res.text();
+  if (!res.ok) {
+    throw new Error(`Zendesk ${String(res.status)}: ${text.slice(0, 400)}`);
+  }
+  return JSON.parse(text) as unknown;
+}
+
+await runReadOnlyMcpConnector("nimbus-zendesk", (reg) => {
+  reg(
+    "zendesk_list",
+    "List the user's Zendesk tickets (`GET /api/v2/tickets.json?page[size]=100`). Returns the cursor-pagination envelope `{ tickets: [...], meta: { has_more, after_cursor }, links: { next } }` — `tickets` holds the ticket objects.",
+    z.object({}),
+    async () => {
+      return jsonResult(await zendeskGet(`/api/v2/tickets.json?page[size]=100`));
+    },
+  );
+
+  reg(
+    "zendesk_get",
+    "Fetch one Zendesk ticket by its numeric id (`GET /api/v2/tickets/{id}.json`). Returns the `{ ticket: {...} }` envelope. Throws when no match is found.",
+    z.object({
+      id: z.string().min(1),
+    }),
+    async (p) => {
+      return jsonResult(await zendeskGet(`/api/v2/tickets/${encodeURIComponent(p.id)}.json`));
+    },
+  );
+
+  reg(
+    "zendesk_search",
+    "Substring search across the user's Zendesk tickets (first page only). Matches the query against the ticket subject, description, status, priority, type, and tags (case-insensitive). Returns a `{ matches: [...] }` envelope.",
+    searchToolInputSchema(100),
+    async (p) => {
+      const root = await zendeskGet(`/api/v2/tickets.json?page[size]=100`);
+      const tickets = (root as { tickets?: unknown[] } | null)?.tickets;
+      return matchesResult(tickets, filterZendeskTickets, p);
+    },
+  );
+});

package/connectors/zoom/nimbus.extension.json

@@ -0,0 +1,15 @@
+{
+  "id": "com.nimbus.zoom",
+  "displayName": "Zoom",
+  "version": "0.1.0",
+  "description": "Zoom REST API connector (read-only). Surfaces the authenticated user's scheduled meetings as `zoom:meeting` items AND cloud-recording transcripts as `zoom:transcript` items (prose-heavy embedding) in the local index via `GET /v2/users/me/meetings?type=scheduled` and `GET /v2/users/me/recordings`. Bearer OAuth auth (`Authorization: Bearer <token>`; short-lived access token refreshed by the Gateway via the 3-legged OAuth flow; never logged); fixed SaaS host api.zoom.us; transcript `download_url` fetches use the Bearer header — the token never appears in a logged URL. The recordings walk windowing keeps each request inside Zoom's ≤1-month constraint, and a skip-if-exists check on `<meeting_uuid>:<recording_file_id>` avoids re-downloading immutable transcripts.",
+  "author": "Nimbus",
+  "entrypoint": "dist/server.js",
+  "runtime": "bun",
+  "permissions": {
+    "network": ["api.zoom.us"]
+  },
+  "hitlRequired": [],
+  "syncInterval": 600,
+  "minNimbusVersion": "0.2.0"
+}

package/connectors/zoom/src/encode-meeting-path.ts

@@ -0,0 +1,5 @@
+export function encodeZoomMeetingPathSegment(idOrUuid: string): string {
+  const needsDoubleEncode = idOrUuid.startsWith("/") || idOrUuid.includes("//");
+  const once = encodeURIComponent(idOrUuid);
+  return needsDoubleEncode ? encodeURIComponent(once) : once;
+}

package/connectors/zoom/src/recordings-window.ts

@@ -0,0 +1,34 @@
+/**
+ * Zoom's /v2/users/me/recordings requires (to - from) <= 1 month. We use 31
+ * days as the safe upper bound (Zoom's docs say "1 month" loosely; 31 covers
+ * any month). Returns nothing on success; throws a clear Error when the
+ * window is wrong so the LLM agent doesn't burn a round-trip on a 400.
+ * Review point 3.1.
+ *
+ * Lives in its own module (not server.ts) so it can be unit-tested without
+ * importing server.ts — which runs `runReadOnlyMcpConnector` at top level and
+ * would start a stdio transport on import. Mirrors the existing
+ * encode-meeting-path.ts / search-filter.ts extraction pattern.
+ */
+const MAX_RECORDINGS_WINDOW_MS = 31 * 86_400_000;
+
+export function validateZoomRecordingsWindow(from: string, to: string): void {
+  const fromMs = Date.parse(from);
+  const toMs = Date.parse(to);
+  if (!Number.isFinite(fromMs)) {
+    throw new TypeError(`Invalid 'from': ${from} is not an ISO-8601 date.`);
+  }
+  if (!Number.isFinite(toMs)) {
+    throw new TypeError(`Invalid 'to': ${to} is not an ISO-8601 date.`);
+  }
+  if (toMs < fromMs) {
+    throw new Error(`'to' (${to}) must be >= 'from' (${from}).`);
+  }
+  const widthMs = toMs - fromMs;
+  if (widthMs > MAX_RECORDINGS_WINDOW_MS) {
+    const days = Math.round(widthMs / 86_400_000);
+    throw new Error(
+      `Zoom requires (to - from) <= 1 month; got ${String(days)} days. Split the request into multiple <= 31-day windows.`,
+    );
+  }
+}