@onesi/genesis 0.2.12 → 0.2.13

package/dist/genesis.openapi.json

@@ -136,6 +136,10 @@
     {
       "name": "brews",
       "description": "Brews (agent recipes and decisions)"
+    },
+    {
+      "name": "connections",
+      "description": "Connections (verified remote MCP servers)"
     }
   ],
   "paths": {
@@ -2130,53 +2134,6 @@
         "x-mcp": true
       }
     },
-    "/v1/foundry/files/{file_id}/content": {
-      "get": {
-        "operationId": "foundry_downloadFile",
-        "summary": "Download tenant file content",
-        "tags": [
-          "foundry"
-        ],
-        "x-foundry-executable": true,
-        "x-foundry-rust-source": "foundry-edge/src/openrouter_files.rs",
-        "x-foundry-rust-route": "/v1/files/{file_id}/content",
-        "responses": {
-          "200": {
-            "description": "File bytes.",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "type": "string",
-                  "format": "binary"
-                }
-              }
-            }
-          },
-          "default": {
-            "$ref": "#/components/responses/Foundry.Error"
-          }
-        },
-        "parameters": [
-          {
-            "name": "file_id",
-            "in": "path",
-            "required": true,
-            "schema": {
-              "type": "string",
-              "minLength": 1
-            }
-          }
-        ],
-        "x-genesis-service": "foundry",
-        "x-upstream": {
-          "base": "https://api.fdy.sh",
-          "method": "GET",
-          "path": "/v1/files/{file_id}/content",
-          "status": "live"
-        },
-        "x-mcp": true
-      }
-    },
     "/v1/foundry/fine_tuning/providers": {
       "get": {
         "operationId": "foundry_listFineTuningProviders",
@@ -6674,13 +6631,13 @@
         "x-mcp": false
       }
     },
-    "/v1/hives/organizations/{org_id}/sso": {
+    "/v1/hives/organizations/{org_id}/usage": {
       "get": {
         "tags": [
           "hives"
         ],
-        "summary": "Get SSO configuration for an organization",
-        "operationId": "hives_get_sso_config",
+        "summary": "Get organization usage (proxied to Cabbage)",
+        "operationId": "hives_get_org_usage",
         "parameters": [
           {
             "name": "org_id",
@@ -6694,7 +6651,7 @@
         ],
         "responses": {
           "200": {
-            "description": "SSO configuration",
+            "description": "Organization usage summary",
             "content": {
               "application/json": {
                 "schema": {
@@ -6710,40 +6667,31 @@
             "description": "Organization not found"
           },
           "503": {
-            "description": "SSO service unavailable"
+            "description": "Billing service unavailable"
           }
         },
         "x-genesis-service": "hives",
         "x-upstream": {
           "base": "https://api.hives.sh",
           "method": "GET",
-          "path": "/v1/organizations/{org_id}/sso",
+          "path": "/v1/organizations/{org_id}/usage",
           "status": "down"
         },
         "x-mcp": false
-      },
+      }
+    },
+    "/v1/hives/payments/checkout": {
       "post": {
         "tags": [
           "hives"
         ],
-        "summary": "Create a new SSO connection",
-        "operationId": "hives_create_sso_connection",
-        "parameters": [
-          {
-            "name": "org_id",
-            "in": "path",
-            "description": "Organization ID",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
+        "summary": "Create a Stripe checkout session",
+        "operationId": "hives_create_checkout",
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/Hives.CreateSsoConnectionRequest"
+                "$ref": "#/components/schemas/Hives.CreateCheckoutRequest"
               }
             }
           },
@@ -6751,7 +6699,7 @@
         },
         "responses": {
           "200": {
-            "description": "SSO connection created",
+            "description": "Checkout session created",
             "content": {
               "application/json": {
                 "schema": {
@@ -6763,53 +6711,73 @@
           "401": {
             "description": "Unauthorized"
           },
-          "404": {
-            "description": "Organization not found"
-          },
           "503": {
-            "description": "SSO service unavailable"
+            "description": "Payments service unavailable"
           }
         },
         "x-genesis-service": "hives",
         "x-upstream": {
           "base": "https://api.hives.sh",
           "method": "POST",
-          "path": "/v1/organizations/{org_id}/sso",
+          "path": "/v1/payments/checkout",
           "status": "down"
         },
         "x-mcp": false
       }
     },
-    "/v1/hives/organizations/{org_id}/sso/{connection_id}": {
-      "delete": {
+    "/v1/hives/payments/methods": {
+      "get": {
         "tags": [
           "hives"
         ],
-        "summary": "Delete an SSO connection",
-        "operationId": "hives_delete_sso_connection",
-        "parameters": [
-          {
-            "name": "org_id",
-            "in": "path",
-            "description": "Organization ID",
-            "required": true,
-            "schema": {
-              "type": "string"
+        "summary": "List payment methods for the authenticated org",
+        "operationId": "hives_list_payment_methods",
+        "responses": {
+          "200": {
+            "description": "Payment methods",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object"
+                }
+              }
             }
           },
-          {
-            "name": "connection_id",
-            "in": "path",
-            "description": "SSO connection ID",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
+          "401": {
+            "description": "Unauthorized"
+          },
+          "503": {
+            "description": "Payments service unavailable"
           }
+        },
+        "x-genesis-service": "hives",
+        "x-upstream": {
+          "base": "https://api.hives.sh",
+          "method": "GET",
+          "path": "/v1/payments/methods",
+          "status": "down"
+        },
+        "x-mcp": false
+      },
+      "post": {
+        "tags": [
+          "hives"
         ],
+        "summary": "Add a payment method",
+        "operationId": "hives_add_payment_method",
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Hives.AddPaymentMethodRequest"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
-            "description": "SSO connection deleted",
+            "description": "Payment method added",
             "content": {
               "application/json": {
                 "schema": {
@@ -6821,48 +6789,147 @@
           "401": {
             "description": "Unauthorized"
           },
-          "404": {
-            "description": "Organization or connection not found"
+          "503": {
+            "description": "Payments service unavailable"
+          }
+        },
+        "x-genesis-service": "hives",
+        "x-upstream": {
+          "base": "https://api.hives.sh",
+          "method": "POST",
+          "path": "/v1/payments/methods",
+          "status": "down"
+        },
+        "x-mcp": false
+      }
+    },
+    "/v1/hives/payments/portal": {
+      "post": {
+        "tags": [
+          "hives"
+        ],
+        "summary": "Get Stripe billing portal URL",
+        "operationId": "hives_get_billing_portal",
+        "responses": {
+          "200": {
+            "description": "Billing portal URL",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object"
+                }
+              }
+            }
+          },
+          "401": {
+            "description": "Unauthorized"
           },
           "503": {
-            "description": "SSO service unavailable"
+            "description": "Payments service unavailable"
           }
         },
         "x-genesis-service": "hives",
         "x-upstream": {
           "base": "https://api.hives.sh",
-          "method": "DELETE",
-          "path": "/v1/organizations/{org_id}/sso/{connection_id}",
+          "method": "POST",
+          "path": "/v1/payments/portal",
           "status": "down"
         },
         "x-mcp": false
       }
     },
-    "/v1/hives/organizations/{org_id}/usage": {
+    "/v1/hives/projects": {
       "get": {
         "tags": [
           "hives"
         ],
-        "summary": "Get organization usage (proxied to Cabbage)",
-        "operationId": "hives_get_org_usage",
+        "summary": "List all projects for the authenticated tenant",
+        "operationId": "hives_list_projects",
         "parameters": [
           {
-            "name": "org_id",
-            "in": "path",
-            "description": "Organization ID",
-            "required": true,
+            "name": "kind",
+            "in": "query",
+            "description": "Filter by project kind",
+            "required": false,
             "schema": {
-              "type": "string"
+              "type": [
+                "string",
+                "null"
+              ]
+            }
+          },
+          {
+            "name": "status",
+            "in": "query",
+            "description": "Filter by status",
+            "required": false,
+            "schema": {
+              "type": [
+                "string",
+                "null"
+              ]
+            }
+          },
+          {
+            "name": "search",
+            "in": "query",
+            "description": "Search by name",
+            "required": false,
+            "schema": {
+              "type": [
+                "string",
+                "null"
+              ]
+            }
+          },
+          {
+            "name": "sort_by",
+            "in": "query",
+            "description": "Sort field",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/Hives.ProjectSortField"
+            }
+          },
+          {
+            "name": "sort_order",
+            "in": "query",
+            "description": "Sort order",
+            "required": false,
+            "schema": {
+              "$ref": "#/components/schemas/Hives.SortOrder"
+            }
+          },
+          {
+            "name": "page",
+            "in": "query",
+            "description": "Page number (1-indexed)",
+            "required": false,
+            "schema": {
+              "type": "integer",
+              "format": "int32",
+              "minimum": 0
+            }
+          },
+          {
+            "name": "per_page",
+            "in": "query",
+            "description": "Items per page",
+            "required": false,
+            "schema": {
+              "type": "integer",
+              "format": "int32",
+              "minimum": 0
             }
           }
         ],
         "responses": {
           "200": {
-            "description": "Organization usage summary",
+            "description": "List of projects",
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object"
+                  "$ref": "#/components/schemas/Hives.PaginatedResponse_ProjectResponse"
                 }
               }
             }
@@ -6870,82 +6937,94 @@
           "401": {
             "description": "Unauthorized"
           },
-          "404": {
-            "description": "Organization not found"
-          },
-          "503": {
-            "description": "Billing service unavailable"
+          "500": {
+            "description": "Internal server error"
           }
         },
         "x-genesis-service": "hives",
         "x-upstream": {
           "base": "https://api.hives.sh",
           "method": "GET",
-          "path": "/v1/organizations/{org_id}/usage",
+          "path": "/v1/projects",
           "status": "down"
         },
-        "x-mcp": false
-      }
-    },
-    "/v1/hives/payments/checkout": {
+        "x-mcp": true
+      },
       "post": {
         "tags": [
           "hives"
         ],
-        "summary": "Create a Stripe checkout session",
-        "operationId": "hives_create_checkout",
+        "summary": "Create a new project",
+        "operationId": "hives_create_project",
         "requestBody": {
           "content": {
             "application/json": {
               "schema": {
-                "$ref": "#/components/schemas/Hives.CreateCheckoutRequest"
+                "$ref": "#/components/schemas/Hives.CreateProjectRequest"
               }
             }
           },
           "required": true
         },
         "responses": {
-          "200": {
-            "description": "Checkout session created",
+          "201": {
+            "description": "Project created",
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object"
+                  "$ref": "#/components/schemas/Hives.ProjectResponse"
                 }
               }
             }
           },
+          "400": {
+            "description": "Invalid request"
+          },
           "401": {
             "description": "Unauthorized"
           },
-          "503": {
-            "description": "Payments service unavailable"
+          "409": {
+            "description": "Project already exists"
+          },
+          "500": {
+            "description": "Internal server error"
           }
         },
         "x-genesis-service": "hives",
         "x-upstream": {
           "base": "https://api.hives.sh",
           "method": "POST",
-          "path": "/v1/payments/checkout",
+          "path": "/v1/projects",
           "status": "down"
         },
-        "x-mcp": false
+        "x-mcp": true
       }
     },
-    "/v1/hives/payments/methods": {
+    "/v1/hives/projects/{project_id}": {
       "get": {
         "tags": [
           "hives"
         ],
-        "summary": "List payment methods for the authenticated org",
-        "operationId": "hives_list_payment_methods",
+        "summary": "Get a project by ID",
+        "operationId": "hives_get_project",
+        "parameters": [
+          {
+            "name": "project_id",
+            "in": "path",
+            "description": "Hives project id (prj_…)",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
         "responses": {
           "200": {
-            "description": "Payment methods",
+            "description": "Project details",
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object"
+                  "$ref": "#/components/schemas/Hives.ProjectResponse"
                 }
               }
             }
@@ -6953,42 +7032,46 @@
           "401": {
             "description": "Unauthorized"
           },
-          "503": {
-            "description": "Payments service unavailable"
+          "404": {
+            "description": "Project not found"
+          },
+          "500": {
+            "description": "Internal server error"
           }
         },
         "x-genesis-service": "hives",
         "x-upstream": {
           "base": "https://api.hives.sh",
           "method": "GET",
-          "path": "/v1/payments/methods",
+          "path": "/v1/projects/{project_id}",
           "status": "down"
         },
-        "x-mcp": false
+        "x-mcp": true
       },
-      "post": {
+      "delete": {
         "tags": [
           "hives"
         ],
-        "summary": "Add a payment method",
-        "operationId": "hives_add_payment_method",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/Hives.AddPaymentMethodRequest"
-              }
+        "summary": "Delete a project",
+        "operationId": "hives_delete_project",
+        "parameters": [
+          {
+            "name": "project_id",
+            "in": "path",
+            "description": "Hives project id (prj_…)",
+            "required": true,
+            "schema": {
+              "type": "string"
             }
-          },
-          "required": true
-        },
+          }
+        ],
         "responses": {
           "200": {
-            "description": "Payment method added",
+            "description": "Project deleted",
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object"
+                  "$ref": "#/components/schemas/Hives.DeleteResponse"
                 }
               }
             }
@@ -6996,508 +7079,218 @@
           "401": {
             "description": "Unauthorized"
           },
-          "503": {
-            "description": "Payments service unavailable"
+          "404": {
+            "description": "Project not found"
+          },
+          "500": {
+            "description": "Internal server error"
           }
         },
         "x-genesis-service": "hives",
         "x-upstream": {
           "base": "https://api.hives.sh",
-          "method": "POST",
-          "path": "/v1/payments/methods",
+          "method": "DELETE",
+          "path": "/v1/projects/{project_id}",
           "status": "down"
         },
-        "x-mcp": false
-      }
-    },
-    "/v1/hives/payments/portal": {
-      "post": {
+        "x-mcp": true
+      },
+      "patch": {
         "tags": [
           "hives"
         ],
-        "summary": "Get Stripe billing portal URL",
-        "operationId": "hives_get_billing_portal",
+        "summary": "Update a project",
+        "operationId": "hives_update_project",
+        "parameters": [
+          {
+            "name": "project_id",
+            "in": "path",
+            "description": "Hives project id (prj_…)",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          }
+        ],
+        "requestBody": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Hives.UpdateProjectRequest"
+              }
+            }
+          },
+          "required": true
+        },
         "responses": {
           "200": {
-            "description": "Billing portal URL",
+            "description": "Project updated",
             "content": {
               "application/json": {
                 "schema": {
-                  "type": "object"
+                  "$ref": "#/components/schemas/Hives.ProjectResponse"
                 }
               }
             }
           },
+          "400": {
+            "description": "Invalid request"
+          },
           "401": {
             "description": "Unauthorized"
           },
-          "503": {
-            "description": "Payments service unavailable"
+          "404": {
+            "description": "Project not found"
+          },
+          "500": {
+            "description": "Internal server error"
           }
         },
         "x-genesis-service": "hives",
         "x-upstream": {
           "base": "https://api.hives.sh",
-          "method": "POST",
-          "path": "/v1/payments/portal",
+          "method": "PATCH",
+          "path": "/v1/projects/{project_id}",
           "status": "down"
         },
-        "x-mcp": false
+        "x-mcp": true
       }
     },
-    "/v1/hives/projects": {
+    "/v1/hives/projects/{project_id}/activity": {
       "get": {
         "tags": [
           "hives"
         ],
-        "summary": "List all projects for the authenticated tenant",
-        "operationId": "hives_list_projects",
+        "summary": "List activity for an authenticated org's project",
+        "description": "Requires hives:read. The backend verifies that the project belongs to the signed org before reading its activity; an unknown or foreign-org project returns 404.",
+        "operationId": "hives_get_project_activity",
         "parameters": [
           {
-            "name": "kind",
+            "name": "project_id",
+            "in": "path",
+            "description": "Hives project id (prj_…)",
+            "required": true,
+            "schema": {
+              "type": "string"
+            }
+          },
+          {
+            "name": "action",
             "in": "query",
-            "description": "Filter by project kind",
-            "required": false,
+            "description": "Filter by action, such as project.updated",
             "schema": {
-              "type": [
-                "string",
-                "null"
-              ]
+              "type": "string"
             }
           },
           {
-            "name": "status",
+            "name": "actor_type",
             "in": "query",
-            "description": "Filter by status",
-            "required": false,
+            "description": "Filter by actor type, such as user, api_key or system",
             "schema": {
-              "type": [
-                "string",
-                "null"
-              ]
+              "type": "string"
             }
           },
           {
-            "name": "search",
+            "name": "resource_type",
             "in": "query",
-            "description": "Search by name",
-            "required": false,
+            "description": "Filter by resource type",
             "schema": {
-              "type": [
-                "string",
-                "null"
-              ]
+              "type": "string"
             }
           },
           {
-            "name": "sort_by",
+            "name": "since",
             "in": "query",
-            "description": "Sort field",
-            "required": false,
+            "description": "Inclusive start timestamp",
             "schema": {
-              "$ref": "#/components/schemas/Hives.ProjectSortField"
+              "type": "string",
+              "format": "date-time"
             }
           },
           {
-            "name": "sort_order",
+            "name": "until",
             "in": "query",
-            "description": "Sort order",
-            "required": false,
+            "description": "Inclusive end timestamp",
             "schema": {
-              "$ref": "#/components/schemas/Hives.SortOrder"
-            }
-          },
-          {
-            "name": "page",
-            "in": "query",
-            "description": "Page number (1-indexed)",
-            "required": false,
-            "schema": {
-              "type": "integer",
-              "format": "int32",
-              "minimum": 0
-            }
-          },
-          {
-            "name": "per_page",
-            "in": "query",
-            "description": "Items per page",
-            "required": false,
-            "schema": {
-              "type": "integer",
-              "format": "int32",
-              "minimum": 0
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "List of projects",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Hives.PaginatedResponse_ProjectResponse"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "500": {
-            "description": "Internal server error"
-          }
-        },
-        "x-genesis-service": "hives",
-        "x-upstream": {
-          "base": "https://api.hives.sh",
-          "method": "GET",
-          "path": "/v1/projects",
-          "status": "down"
-        },
-        "x-mcp": true
-      },
-      "post": {
-        "tags": [
-          "hives"
-        ],
-        "summary": "Create a new project",
-        "operationId": "hives_create_project",
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/Hives.CreateProjectRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "201": {
-            "description": "Project created",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Hives.ProjectResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "Invalid request"
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "409": {
-            "description": "Project already exists"
-          },
-          "500": {
-            "description": "Internal server error"
-          }
-        },
-        "x-genesis-service": "hives",
-        "x-upstream": {
-          "base": "https://api.hives.sh",
-          "method": "POST",
-          "path": "/v1/projects",
-          "status": "down"
-        },
-        "x-mcp": true
-      }
-    },
-    "/v1/hives/projects/{project_id}": {
-      "get": {
-        "tags": [
-          "hives"
-        ],
-        "summary": "Get a project by ID",
-        "operationId": "hives_get_project",
-        "parameters": [
-          {
-            "name": "project_id",
-            "in": "path",
-            "description": "Hives project id (prj_…)",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Project details",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Hives.ProjectResponse"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "404": {
-            "description": "Project not found"
-          },
-          "500": {
-            "description": "Internal server error"
-          }
-        },
-        "x-genesis-service": "hives",
-        "x-upstream": {
-          "base": "https://api.hives.sh",
-          "method": "GET",
-          "path": "/v1/projects/{project_id}",
-          "status": "down"
-        },
-        "x-mcp": true
-      },
-      "delete": {
-        "tags": [
-          "hives"
-        ],
-        "summary": "Delete a project",
-        "operationId": "hives_delete_project",
-        "parameters": [
-          {
-            "name": "project_id",
-            "in": "path",
-            "description": "Hives project id (prj_…)",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Project deleted",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Hives.DeleteResponse"
-                }
-              }
-            }
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "404": {
-            "description": "Project not found"
-          },
-          "500": {
-            "description": "Internal server error"
-          }
-        },
-        "x-genesis-service": "hives",
-        "x-upstream": {
-          "base": "https://api.hives.sh",
-          "method": "DELETE",
-          "path": "/v1/projects/{project_id}",
-          "status": "down"
-        },
-        "x-mcp": true
-      },
-      "patch": {
-        "tags": [
-          "hives"
-        ],
-        "summary": "Update a project",
-        "operationId": "hives_update_project",
-        "parameters": [
-          {
-            "name": "project_id",
-            "in": "path",
-            "description": "Hives project id (prj_…)",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          }
-        ],
-        "requestBody": {
-          "content": {
-            "application/json": {
-              "schema": {
-                "$ref": "#/components/schemas/Hives.UpdateProjectRequest"
-              }
-            }
-          },
-          "required": true
-        },
-        "responses": {
-          "200": {
-            "description": "Project updated",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Hives.ProjectResponse"
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "Invalid request"
-          },
-          "401": {
-            "description": "Unauthorized"
-          },
-          "404": {
-            "description": "Project not found"
-          },
-          "500": {
-            "description": "Internal server error"
-          }
-        },
-        "x-genesis-service": "hives",
-        "x-upstream": {
-          "base": "https://api.hives.sh",
-          "method": "PATCH",
-          "path": "/v1/projects/{project_id}",
-          "status": "down"
-        },
-        "x-mcp": true
-      }
-    },
-    "/v1/hives/projects/{project_id}/activity": {
-      "get": {
-        "tags": [
-          "hives"
-        ],
-        "summary": "List activity for an authenticated org's project",
-        "description": "Requires hives:read. The backend verifies that the project belongs to the signed org before reading its activity; an unknown or foreign-org project returns 404.",
-        "operationId": "hives_get_project_activity",
-        "parameters": [
-          {
-            "name": "project_id",
-            "in": "path",
-            "description": "Hives project id (prj_…)",
-            "required": true,
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "action",
-            "in": "query",
-            "description": "Filter by action, such as project.updated",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "actor_type",
-            "in": "query",
-            "description": "Filter by actor type, such as user, api_key or system",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "resource_type",
-            "in": "query",
-            "description": "Filter by resource type",
-            "schema": {
-              "type": "string"
-            }
-          },
-          {
-            "name": "since",
-            "in": "query",
-            "description": "Inclusive start timestamp",
-            "schema": {
-              "type": "string",
-              "format": "date-time"
-            }
-          },
-          {
-            "name": "until",
-            "in": "query",
-            "description": "Inclusive end timestamp",
-            "schema": {
-              "type": "string",
-              "format": "date-time"
-            }
-          },
-          {
-            "name": "page",
-            "in": "query",
-            "description": "Page number (1-indexed)",
-            "schema": {
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 10000,
-              "default": 1
-            }
-          },
-          {
-            "name": "per_page",
-            "in": "query",
-            "description": "Items per page",
-            "schema": {
-              "type": "integer",
-              "minimum": 1,
-              "maximum": 100,
-              "default": 20
-            }
-          }
-        ],
-        "responses": {
-          "200": {
-            "description": "Project activity for the authenticated org",
-            "content": {
-              "application/json": {
-                "schema": {
-                  "$ref": "#/components/schemas/Hives.PaginatedResponse_ActivityEntry"
-                }
-              }
-            }
-          },
-          "400": {
-            "description": "Invalid filter or pagination"
-          },
-          "401": {
-            "description": "Missing or invalid signed identity"
-          },
-          "403": {
-            "description": "Missing hives:read scope"
-          },
-          "404": {
-            "description": "Project not found in the authenticated org"
-          },
-          "500": {
-            "description": "Internal server error"
-          }
-        },
-        "x-genesis-service": "hives",
-        "x-upstream": {
-          "base": "https://api.hives.sh",
-          "method": "GET",
-          "path": "/v1/projects/{project_id}/activity",
-          "status": "down"
-        },
-        "x-mcp": true
-      }
-    },
-    "/v1/hives/projects/{project_id}/cron": {
-      "get": {
-        "tags": [
-          "hives"
-        ],
-        "summary": "List all cron jobs for a project",
-        "operationId": "hives_list_crons",
-        "parameters": [
-          {
-            "name": "project_id",
-            "in": "path",
-            "description": "Hives project id (prj_…)",
-            "required": true,
-            "schema": {
-              "type": "string"
+              "type": "string",
+              "format": "date-time"
+            }
+          },
+          {
+            "name": "page",
+            "in": "query",
+            "description": "Page number (1-indexed)",
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 10000,
+              "default": 1
+            }
+          },
+          {
+            "name": "per_page",
+            "in": "query",
+            "description": "Items per page",
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 100,
+              "default": 20
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Project activity for the authenticated org",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Hives.PaginatedResponse_ActivityEntry"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Invalid filter or pagination"
+          },
+          "401": {
+            "description": "Missing or invalid signed identity"
+          },
+          "403": {
+            "description": "Missing hives:read scope"
+          },
+          "404": {
+            "description": "Project not found in the authenticated org"
+          },
+          "500": {
+            "description": "Internal server error"
+          }
+        },
+        "x-genesis-service": "hives",
+        "x-upstream": {
+          "base": "https://api.hives.sh",
+          "method": "GET",
+          "path": "/v1/projects/{project_id}/activity",
+          "status": "down"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/hives/projects/{project_id}/cron": {
+      "get": {
+        "tags": [
+          "hives"
+        ],
+        "summary": "List all cron jobs for a project",
+        "operationId": "hives_list_crons",
+        "parameters": [
+          {
+            "name": "project_id",
+            "in": "path",
+            "description": "Hives project id (prj_…)",
+            "required": true,
+            "schema": {
+              "type": "string"
             }
           },
           {
@@ -101545,6 +101338,718 @@
         },
         "x-mcp": true
       }
+    },
+    "/v1/connections/catalog": {
+      "get": {
+        "operationId": "connections_listCatalog",
+        "summary": "List verified MCP servers in the catalog",
+        "description": "Scope `connections:read`. Filter by OneOS plugin category (`plugin`, e.g. `scopes`). Suspended servers are listed with their `reason`.",
+        "parameters": [
+          {
+            "name": "plugin",
+            "in": "query",
+            "required": false,
+            "description": "OneOS plugin category the server competes in, e.g. scopes, silos, traces",
+            "schema": {
+              "type": "string",
+              "pattern": "^[a-z][a-z0-9-]{0,31}$"
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Catalog servers",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "data"
+                  ],
+                  "properties": {
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Connections.CatalogServer"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/catalog",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/catalog/{server}": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Server"
+        }
+      ],
+      "get": {
+        "operationId": "connections_getCatalogServer",
+        "summary": "Get a catalog server with its pinned tool manifest",
+        "description": "Scope `connections:read`.",
+        "responses": {
+          "200": {
+            "description": "The server and its pinned manifest",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.CatalogServerDetail"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/catalog/{server}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections": {
+      "get": {
+        "operationId": "connections_list",
+        "summary": "List your organization's connections",
+        "description": "Scope `connections:read`. Connections of the selected environment, newest first (at most 200), optionally of one `status`.",
+        "parameters": [
+          {
+            "name": "status",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "enum": [
+                "pending_auth",
+                "active",
+                "needs_reauth",
+                "revoked"
+              ]
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Connections",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "data"
+                  ],
+                  "properties": {
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Connections.Connection"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      },
+      "post": {
+        "operationId": "connections_connect",
+        "summary": "Connect a catalog server",
+        "description": "Scope `connections:write`. Creates a `pending_auth` connection and returns the `authorize_url` a person opens to consent at the vendor. `tools` picks the tools to enable (default: the manifest's defaults); only their scopes are requested. Unknown fields are refused (422). Enabling any `send`, `spend` or `destructive` tool needs an owner's approval (428). `auto_org` names the Auto org that governs the connection (its authority checks and approvals); a connect carrying `auto_org` always answers `428 APPROVAL_REQUIRED` first, so a person approves binding the connection to that Auto org.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Connections.Approval"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Connections.ConnectRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Connection created, waiting for a person to authorize it",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.ConnectResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Connections.Conflict"
+          },
+          "410": {
+            "$ref": "#/components/responses/Connections.ToolChanged"
+          },
+          "422": {
+            "$ref": "#/components/responses/Connections.Invalid"
+          },
+          "428": {
+            "$ref": "#/components/responses/Connections.ApprovalRequired"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "POST",
+          "path": "/v1",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/{id}": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        }
+      ],
+      "get": {
+        "operationId": "connections_get",
+        "summary": "Get a connection",
+        "description": "Scope `connections:read`. Status, granted scopes and the pinned manifest hash.",
+        "responses": {
+          "200": {
+            "description": "The connection",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.Connection"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/{id}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      },
+      "delete": {
+        "operationId": "connections_revoke",
+        "summary": "Revoke a connection",
+        "description": "Scope `connections:write`. Never needs an approval. Blinds deletes the stored tokens and asks the vendor to revoke them (best effort, reported as `vendor_revoked`; `tokens_deleted` is false when Blinds did not confirm, and repeating the DELETE retries). The connection stays listed as `revoked`.",
+        "responses": {
+          "200": {
+            "description": "Revoked",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.RevokeResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "DELETE",
+          "path": "/v1/{id}",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/{id}/authorize": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        }
+      ],
+      "post": {
+        "operationId": "connections_authorize",
+        "summary": "Get a new authorize URL for a person to open",
+        "description": "Scope `connections:write`. Returns a fresh `authorize_url` (its `state` is single use and valid for 10 minutes). Human step: a person opens it in a browser. The hosted MCP refuses this operation for agents (human consent); use the CLI (`genesis connections authorize <id>`) or the Console.",
+        "responses": {
+          "200": {
+            "description": "The URL a person opens to consent at the vendor",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.AuthorizeResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Connections.Conflict"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "POST",
+          "path": "/v1/{id}/authorize",
+          "status": "not_deployed"
+        },
+        "x-mcp": false
+      }
+    },
+    "/v1/connections/{id}/tools": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        }
+      ],
+      "get": {
+        "operationId": "connections_listTools",
+        "summary": "List a connection's tools with their policy",
+        "description": "Scope `connections:read`. The pinned manifest's tools, each with its effect, scopes, policy mode and the vendor's description and input schema (untrusted).",
+        "responses": {
+          "200": {
+            "description": "Tools",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.ToolList"
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "410": {
+            "$ref": "#/components/responses/Connections.ToolChanged"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/{id}/tools",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      },
+      "patch": {
+        "operationId": "connections_setToolPolicy",
+        "summary": "Set tool policies (allow, approve or deny)",
+        "description": "Scope `connections:write`. `tools` maps tool names to `allow`, `approve` or `deny`; `send`, `spend` and `destructive` tools take `approve` or `deny` only (422 for `allow`). Narrowing never needs an approval; widening (deny to approve or allow, approve to allow) needs an owner's approval (428) and Auto's `connections.widen` check. When the change needs scopes not yet granted, the answer carries `reauthorize`.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Connections.Approval"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Connections.ToolPolicyRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The connection with its new policy and the changes made",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.ToolPolicyResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Connections.Conflict"
+          },
+          "422": {
+            "$ref": "#/components/responses/Connections.Invalid"
+          },
+          "428": {
+            "$ref": "#/components/responses/Connections.ApprovalRequired"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "PATCH",
+          "path": "/v1/{id}/tools",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/{id}/tools/{tool}/call": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        },
+        {
+          "$ref": "#/components/parameters/Connections.Tool"
+        }
+      ],
+      "post": {
+        "operationId": "connections_call",
+        "summary": "Call a connected tool",
+        "description": "Scope `connections:write`. Runs Auto's `connections.call` check, then calls the tool through Blinds. The result is third-party content inside the `untrusted` wrapper. A tool whose policy is `approve`, or a write to another connection after this session read untrusted content, answers 428; retry with `OneOS-Approval`.",
+        "parameters": [
+          {
+            "$ref": "#/components/parameters/Connections.Approval"
+          }
+        ],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/Connections.CallRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The call's outcome and its wrapped result",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.CallResult"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          },
+          "409": {
+            "$ref": "#/components/responses/Connections.NeedsReauth"
+          },
+          "410": {
+            "$ref": "#/components/responses/Connections.ToolChanged"
+          },
+          "422": {
+            "$ref": "#/components/responses/Connections.Invalid"
+          },
+          "428": {
+            "$ref": "#/components/responses/Connections.ApprovalRequired"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "POST",
+          "path": "/v1/{id}/tools/{tool}/call",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/{id}/activity": {
+      "parameters": [
+        {
+          "$ref": "#/components/parameters/Connections.Id"
+        }
+      ],
+      "get": {
+        "operationId": "connections_activity",
+        "summary": "Read a connection's activity ledger",
+        "description": "Scope `connections:read`. Append-only, hash-chained rows, oldest first; hashes only, never payloads. Page with `after` = `next_after`.",
+        "parameters": [
+          {
+            "name": "after",
+            "in": "query",
+            "required": false,
+            "description": "Return rows with a larger `seq` (default 0)",
+            "schema": {
+              "type": "integer",
+              "minimum": 0
+            }
+          },
+          {
+            "name": "limit",
+            "in": "query",
+            "required": false,
+            "description": "Page size, 1-500 (default 100)",
+            "schema": {
+              "type": "integer",
+              "minimum": 1,
+              "maximum": 500
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Ledger rows",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "type": "object",
+                  "required": [
+                    "data"
+                  ],
+                  "properties": {
+                    "data": {
+                      "type": "array",
+                      "items": {
+                        "$ref": "#/components/schemas/Connections.ActivityRow"
+                      }
+                    },
+                    "next_after": {
+                      "type": [
+                        "integer",
+                        "null"
+                      ]
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "404": {
+            "$ref": "#/components/responses/Connections.NotFound"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/{id}/activity",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/tools": {
+      "get": {
+        "operationId": "connections_searchTools",
+        "summary": "Search the connected tools your organization may call",
+        "description": "Scope `connections:read`. Connected tools of the selected environment whose policy is not `deny`, matched against `q` (at most 100). genesis-mcp's `genesis_search_tools` lists them by `name` (`conn.<connection>.<tool>`). `session_tainted` says whether this principal has read untrusted content.",
+        "parameters": [
+          {
+            "name": "q",
+            "in": "query",
+            "required": false,
+            "description": "Keywords",
+            "schema": {
+              "type": "string",
+              "maxLength": 200
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "Matching connected tools",
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/Connections.SearchToolsResponse"
+                }
+              }
+            }
+          },
+          "403": {
+            "$ref": "#/components/responses/Connections.Forbidden"
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/tools",
+          "status": "not_deployed"
+        },
+        "x-mcp": true
+      }
+    },
+    "/v1/connections/oauth/callback": {
+      "get": {
+        "operationId": "connections_oauthCallback",
+        "summary": "OAuth redirect target for a person's browser (anonymous)",
+        "description": "Human browser only; anonymous. The vendor redirects the person here after consent. The gateway forwards it with no identity envelope and no credential; Connections authenticates it only by the single-use `state` (10 minutes, bound to the connection and its PKCE verifier) and hands the code to Blinds. Not an API for agents.",
+        "parameters": [
+          {
+            "name": "state",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 512
+            }
+          },
+          {
+            "name": "code",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 2048
+            }
+          },
+          {
+            "name": "iss",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 512
+            }
+          },
+          {
+            "name": "error",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 256
+            }
+          },
+          {
+            "name": "error_description",
+            "in": "query",
+            "required": false,
+            "schema": {
+              "type": "string",
+              "maxLength": 1024
+            }
+          }
+        ],
+        "responses": {
+          "200": {
+            "description": "A page telling the person the connection is ready (or what failed)",
+            "content": {
+              "text/html": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          },
+          "400": {
+            "description": "Unknown, used or expired state",
+            "content": {
+              "text/html": {
+                "schema": {
+                  "type": "string"
+                }
+              }
+            }
+          }
+        },
+        "tags": [
+          "connections"
+        ],
+        "security": [],
+        "x-genesis-service": "connections",
+        "x-upstream": {
+          "base": "https://connections-api-808958844152.us-central1.run.app",
+          "method": "GET",
+          "path": "/v1/oauth/callback",
+          "status": "not_deployed"
+        },
+        "x-mcp": false
+      }
     }
   },
   "components": {
@@ -105260,39 +105765,6 @@
           }
         }
       },
-      "Hives.CreateSsoConnectionRequest": {
-        "type": "object",
-        "required": [
-          "name"
-        ],
-        "properties": {
-          "idp_type": {
-            "type": [
-              "string",
-              "null"
-            ],
-            "description": "IdP type hint"
-          },
-          "metadata_raw": {
-            "type": [
-              "string",
-              "null"
-            ],
-            "description": "Raw IdP metadata XML (alternative to URL)"
-          },
-          "metadata_url": {
-            "type": [
-              "string",
-              "null"
-            ],
-            "description": "IdP metadata URL (e.g. Okta, Azure AD metadata endpoint)"
-          },
-          "name": {
-            "type": "string",
-            "description": "Connection name/label"
-          }
-        }
-      },
       "Hives.CreateTerminalSessionRequest": {
         "type": "object",
         "description": "Create terminal session request",
@@ -157015,6 +157487,842 @@
             }
           }
         }
+      },
+      "Connections.Tier": {
+        "type": "string",
+        "enum": [
+          "verified",
+          "suspended",
+          "pending"
+        ]
+      },
+      "Connections.Effect": {
+        "type": "string",
+        "enum": [
+          "read",
+          "write",
+          "send",
+          "spend",
+          "destructive"
+        ]
+      },
+      "Connections.Mode": {
+        "type": "string",
+        "enum": [
+          "allow",
+          "approve",
+          "deny"
+        ]
+      },
+      "Connections.ConnectionStatus": {
+        "type": "string",
+        "enum": [
+          "pending_auth",
+          "active",
+          "needs_reauth",
+          "revoked"
+        ]
+      },
+      "Connections.Error": {
+        "type": "object",
+        "required": [
+          "error"
+        ],
+        "description": "Codes include TOOL_DENIED, AUTHORITY_DENIED (with `reasons`), APPROVAL_UNAVAILABLE (403), TOOL_CHANGED_PENDING_REVIEW (410), APPROVAL_CONSUMED, APPROVAL_NOT_APPROVED, APPROVAL_MISMATCH, revoked, conflict (409) and invalid (422).",
+        "properties": {
+          "error": {
+            "type": "object",
+            "required": [
+              "code",
+              "message"
+            ],
+            "properties": {
+              "code": {
+                "type": "string"
+              },
+              "message": {
+                "type": "string"
+              },
+              "request_id": {
+                "type": "string"
+              }
+            }
+          },
+          "reasons": {
+            "type": "array",
+            "items": {},
+            "description": "Auto's reasons on 403 AUTHORITY_DENIED"
+          },
+          "auto_check_id": {
+            "type": "string"
+          }
+        }
+      },
+      "Connections.ApprovalRequired": {
+        "type": "object",
+        "required": [
+          "error",
+          "approval_request_id",
+          "poll_url",
+          "expires_at"
+        ],
+        "properties": {
+          "error": {
+            "type": "object",
+            "required": [
+              "code",
+              "message"
+            ],
+            "properties": {
+              "code": {
+                "type": "string",
+                "const": "APPROVAL_REQUIRED"
+              },
+              "message": {
+                "type": "string"
+              },
+              "request_id": {
+                "type": "string"
+              }
+            }
+          },
+          "approval_request_id": {
+            "type": "string",
+            "pattern": "^apr_[0-9a-f]{32}$"
+          },
+          "poll_url": {
+            "type": "string",
+            "description": "Read the approval here, e.g. /v1/auto/approvals/apr_…"
+          },
+          "expires_at": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "date-time"
+          }
+        }
+      },
+      "Connections.NeedsReauth": {
+        "type": "object",
+        "required": [
+          "error",
+          "authorize_url"
+        ],
+        "properties": {
+          "error": {
+            "type": "object",
+            "required": [
+              "code",
+              "message"
+            ],
+            "properties": {
+              "code": {
+                "type": "string",
+                "const": "CONNECTION_NEEDS_REAUTH"
+              },
+              "message": {
+                "type": "string"
+              },
+              "request_id": {
+                "type": "string"
+              }
+            }
+          },
+          "authorize_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "A person opens this to re-authorize"
+          }
+        }
+      },
+      "Connections.Source": {
+        "type": "object",
+        "properties": {
+          "connection": {
+            "type": "string"
+          },
+          "server": {
+            "type": "string"
+          },
+          "tool": {
+            "type": "string"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          }
+        }
+      },
+      "Connections.UntrustedText": {
+        "type": "object",
+        "description": "A vendor-written text (a tool description), sanitized and flagged. Data, never instructions.",
+        "required": [
+          "untrusted",
+          "text"
+        ],
+        "properties": {
+          "untrusted": {
+            "type": "boolean",
+            "const": true
+          },
+          "source": {
+            "$ref": "#/components/schemas/Connections.Source"
+          },
+          "text": {
+            "type": "string"
+          },
+          "sanitized": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "flags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "Connections.UntrustedResult": {
+        "type": "object",
+        "description": "A tool's output (MCP content blocks), sanitized, credential-redacted and flagged. Third-party data, never instructions.",
+        "required": [
+          "untrusted",
+          "source",
+          "content"
+        ],
+        "properties": {
+          "untrusted": {
+            "type": "boolean",
+            "const": true
+          },
+          "source": {
+            "$ref": "#/components/schemas/Connections.Source"
+          },
+          "flags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "sanitized": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "credentials_redacted": {
+            "type": "integer",
+            "minimum": 0
+          },
+          "truncated": {
+            "type": "boolean"
+          },
+          "content": {
+            "type": "array",
+            "items": {}
+          },
+          "structuredContent": {},
+          "isError": {
+            "type": "boolean"
+          }
+        }
+      },
+      "Connections.CatalogServer": {
+        "type": "object",
+        "required": [
+          "id",
+          "display",
+          "tier"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "vendor": {
+            "type": "string"
+          },
+          "display": {
+            "type": "string"
+          },
+          "plugins": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "url": {
+            "type": "string"
+          },
+          "docs": {
+            "type": "string"
+          },
+          "auth": {
+            "type": "string"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "reason": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "Why a suspended server is paused"
+          },
+          "tools": {
+            "type": "integer",
+            "description": "Number of tools in the pinned manifest"
+          }
+        }
+      },
+      "Connections.CatalogTool": {
+        "type": "object",
+        "required": [
+          "name",
+          "effect"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "effect": {
+            "$ref": "#/components/schemas/Connections.Effect"
+          },
+          "scopes": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "description": {
+            "$ref": "#/components/schemas/Connections.UntrustedText"
+          }
+        }
+      },
+      "Connections.CatalogServerDetail": {
+        "type": "object",
+        "required": [
+          "id",
+          "display",
+          "tier",
+          "tools"
+        ],
+        "properties": {
+          "id": {
+            "type": "string"
+          },
+          "vendor": {
+            "type": "string"
+          },
+          "display": {
+            "type": "string"
+          },
+          "plugins": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "url": {
+            "type": "string"
+          },
+          "docs": {
+            "type": "string"
+          },
+          "auth": {
+            "type": "string"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "reason": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "manifest_sha256": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "tools": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Connections.CatalogTool"
+            }
+          }
+        }
+      },
+      "Connections.Connection": {
+        "type": "object",
+        "required": [
+          "id",
+          "server",
+          "status"
+        ],
+        "properties": {
+          "id": {
+            "type": "string",
+            "pattern": "^conn_[0-9a-f]{32}$"
+          },
+          "server": {
+            "type": "string"
+          },
+          "url": {
+            "type": "string"
+          },
+          "status": {
+            "$ref": "#/components/schemas/Connections.ConnectionStatus"
+          },
+          "auto_org": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "The Auto org that governs the connection, if one was named at connect"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "server_status": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "policy": {
+            "type": "object",
+            "additionalProperties": {
+              "$ref": "#/components/schemas/Connections.Mode"
+            }
+          },
+          "scopes_requested": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "scopes_granted": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "token_expires_at": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "date-time"
+          },
+          "created_by": {
+            "type": "string"
+          },
+          "created_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "updated_at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "revoked_at": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "format": "date-time"
+          }
+        }
+      },
+      "Connections.ConnectRequest": {
+        "type": "object",
+        "required": [
+          "server"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "server": {
+            "type": "string",
+            "pattern": "^[a-z0-9-]{1,64}$"
+          },
+          "tools": {
+            "type": "array",
+            "maxItems": 500,
+            "items": {
+              "type": "string",
+              "pattern": "^[A-Za-z0-9_.-]{1,128}$"
+            },
+            "description": "Tools to enable (default: the manifest defaults)"
+          },
+          "auto_org": {
+            "type": "string",
+            "pattern": "^aorg_[a-f0-9]{32}$",
+            "description": "The Auto org that governs the connection. A connect carrying it always answers 428 APPROVAL_REQUIRED first."
+          }
+        }
+      },
+      "Connections.ConnectResponse": {
+        "type": "object",
+        "required": [
+          "connection",
+          "authorize_url"
+        ],
+        "properties": {
+          "connection": {
+            "$ref": "#/components/schemas/Connections.Connection"
+          },
+          "authorize_url": {
+            "type": "string",
+            "format": "uri",
+            "description": "A person opens this to consent at the vendor"
+          },
+          "next": {
+            "type": "string"
+          }
+        }
+      },
+      "Connections.AuthorizeResponse": {
+        "type": "object",
+        "required": [
+          "authorize_url"
+        ],
+        "properties": {
+          "authorize_url": {
+            "type": "string",
+            "format": "uri"
+          },
+          "next": {
+            "type": "string"
+          }
+        }
+      },
+      "Connections.ConnectionTool": {
+        "type": "object",
+        "required": [
+          "name",
+          "effect",
+          "mode"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "effect": {
+            "$ref": "#/components/schemas/Connections.Effect"
+          },
+          "mode": {
+            "$ref": "#/components/schemas/Connections.Mode"
+          },
+          "stored_mode": {
+            "$ref": "#/components/schemas/Connections.Mode"
+          },
+          "scopes": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          },
+          "description": {
+            "$ref": "#/components/schemas/Connections.UntrustedText"
+          },
+          "inputSchema": {},
+          "schema_flags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "Connections.ToolList": {
+        "type": "object",
+        "required": [
+          "connection",
+          "server",
+          "tools"
+        ],
+        "properties": {
+          "connection": {
+            "type": "string"
+          },
+          "server": {
+            "type": "string"
+          },
+          "tier": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "server_status": {
+            "$ref": "#/components/schemas/Connections.Tier"
+          },
+          "manifest_sha256": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "tools": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Connections.ConnectionTool"
+            }
+          }
+        }
+      },
+      "Connections.ToolPolicyRequest": {
+        "type": "object",
+        "required": [
+          "tools"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "tools": {
+            "type": "object",
+            "maxProperties": 500,
+            "additionalProperties": {
+              "$ref": "#/components/schemas/Connections.Mode"
+            },
+            "description": "Tool name to mode, e.g. {\"create_issue\": \"approve\"}"
+          }
+        }
+      },
+      "Connections.ToolPolicyResponse": {
+        "type": "object",
+        "required": [
+          "connection",
+          "changed"
+        ],
+        "properties": {
+          "connection": {
+            "$ref": "#/components/schemas/Connections.Connection"
+          },
+          "changed": {
+            "type": "array",
+            "items": {
+              "type": "object",
+              "properties": {
+                "name": {
+                  "type": "string"
+                },
+                "effect": {
+                  "$ref": "#/components/schemas/Connections.Effect"
+                },
+                "from": {
+                  "$ref": "#/components/schemas/Connections.Mode"
+                },
+                "to": {
+                  "$ref": "#/components/schemas/Connections.Mode"
+                }
+              }
+            }
+          },
+          "reauthorize": {
+            "type": "object",
+            "properties": {
+              "missing_scopes": {
+                "type": "array",
+                "items": {
+                  "type": "string"
+                }
+              },
+              "authorize_url": {
+                "type": "string",
+                "format": "uri"
+              }
+            }
+          }
+        }
+      },
+      "Connections.CallRequest": {
+        "type": "object",
+        "required": [
+          "arguments"
+        ],
+        "additionalProperties": false,
+        "properties": {
+          "arguments": {
+            "type": "object",
+            "additionalProperties": true,
+            "description": "The tool's arguments, as its inputSchema describes"
+          }
+        }
+      },
+      "Connections.CallResult": {
+        "type": "object",
+        "required": [
+          "call_id",
+          "outcome",
+          "result"
+        ],
+        "properties": {
+          "call_id": {
+            "type": "string"
+          },
+          "outcome": {
+            "type": "string",
+            "enum": [
+              "ok",
+              "tool_error"
+            ]
+          },
+          "result": {
+            "$ref": "#/components/schemas/Connections.UntrustedResult"
+          },
+          "auto_check_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "auto_receipt": {
+            "type": [
+              "string",
+              "null"
+            ],
+            "description": "Auto's signed receipt (JWS)"
+          },
+          "approval_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          }
+        }
+      },
+      "Connections.RevokeResponse": {
+        "type": "object",
+        "required": [
+          "connection"
+        ],
+        "properties": {
+          "connection": {
+            "$ref": "#/components/schemas/Connections.Connection"
+          },
+          "vendor_revoked": {
+            "type": "boolean"
+          },
+          "tokens_deleted": {
+            "type": "boolean"
+          }
+        }
+      },
+      "Connections.ActivityRow": {
+        "type": "object",
+        "required": [
+          "seq",
+          "kind",
+          "outcome",
+          "hash"
+        ],
+        "additionalProperties": true,
+        "properties": {
+          "seq": {
+            "type": "integer"
+          },
+          "at": {
+            "type": "string",
+            "format": "date-time"
+          },
+          "kind": {
+            "type": "string"
+          },
+          "connection_id": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "principal": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "tool": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "args_sha256": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "result_sha256": {
+            "type": [
+              "string",
+              "null"
+            ]
+          },
+          "outcome": {
+            "type": "string"
+          },
+          "prev_hash": {
+            "type": "string"
+          },
+          "hash": {
+            "type": "string"
+          }
+        }
+      },
+      "Connections.ConnectedTool": {
+        "type": "object",
+        "required": [
+          "name",
+          "connection",
+          "server",
+          "tool",
+          "effect"
+        ],
+        "properties": {
+          "name": {
+            "type": "string",
+            "description": "conn.<connection>.<tool>"
+          },
+          "connection": {
+            "type": "string",
+            "pattern": "^conn_[0-9a-f]{32}$"
+          },
+          "server": {
+            "type": "string"
+          },
+          "tool": {
+            "type": "string"
+          },
+          "effect": {
+            "$ref": "#/components/schemas/Connections.Effect"
+          },
+          "mode": {
+            "$ref": "#/components/schemas/Connections.Mode"
+          },
+          "description": {
+            "$ref": "#/components/schemas/Connections.UntrustedText"
+          },
+          "inputSchema": {},
+          "schema_flags": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            }
+          }
+        }
+      },
+      "Connections.SearchToolsResponse": {
+        "type": "object",
+        "required": [
+          "data"
+        ],
+        "properties": {
+          "data": {
+            "type": "array",
+            "items": {
+              "$ref": "#/components/schemas/Connections.ConnectedTool"
+            }
+          },
+          "session_tainted": {
+            "type": "boolean"
+          }
+        }
       }
     },
     "responses": {
@@ -157593,6 +158901,76 @@
             }
           }
         }
+      },
+      "Connections.Forbidden": {
+        "description": "Missing scope; `TOOL_DENIED` (policy deny or not in the manifest); `AUTHORITY_DENIED` with `reasons` (Auto denied); `APPROVAL_UNAVAILABLE` (an approval is needed but the org has no Auto org)",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.NotFound": {
+        "description": "Not found in your organization and environment",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.Conflict": {
+        "description": "`revoked`, `conflict` (the policy changed meanwhile), or an approval refusal: `APPROVAL_CONSUMED`, `APPROVAL_NOT_APPROVED`, `APPROVAL_MISMATCH`",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.NeedsReauth": {
+        "description": "`CONNECTION_NEEDS_REAUTH`: a person opens the fresh `authorize_url` (an approval refusal or `revoked` is also a 409, without it)",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.NeedsReauth"
+            }
+          }
+        }
+      },
+      "Connections.ToolChanged": {
+        "description": "`TOOL_CHANGED_PENDING_REVIEW`: the server's live tools differ from its pinned manifest; it is suspended for every organization until re-verified",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.Invalid": {
+        "description": "Invalid request body or parameters",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.Error"
+            }
+          }
+        }
+      },
+      "Connections.ApprovalRequired": {
+        "description": "`APPROVAL_REQUIRED`: a human approves `approval_request_id` in Auto; then retry the same request with `OneOS-Approval`",
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/Connections.ApprovalRequired"
+            }
+          }
+        }
       }
     },
     "parameters": {
@@ -158718,6 +160096,46 @@
           "maxLength": 256
         },
         "description": "Stable key; a retry with it returns the original decision instead of creating another"
+      },
+      "Connections.Id": {
+        "name": "id",
+        "in": "path",
+        "required": true,
+        "description": "Connection id (conn_ followed by 32 hex)",
+        "schema": {
+          "type": "string",
+          "pattern": "^conn_[0-9a-f]{32}$"
+        }
+      },
+      "Connections.Server": {
+        "name": "server",
+        "in": "path",
+        "required": true,
+        "description": "Catalog server id, e.g. linear, neon, sentry",
+        "schema": {
+          "type": "string",
+          "pattern": "^[a-z0-9-]{1,64}$"
+        }
+      },
+      "Connections.Tool": {
+        "name": "tool",
+        "in": "path",
+        "required": true,
+        "description": "The tool's name in the pinned manifest",
+        "schema": {
+          "type": "string",
+          "pattern": "^[A-Za-z0-9_.-]{1,128}$"
+        }
+      },
+      "Connections.Approval": {
+        "name": "OneOS-Approval",
+        "in": "header",
+        "required": false,
+        "description": "An approved approval id (`apr_…`) from an earlier 428, to retry the same request",
+        "schema": {
+          "type": "string",
+          "pattern": "^apr_[0-9a-f]{32}$"
+        }
       }
     },
     "headers": {
@@ -158754,7 +160172,7 @@
       "upstream": "https://api.fdy.sh",
       "status": "live",
       "statusNote": "api.fdy.sh answered in the Oct 9 inventory probe",
-      "operations": 116
+      "operations": 115
     },
     {
       "name": "hives",
@@ -158762,7 +160180,7 @@
       "upstream": "https://api.hives.sh",
       "status": "down",
       "statusNote": "api.hives.sh returned 503 (audit G-LIVE-1); spec misses 35 console-called paths (G-SPEC-1)",
-      "operations": 198
+      "operations": 195
     },
     {
       "name": "relays",
@@ -158994,6 +160412,15 @@
       "statusNote": "Org API keys and One account logins with a selected project (gateway/src/brews-transport.ts). Sandbox. Omit scope: Brews fills it from the selection. Run, eval and bench answer 503 BREWS_E_METERING_UNAVAILABLE.",
       "gatewayRoute": "dedicated",
       "operations": 22
+    },
+    {
+      "name": "connections",
+      "title": "Connections (verified remote MCP servers)",
+      "upstream": "https://connections-api-808958844152.us-central1.run.app",
+      "status": "not_deployed",
+      "statusNote": "Closed gateway admission behind CONNECTIONS_GATEWAY_ENABLED (default off): /v1/connections/* with a v2 signed identity and selected context (API key, M2M token or login session); connections:read for GET, connections:write otherwise, connections:* both. Sandbox in P0; Live only through UPSTREAM_CONNECTIONS_LIVE once connections is in GENESIS_LIVE_SERVICES. GET /v1/connections/oauth/callback is anonymous (a person's browser after vendor consent): no credential is read or forwarded and no identity envelope is sent. connections_authorize is a human-consent operation the hosted MCP refuses. Tool results and vendor descriptions are wrapped as untrusted. Vendor tokens live in Blinds only.",
+      "gatewayRoute": "dedicated",
+      "operations": 13
     }
   ]
 }