Repository navigation
Ten new connectors: Figma, Miro, GitLab, Cloudflare, Supabase, PayPal, Square, DocuSign, Shippo, Zoho Books - #1022
Merged
Merged
Conversation
…ted) - figma (27 tools): REST API with a personal access token in X-Figma-Token. User, file metadata, document tree (depth 2 by default, 200 KB cap), nodes, image renders and fills, versions, comments and reactions, team projects and files, team and file components, component sets and styles, dev resources. Dev resource deletion installs switched off; refused dev resources and render errors in a 200 answer fail the call. - miro (40 tools): REST API v2 with OAuth 2.0 (authorization code, refresh, client_secret_post; scopes are ticked on the app). Boards (find, read, create, rename, copy), items of every type (list, read, move, delete), sticky notes, shapes, text, cards and frames (create and change), connectors, tags (create, attach, remove, find items) and board members. Board deletion, sharing and member changes install switched off. Tag removal keeps tag_id in the path template so it can never become a plain item delete. - gitlab (39 tools): REST API v4 under GITLAB_URL (https://gitlab.com or a self-managed instance) with a personal access token. Projects, members, labels, issues and notes, merge requests with diffs, commits and notes, pipelines, jobs and job logs, branches, commits, tree, files and instance and project search. Path arguments are URL-encoded, list tools return the pagination headers. Issue and branch deletion install switched off; nothing merges, pushes or runs pipelines. - cloudflare (26 tools): API v4 with an API token. Zones, settings, DNS records (list, export, create, change, delete), cache purge by URL, tag, host or prefix, rulesets and phase entry points, page rules, daily traffic and free GraphQL analytics queries, Workers (scripts, settings, code, routes, domains) and R2 buckets. Record deletion and purge everything install switched off; GraphQL errors in a 200 answer fail the call. - supabase (24 tools): Management API with a personal access token. Projects, organizations, health, read-only SQL with bound parameters, schemas, tables, table details, extensions, migrations, backups, TypeScript types, Edge Functions, API keys (only public key values; secret and service_role values are dropped), logs on the current logs endpoint, API usage, security and performance advisors, branches and storage buckets. Full-rights SQL installs switched off. All five are unlisted, so the quoted adapter counts stay at 338. Each has static checks, request-shape checks against a local server, opt-in live reads, and write round-trips behind <VENDOR>_LIVE_WRITE=1 that clean up in finally.
…listed) - paypal (28 tools): REST APIs with the app's own keys through the existing OAuth2 client_credentials grant (HTTP Basic at PAYPAL_API_URL/v1/oauth2/token); PAYPAL_API_URL picks sandbox or live. Orders (create, get, capture), captures, refunds and authorizations, Invoicing v2 (list, search, create draft, get, send, remind, cancel; delete draft installs switched off), Transaction Search and balances, disputes, catalog products, plans, subscriptions with their transactions and cancel, payout batches. Capture, refund and both cancels are destructive and ask for confirmation. - square (34 tools): bearer access token, Square-Version 2026-09-16, SQUARE_API_URL for sandbox or production. Merchant, locations, payments, refunds (refund is destructive), orders, customers, catalog list, search and upsert, inventory counts, invoices (create, publish, cancel) and team members. Deletes of customers, catalog objects and draft invoices install switched off. - docusign (17 tools): eSignature REST API v2.1, authorization code grant with HTTP Basic at the token endpoint and the signature extended scopes on DOCUSIGN_AUTH_URL (demo or production); the base path is built from DOCUSIGN_BASE_URI and DOCUSIGN_ACCOUNT_ID, checked with a userinfo tool. Envelopes (list, get, create from a template or a base64 document as drafts by default, send, resend, void), recipients, documents with a base64 download (Content-Transfer-Encoding header, 1.5 MB cap), audit events, form data, templates. Moving envelopes to the recycle bin installs switched off. - shippo (30 tools): ShippoToken key, no version header (it would change the account default). Addresses with validation, parcels, parcel templates, shipments and rates, buying labels, tracking, carrier accounts, customs items and declarations, label refunds, manifests. Buying and refunding a label are destructive. - zoho-books (44 tools): Zoho OAuth with configurable data-center sign-in server and API host, Zoho-oauthtoken header, organization_id on every call. Organizations, contacts, items, invoices (create, email, mark sent, void), estimates, customer payments, bills, expenses, chart of accounts and account transactions, bank accounts and transactions, taxes. Deletes install switched off; errorWhen catches a non-zero code in a 200 answer. No engine change. Each adapter has a static spec (auth, variable patterns, every tool's URL, bodies, annotations) and live reads plus cleaned-up write round-trips behind <VENDOR>_LIVE_WRITE=1. All unlisted, so the quoted adapter counts stay unchanged.
Coding-Professional
left a comment
Coding-Professional
left a comment
Contributor
There was a problem hiding this comment.
I checked the Supabase API-key tool against the current Management API docs and found two related cases worth covering before listing this connector.
| "path": "/v1/projects/{project_ref}/api-keys", | ||
| "encodePathParams": true, | ||
| "queryParams": { | ||
| "reveal": "false" |
Contributor
There was a problem hiding this comment.
The tool description promises values for publishable and legacy anon keys, but Supabase documents reveal=true as the option that includes key values. With reveal=false, this request appears to return metadata only; the unit test passes a hand-built response with values straight to the transform, so it cannot catch that mismatch. Could we either describe this as metadata-only or test a safe path that actually returns the public values? Docs: https://supabase.com/docs/guides/getting-started/api-keys#find-your-keys
| "responseMapping": { | ||
| "transform": { | ||
| "mode": "jmespath", | ||
| "expression": "[].{id: id, name: name, type: type, prefix: prefix, description: description, inserted_at: inserted_at, updated_at: updated_at, api_key: (type == 'publishable' || name == 'anon') && api_key || `null`}", |
Contributor
There was a problem hiding this comment.
Please make the legacy-anon exception depend on both type == 'legacy' and name == 'anon'. A named secret key can also be called anon; given {type: 'secret', name: 'anon', api_key: 'sb_secret_example'}, this expression passes its value through to the agent. reveal=false may mask it in the current API response, but the transform itself should be safe if a value is present, as in the PR fixture. A regression case with a secret key named anon would protect the intended no-secret-values guarantee. Supabase documents named secret keys and their elevated access: https://supabase.com/docs/guides/getting-started/api-keys
… and Miro Figma: team projects moved to the v2 folder endpoints (folders:read), since new tokens can no longer get projects:read; adds subfolders. A wrong token is a 401, a missing scope a 403. Without Dev Mode access Figma answers "File not found" on dev resources; the tools, instructions and a new error hint say so, and the live spec accepts that refusal. DocuSign: the live spec gives the account variables a stand-in until userinfo names the account, so the placeholder guard lets userinfo through. Shippo: validating an address saves a new, standardized address with its own object_id; the description says to ship to it, and the spec does. Zoho Books: customer payments list under "customerpayments". A sent invoice cannot be deleted (code 4529), not even once void; adds zoho_books_mark_invoice_draft and documents voiding as the correction. PayPal: transaction search and balances omit their arrays on an empty account; descriptions and the spec allow for that. Miro: frame creation answered valid bodies with 500 for minutes at a time; the tool says to retry unchanged and the live spec retries a 500 for up to a minute.
…tLab stays unlisted
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ten new catalog connectors. Nine are listed after live tests against real accounts on 11 Oct; GitLab stays unlisted until it has been tested.
Fixes found by the live runs:
Quoted counts go from 338 to 347. No engine changes.