> ## Documentation Index
> Fetch the complete documentation index at: https://docs.nemu.cc/llms.txt
> Use this file to discover all available pages before exploring further.

# Connectors

> Your own databases, servers and MCP tools, behind an approval gate

A connector points the assistant at something of yours: a Postgres or MySQL
database, a server over SSH, or an MCP server. Credentials are sealed and only
decrypted for the length of one call.

Add one from the **+** menu in the composer.

## The three kinds

**Database.** Postgres or MySQL. Host, port, database, username, password, and
TLS settings if you need them. The assistant gets a `run_sql_query` tool.

**SSH.** Host, port, username, and either a password or a private key with an
optional passphrase. The assistant gets an `ssh_run_command` tool.

**MCP.** A URL and a transport, either HTTP or SSE. Authentication can be none,
a header, a bearer token or OAuth. The server's own tools appear to the
assistant with their real names and descriptions.

New connectors are read only by default.

## Nothing writes without you

Reads run. Anything that could change something stops and asks.

For SQL, statements beginning `select`, `with`, `show`, `explain`, `describe`,
`values` or `table` are reads. Everything else is a write and is gated. So is
anything with multiple statements, and a CTE that hides an insert or delete
inside it.

**Every SSH command is gated**, with no read and write distinction, because a
shell command is too easy to disguise.

MCP tools skip the gate only when the server itself declares them read only.

## Approving

When something is gated you get four choices.

| Choice            | Effect                                       |
| ----------------- | -------------------------------------------- |
| Add to allow list | Remember this shape of command for this chat |
| Allow, just once  | Run it and ask again next time               |
| Deny              | Skip it                                      |
| Deny all          | Stop asking for the rest of this turn        |

Commands judged dangerous, such as `drop`, `truncate`, `grant`, `rm`, `dd`,
`sudo` or anything carrying shell metacharacters, are marked **Dangerous action,
review carefully** and cannot be added to an allow list. They can only ever be
approved one at a time.

An allow list entry is scoped to one chat and one connector. It does not carry
over to another conversation.

<Warning>
  There is currently no screen for reviewing or revoking allow list entries. They
  live with the chat, so clearing the chat is the way to drop them.
</Warning>

## Limits

Queries return at most 1,000 rows and are cancelled after 30 seconds. SSH
commands are cancelled after 30 seconds and their output is truncated at 100,000
characters.

There is no cap on how many connectors you may create and no plan gating on
them.

## MCP over OAuth

Choosing OAuth opens the provider in a new tab. Approve there, come back, and
press Verify connection. Tokens refresh a minute before they expire.
Disconnecting deletes the stored authorization outright.