Remote connectors

This is the direction that works, and it is not the one the previous pages describe. Here Deskworth is the client: an operator declares a third-party MCP server — a finance data provider, an internal service — and assigns it to specific roles.

#A connector is an outward path, and it is treated as one

The rule the whole capability model rests on is that no role combines reading the operator’s own data with reaching outward. A connector reaches outward. So a role that reads the desk or a deposited file cannot receive one — and that refusal is carried by the code, not by a warning in a settings screen.

• AVAILABLEA role holding desk or deposit access is refused a connectorRefused at declaration time, with a message naming the rule. It is the same separation that stops the application from opening if any role ever combines the two.
• AVAILABLEThe address must be httpsAnything else is refused. A loopback address is compared whole against a short list — a hostname beginning with a loopback address and continuing into someone else’s domain used to pass, which would have sent the operator’s question out in clear text.
• AVAILABLEThe name deskworth is reservedTwo declarations merge into one namespace. A third-party server taking that name would silently replace the tool server — leaving the card mute, or handing it finance tools Deskworth did not write, with that card’s token.
• AVAILABLEDeskworth never sees the connector’s tokenSign-in happens inside the CLI and the token lives in the macOS keychain. The declaration Deskworth writes holds a name, an address and a role list.
• PLANNEDA remote connector reaching your local DeskworthImpossible by construction: the connection does not start from your machine, so a loopback address is not something it can reach 2.

LimitOne residual risk is accepted openly rather than hidden: a connector is approved by the operator, and what it returns is data the agent reads. Fetched content is treated as data and never as instruction — a design rule of the capability system, not a filter applied afterwards.