Tools from someone else's API

Where tools come from

A connector is an outside API your deployment brings, under one credential you hold. vendo sync reads your own API; a connector reads someone else’s at boot and hands the result to the same registry. Connector tools are ordinary tools. They collide-check against your own by name, they take corrections in .vendo/overrides.json, and every call goes through the guard.

Any REST API with a spec

openApiConnector takes the spec document, not a path or a URL. Read it, bundle it, or fetch it yourself, then hand it over.

app/api/vendo/[...vendo]/route.ts

import { readFileSync } from "node:fs";
import { createVendo, openApiConnector } from "@vendoai/vendo/server";

const vendo = createVendo({
  connectors: [
    openApiConnector({
      name: "ledger",
      spec: readFileSync("./specs/ledger.json", "utf8"),
      baseUrl: "https://api.ledger.example",
      headers: { authorization: `Bearer ${process.env.LEDGER_TOKEN}` },
    }),
  ],
});

Option	What it does
`spec`	The document itself: JSON text, YAML text, or an already-parsed object.
`baseUrl`	Where the calls land. Wins over the spec’s own `servers[0]`.
`headers`	Static headers, or a function called per tool call (below).
`name`	The namespace every tool is named under. Defaults to `openapi`.

Each operation becomes one tool — openapi_ledger_getAccount. Path, query, and body parameters come straight off the spec, so the model sees the API’s own declared shape. Risk comes from the method, never the name: DELETE is destructive, everything else is ungraded, and the guard asks about every ungraded call. Grade them by name:

.vendo/overrides.json

{
  "format": "vendo/overrides@3",
  "tools": {
    "openapi_ledger_getAccount": { "risk": "read" },
    "openapi_ledger_createAccount": { "risk": "write" }
  }
}

An MCP server

mcpConnector speaks streamable HTTP to any MCP server and lists its tools at boot.

app/api/vendo/[...vendo]/route.ts

import { createVendo, mcpConnector } from "@vendoai/vendo/server";

const vendo = createVendo({
  connectors: [
    mcpConnector({
      name: "linear",
      url: "https://mcp.linear.app/mcp",
      headers: { authorization: `Bearer ${process.env.LINEAR_TOKEN}` },
    }),
  ],
});

Tools are named mcp_<name>_<tool>. Risk comes off the server’s own annotations: destructiveHint is destructive, readOnlyHint is read, anything else is write.

One credential per user

Pass a function instead of an object and it runs on every call, with the acting principal in hand. Both connectors take the same shape.

openApiConnector({
  name: "ledger",
  spec,
  baseUrl: "https://api.ledger.example",
  headers: async ({ principal }) => ({
    authorization: `Bearer ${await tokenFor(principal?.subject)}`,
  }),
});

The resolver receives principal, presence (present or away), and grant when the guard decided the call against a standing permission.

Hand back a service-level credential when principal is undefined, never a specific user’s. mcpConnector also resolves headers when it lists a server’s tools, and that listing is a system operation with no principal.

An MCP connector with a resolver keeps one protocol session per subject, so a server that binds auth to the session can never mix two users up.

Which credential runs the call

Layer	Who sets it up	Whose credential runs the call
A connector’s static `headers`	You, once, at boot	Yours — the whole deployment shares it
A connector’s headers resolver	You, once, at boot	Whatever you hand back for that principal
Connected accounts	Each user, through one OAuth popup	Theirs — the broker holds it and runs the call
Tenant connectors	One of your customer companies, by pasting a token	That company’s — one token, shared by all its members

Get started

Vendo's Full-Stack Agent

In your existing agent

From outside agents

How to

Generated UI & apps

Make it yours

Capabilities

Production

Tools from someone else's API

Where tools come from

Any REST API with a spec

An MCP server

One credential per user

Which credential runs the call

​Where tools come from

​Any REST API with a spec

​An MCP server

​One credential per user

​Which credential runs the call

Where tools come from

Any REST API with a spec

An MCP server

One credential per user

Which credential runs the call