Connectors & governance
Importing and exporting MCP connector configurations
Connector configuration is reviewable state, so it moves between environments as an export you can read in a pull request. What does not move is the credential: each environment holds its own.
Open Connector config export & import in the consoleWhat moves, and what does not
An export is the shape of a project's connector configuration — which servers exist, what type each one is, and the policy around them — in a form you can read in a review before importing it somewhere else.
Exporting a configuration
- Export from the source projectYou get the shape of its connector setup: which servers exist, what type each one is, and the policy around them.
- Read it in reviewThe export is reviewable text, which is the point — a connector change that nobody could read before it applied would be governance in name only.
- Import into the target projectThe servers and policy arrive. What does not arrive is any credential.
What the target environment still needs
An imported configuration is not a working connection. Each environment holds its own credential, encrypted with its own key, and each connection must pass its own safety sweep before an agent can reach it.
- Add the environment's own credential for each imported server.
- Let each connection's sweep run and pass.
- Confirm the agent grants came across as intended, and narrow any that arrived broader than this environment needs.
What to look for in review
Put it into practice
Run a fleet with these guardrails on from day one.
Hard cost caps, one audited gateway in front of every tool call, and versioned rule files — the defaults, not an enterprise add-on.