Connectors let Eyra hand a task to a declared worker without turning that worker into an unbounded model-selected shell command. A connector can be a CLI, stdio MCP runner, local HTTP service, remote HTTP service, browser agent, coding agent, or guarded Python module. Eyra still owns the policy layer: manifest validation, route classification, acceptance checks, sandboxed working directories, static argv, approvals, timeouts, output caps, cancellation, redaction, logs, artifacts, and route-trace metadata.

​
Enablement

Connectors are disabled by default. 
CONNECTORS_ENABLED=false
CONNECTORS_CONFIG_PATH=~/.config/eyra/connectors.json
CONNECTORS_ALLOWED_ROOTS=
CONNECTORS_TIMEOUT_SECONDS=600
CONNECTORS_OUTPUT_CAP_BYTES=32768
CONNECTORS_ALLOW_REMOTE=false
CONNECTORS_ALLOW_PYTHON_MODULE=false
CONNECTORS_ALLOWED_ROOTS falls back to FILESYSTEM_ALLOWED_PATHS when empty. Remote HTTP connectors require CONNECTORS_ALLOW_REMOTE=true. Python module connectors require CONNECTORS_ALLOW_PYTHON_MODULE=true.

​
Manifest

CONNECTORS_CONFIG_PATH points to a JSON object with a connectors list. 
{
  "connectors": [
    {
      "id": "local_worker",
      "displayName": "Local Worker",
      "type": "cli",
      "enabled": true,
      "command": ["local-worker", "run", "--json"],
      "cwdPolicy": "request",
      "inputMode": "stdin_json",
      "outputMode": "stdout_json",
      "local": true,
      "canUseNetwork": false,
      "canReadFiles": true,
      "canMutateFiles": true,
      "canControlUI": false,
      "canRunShell": false,
      "requiresApproval": true,
      "riskTier": "medium_risk_change",
      "timeoutSeconds": 600,
      "outputCapBytes": 32768,
      "privacy": {
        "dataSent": ["task", "cwd", "selected_files"],
        "destination": "local CLI process",
        "leavesMachine": false
      },
      "acceptance": {
        "healthCommand": ["local-worker", "--version"],
        "testTask": "report status",
        "expectedOutputContains": "ok",
        "requiresHumanApproval": true
      }
    }
  ]
}
Connector ids must match ^[a-z][a-z0-9_-]{1,63}$. Commands and acceptance health commands must be static argv lists. Eyra rejects model-filled placeholders, shell interpolation, and shell interpreters with -c.

​
Types

TypeTransport
cliStatic local command
mcpStatic local MCP command
http_localPOST to localhost or loopback
http_remotePOST to a remote HTTP endpoint, opt-in only
python_modulepython -m <module>, guarded by opt-in
browser_agentStatic local browser-agent command
coding_agentStatic local coding-agent command

​
Risk tiers

TierMeaning
read_onlyReads bounded local or connector state
low_risk_changeLow-impact local changes
medium_risk_changeMutates files or performs bounded local work
high_risk_changeRisky local changes
irreversible_or_externalExternal or hard-to-undo action
delegated_agentAnother agent controls execution details
Approval is required when the manifest requests it, when the connector can mutate files, control UI, run shell, leave the machine, or when the risk tier is medium or higher. privacy.dataSent is also the runtime payload allowlist. Eyra always sends only connectorId and jobId automatically. It sends task only when task is declared, cwd only when cwd is declared, and selected paths only when selected_files is declared and every selected file resolves inside CONNECTORS_ALLOWED_ROOTS. file_contents, pdf, pdf_text, screenshot, and clipboard are reserved data classes. Manifest validation rejects them until the connector runner has explicit safe payload support for each class.

​
Acceptance

A connector must be accepted before use. Acceptance can run a declared health command and a declared test task, then records one of these states:
StateMeaning
not_configuredMissing connector or disabled connector system
configuredManifest loaded but not accepted yet
validation_failedManifest/config validation failed
availableTransport is available, or acceptance is waiting for human approval
acceptance_failedAcceptance check failed
acceptedHealth and test task actually ran successfully
disabledDisabled in manifest or current session

​
Terminal commands

/connectors
/connector <id>
/connector test <id>
/connector enable <id>
/connector disable <id>
/connector run <id> <task>
Eyra also recognizes direct phrases such as list connectors, show connector local_worker, ask connector local_worker to summarize this, and cancel local_worker.

​
CLI validation

eyra connectors validate
eyra connectors validate --json
eyra connectors list
eyra connectors test local_worker
eyra-connectors validate --json
The connector CLI forces connector loading for validation/list/test, redacts sensitive values, and exits non-zero when validation or acceptance fails. approval_required is not acceptance; approval-gated connectors remain available until the approval is granted and the acceptance test task runs successfully.

​
Runtime behavior

Connector jobs run as background tasks with durable job rows. Results include capped, redacted output plus connector artifacts such as connector id, redacted working directory or endpoint, output size, and duration. Cancellation works by connector id or job id. If a connector asks for approval, the job waits for an exact run_connector_task approval and reruns only after that approval is consumed. Remote connectors are never part of the default local path. Realtime voice does not expose connector execution as a browser-side tool.