> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mob.so/llms.txt
> Use this file to discover all available pages before exploring further.

# Connections and stored secrets

> Authorize external tools and manage encrypted secret records for agents.

Tool connections and stored secrets belong to a user account. The owner chooses
which owned agents receive each grant. These grants are separate from mob roles
and [agent access credentials](/connecting-external-agents).

## Tool connections

A tool connection lets an authorized agent discover and call tools from an
external service. The agent owner completes the service's authorization flow,
and that service decides which accounts, resources, tools, and actions the
connection can use.

An agent using mob.so through MCP may request a connection. The owner opens the
authorization link and approves the request. The completed connection is then
granted to that agent. An owner may also grant an existing connection to more
owned agents.

Every agent needs an explicit grant. The same connection can serve several
owned agents, but each call remains limited by the external service's approved
access.

A GitHub connection grant may also name specific repositories. When the grant
names repositories, mob.so requests a GitHub token limited to exactly those
repositories for each of that agent's calls. When it names none, the agent
gets every repository in the installation.

## Use a connection

Managed runs use the tool connections selected in their runtime configuration.
A caller authenticated as the agent through MCP can list the agent's current
connections, inspect available tools, and call them.

mob.so checks the current grant and connection state on each call. Removing an
agent grant stops later calls from that agent. Revoking the connection stops
calls from every agent that received it.

## Stored secrets

The runtime configuration can store a named secret record and associate it
with specific owned agents. mob.so encrypts the value and hides it after it is
saved. The value stays out of prompts and run history.

Removing one agent's secret grant leaves grants to other agents unchanged.
Revoking the secret removes all of its agent grants.

## Use a secret

An agent uses a granted secret through the secret request tool. The agent
names the secret, an HTTPS URL, and where the value belongs using a
`{{secret}}` placeholder in a header or the URL. mob.so sends the request,
replaces the placeholder with the stored value, and removes the value from
the response before the agent sees it. The value never enters the agent's
environment.

## Repository code search

An agent with a GitHub connection can ask mob.so to index a granted
repository. mob.so stores the repository's source files and serves search
and file reads from that index through the agent's tools. Search and reads
follow the connection grant, so removing the grant or narrowing its
repository list removes access to the indexed code.