APIConnections
Turn any HTTP API into AI-callable tools. Fetch web pages and REST APIs, read JavaScript-rendered pages in a hidden window, and pull the readable article out of a cluttered page. Define endpoints by hand or import an OpenAPI 3.x spec; pick from four auth methods including OAuth 2.0; ship the AI a typed schema for every operation. Attach reusable middlewares to inject the signed-in identity, add headers, reshape responses, or run a script. Give a connection its own render mode, retries, rate cap, and encrypted cookie jar. Built-in SSRF defense with localhost allowed by default, per-host allowlist, dynamic placeholders, and a per-endpoint test runner.
Any HTTP API Becomes a First-Class Tool
Define an API once and every endpoint registers as a typed MCP tool the AI can call directly. No bespoke plugin per service, no copy-paste of base URLs across prompts. The same panel manages everything from a one-off webhook to a 200-endpoint OpenAPI spec.
- Generic plexon_http_request tool for ad-hoc calls from any prompt
- Per-endpoint typed tools named plexon_http_<connection>__<endpoint>
- AI picks the right tool from name, description, and JSON Schema input
- Bring your own API in minutes, no code, no plugin packaging
Reads JavaScript Pages, Not Just Static HTML
Most fetch tools only see the raw HTML a server sends, so a single-page app comes back as an empty shell. Plexon renders the page in a hidden window when it detects a JavaScript app, waits for it to settle, and reads the real content. Ask for just the article and it strips the navigation and ads down to the title, byline, and body. It can also capture a screenshot of the rendered page.
- Auto mode fetches statically first and only renders when the page needs it
- Article mode returns the readable content, chrome removed
- Screenshots come back as an image you can view in the reply
- Rendering reads the page; it never clicks, types, or signs in
Per-Connection Fetch Options
Each connection carries its own request behavior. Set how pages render, a request timeout, automatic retries with backoff that respect Retry-After on rate limits and server errors, and a per-minute request cap. Turn on a cookie jar and the connection remembers its session between requests, encrypted on disk, so a login carries through to later calls.
- Retries apply to safe requests only; a POST is never replayed
- Rate limit caps how fast the AI can hit an API
- Cookie jar is per connection, opt-in, and encrypted at rest
- A Clear cookies button resets the session in one click
OpenAPI 3.x Import in One Click
Drop a Stripe, GitHub, or Notion OpenAPI spec into the panel and Plexon materialises every operation as a derived tool, with parameters, body schemas, and descriptions already filled in. Manual edits survive a re-import so your tweaks don't get clobbered.
- OpenAPI 3.0 and 3.1 supported, with JSON or YAML
- operationId becomes the tool name; summary and description flow through
- Path, query, and header parameters land typed and ready
- Body schemas land complete: oneOf and anyOf round-trip
Import a Postman Collection, Variables and All
Drop an exported Postman collection into the panel and a wizard turns every request into a typed tool. Collection variables like base_url become connection variables you configure once; folder-scoped bearer tokens map to encrypted secrets that ride the right endpoints. A 454-request collection imports clean, and re-importing the same file updates the connection in place instead of piling up duplicates.
- Wizard reads the collection up front: base URL, variables, secret tokens, folders
- Folder-scoped auth flattens to a per-endpoint header backed by a secret {{variable}}
- Raw JSON bodies become typed schemas; query and path params land ready
- Big collections defer their tools so they load on demand, not all at once
Four Auth Methods, All Local
API key in header or query, Bearer token, Basic auth, and OAuth 2.0 with PKCE. Static secrets live in the encrypted credstore. OAuth tokens are stored encrypted per connection with automatic refresh on 401. Nothing crosses the IPC bus to the renderer.
- API key (header or query), Bearer, Basic, OAuth 2.0
- Shared OAuth callback server (port 8089) handles concurrent flows
- 401-driven token refresh, retried once before surfacing failure
- AES-256-GCM at rest; secrets never appear in exported configs
Reusable Middlewares You Attach to Any Connection
A middleware is a pre or post hook you build once and tick on as many connections as you want. Inject the signed-in identity, add a header or query param, set a field on the JSON body, or strip fields from the response before the AI sees it. Pre hooks run in order before the call; response hooks run in reverse after it. Any endpoint can opt out of the ones it does not need.
- Inject identity: the verified email or affiliate token into a header or query param
- Inject a header, query param, or JSON body field, fixed or templated with {{user.email}}
- Redact response fields so secrets never reach the model
- Per-endpoint opt-out keeps a public health check off the authenticated path
Bundle Connections into Personas and the Marketplace
A connection is a first-class artifact. List it under a Persona and picking that role wires up the API and its tools in one move. Share it through the Marketplace and the bundle carries the middlewares the connection uses; on install they are created first, deduplicated by name, then the connection is wired to the fresh local IDs.
- List a connection under a Persona to ship it with that role
- Export as a .plxm bundle or move it into a linked marketplace
- Bundled connections carry their middlewares; install creates both
- Identity injection means a shared connection needs no pasted secrets
SSRF Defense in Depth
Every outbound call passes through a single chokepoint. Scheme allowlist, hostname rejection (*.local, *.internal, *.lan), post-DNS CIDR blocklist covering link-local, private, CGNAT, AWS IMDS, IPv6 specials, and IPv4-mapped IPv6, plus DNS-pinned dialing that survives DNS rebinding attacks. Your own machine (localhost, 127.0.0.1) is allowed by default; a public name that rebinds to loopback is still refused.
- Scheme allowlist: http / https only, embedded credentials rejected
- localhost and 127.0.0.1 allowed by default; *.local, *.internal, *.lan blocked
- Post-DNS CIDR check; IPv4-mapped IPv6 collapsed and re-checked
- DNS pinning so the dialer cannot follow a rebind, including a rebind to loopback
Per-Host Allowlist with First-Call Approval
A fresh host triggers an in-chat approval prompt: Allow once, Allow always, or Deny. Write methods (POST, PUT, PATCH, DELETE) prompt a second time with a method, path, and body preview unless you opt in to writes for that host. The allowlist lives at ~/.plexon/connections/allowlist.json.
- Fresh host → Allow once / Allow always / Deny prompt
- Write-method preview shows method, path, and 1 KB body sample
- Per-host "always allow writes" toggle for trusted internal APIs
- Per-session allow-once cache prevents accidental cross-session reuse
Dynamic Placeholders the AI Resolves
Templated paths and bodies stop being a chore. Tokens like /api/users/{user_id}/get_info?date={now_iso8601()} are resolved at call time. Built-in functions cover dates, UUIDs, random integers, and hex strings, while the AI fills the named parameters from your prompt or asks you when missing.
- {now_iso8601()}, {uuid()}, {hex(N)}, {rand_int(a, b)} resolved at call time
- Required path tokens auto-detected from {name} and seeded as path params
- AI asks the user for missing required fields before sending
- Per-parameter description tells the AI exactly what to ask
Visual Body Editor with Simple + Schema Tabs
Build a request body with flat rows (name, type, required, description, enum, format), or paste a full JSON Schema in the Schema tab. Round-trips between tabs whenever the shape is flat-of-primitives. Schema tab accepts bare schemas and OpenAPI requestBody fragments, pretty-prints on demand, and links to the JSON Schema spec.
- Simple tab: 7 JSON Schema types, string formats, array item types
- Schema tab: paste a JSON Schema or an OpenAPI requestBody fragment
- Load-from-file button accepts .json schemas off the clipboard or disk
- Pretty-print and JSON Schema "Learn more" link in the toolbar
AI-Polish on Descriptions
A sparkle button next to the connection description and every endpoint description rewrites the text via the planning provider. The polished version is what the AI sees at tool-selection time. Better descriptions mean fewer wrong-tool picks and fewer wasted turns.
- Connection-level description prepended to every derived tool
- Endpoint-level description tells the AI when to pick this tool
- 10-character minimum gate; tooltip explains why disabled
- Stale-response guard: a Stop click cancels the spinner immediately
Per-Endpoint Test Runner
Every endpoint has a Run button that opens a typed test dialog. Required fields are validated before the request fires. Path tokens are substituted client-side, body fields are coerced to the right primitive type, and the response panel surfaces status, size, duration, pinned IP, inline body, and a path to the on-disk dump for bodies over 4 KB.
- Required-field red highlights before the call leaves the dialog
- Booleans, enums, numbers, and dates all input-correct by type
- Bodies over 4 KB spill to ~/.plexon/http-responses/<uuid>.json
- plexon_read_file path returned inline so the AI can finish the job
Under the Hood
MCP-Native Tool Registration
Each saved endpoint registers as its own MCP tool through the same embedded server every built-in tool uses. The AI sees them in its tool catalog with name, description, and JSON Schema; no special branching, no out-of-band shim.
JavaScript Rendering in a Hidden Window
When a fetch detects an unrendered app shell, the daemon renders the page in a hidden Chromium window that ships with the app, waits for the network to settle, and reads the post-script HTML into the same markdown pipeline. Page scripts run in an isolated session with no access to your own browser profile, and their subresource requests are held to the same private-address block as the main fetch.
Per-Connection Fetch Defaults
A connection can set its render mode, timeout, automatic retries (safe methods only, with Retry-After honored), a per-minute rate cap, and a cookie jar. The jar stores session cookies encrypted at rest and matches them by domain, path, and the Secure flag, with a supercookie guard. Retries never replay a POST, and cookie-jar requests are never cached.
OpenAPI 3.0 + 3.1 Import
Powered by kin-openapi. operationId becomes the tool name; summary and description flow into the tool description; path, query, header, and body params land typed and ready. The persisted spec under each connection survives a re-import diff-clean.
Postman Collection Import
A v2.1.0 collection imports through a wizard. Collection variables become per-connection {{variables}}, the base URL is yours to pick from the environments the file defines, and folder-scoped auth flattens to a secret-backed Authorization header per endpoint. Re-import matches on the collection _postman_id and updates in place; the secrets you entered are preserved.
Connection Variables, Plain and Secret
Reference {{name}} in any URL, path, header, query, or body. Plain values live in connection.json; secret values live in the encrypted credstore and never cross the IPC bus. A request that resolves a secret skips the response cache. Edit them by hand in the connection editor, or let a Postman import seed them.
Four Auth Methods
API key (header or query), Bearer token, Basic auth, OAuth 2.0 with PKCE. Static secrets land in the encrypted credstore keyed httpconn_<id>; OAuth tokens get their own encrypted per-connection store with 401-driven refresh. Nothing leaves the daemon.
SSRF Defense in Depth
Single chokepoint validates scheme, hostname, and every resolved IP against a CIDR blocklist (link-local, private, CGNAT, AWS IMDS, IPv6 specials, IPv4-mapped IPv6). localhost is allowed by default; DNS pinning blocks rebind attacks, including a public name that resolves to loopback. Cross-host redirects are refused outright.
Identity-Injecting Middlewares
An inject_identity middleware puts the signed-in email or affiliate token into a header or query param, from the same verified identity the MCP tools use. The {{user.email}} and {{user.affiliate_token}} templates work in any header or body value. A request that carries identity skips the response cache, so one user is never served another reply.
Scripted Middlewares
For logic the declarative kinds do not cover, a script middleware runs your own program (Go, Node, anything) with the request as JSON on stdin and the changes on stdout. It runs with the same trust as an MCP server, with a bounded timeout and capped output. Identity arrives as PLEXON_USER_EMAIL and PLEXON_AFFILIATE_TOKEN, scoped to that one process.
Bundled in Personas and the Marketplace
A connection is a marketplace artifact and a Persona dependency. Share it and the bundle carries the middlewares it references; on install they are created first, deduplicated by name, then the connection is wired to the fresh local IDs. The same path the persona dependency installer uses.
Per-Endpoint Test Runner
Every endpoint card has a Run button. Required-field validation runs before the request fires; path tokens substitute client-side; body fields coerce to the right primitive; the response panel returns status, size, duration, pinned IP, inline body, and a file path for spills over 4 KB.
Visual + JSON Body Editor
Simple tab edits a flat list of typed body fields (string formats, array item types, enums, defaults, descriptions). Schema tab handles arbitrary JSON Schema; round-trips with Simple when the shape is flat-of-primitives. Load-from-file accepts JSON Schema or OpenAPI requestBody fragments.
AI-Enhance Descriptions
Sparkle button on the connection-level description and every endpoint description. The planning provider rewrites the text for tool-selection clarity. The polished output is what the AI sees at every call site, not just inside the editor.
Dynamic Placeholders
Built-in functions {now_iso8601()}, {uuid()}, {hex(N)}, and {rand_int(a, b)} resolve at call time. Named tokens like {user_id} stay AI-fillable: the AI extracts them from the prompt or asks the user when required and missing.
OpenAPI File Picker
Import OpenAPI specs from the panel header or paste a single schema into the Body editor. Path is bounded at 5 MB so a hostile spec cannot pin the parser; the daemon stripts every secret before returning sanitized Connection metadata to the renderer.