> ## Documentation Index
> Fetch the complete documentation index at: https://docs.impellabs.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Security model

> What ImpelLabs sends to your tool, where it sends it, and how credentials and permissions are held.

This page lists what ImpelLabs does when it calls your tool, so you can build your side to match.

## Where requests go

* Only to `https://` addresses on the standard web port. An address with a user name or password in it is refused.
* Only to public addresses. ImpelLabs resolves the name, refuses the call if any address is private, and connects to the
  address it checked. A name that changes to a private address later cannot redirect a call.
* Redirects are never followed. Give the final address.
* Each request waits up to 15 seconds. An answer larger than 1 MB is refused.

## What each request carries

* The header `User-Agent: ImpelLabsBot/1.0`.
* Your credential in one header, as you set it up: `Authorization: Bearer ...`, `Authorization: Basic ...`, or a
  header you name.
* For MCP: `Content-Type`, `Accept`, `MCP-Protocol-Version` and the session header if you gave one.
* For an API: the arguments the operation declares, in the places the description says. Header arguments cannot be
  `authorization`, `cookie` or other headers that the transport owns.

ImpelLabs does not sign requests. There is no signature header. Authenticate each request with the credential you
gave, and keep that credential limited to what the agent may do.

## What is never sent

* Your credentials never go to any address other than the connection's own address.
* Arguments that an API operation does not declare are dropped before the call.
* A tool receives the arguments the agent chose and the headers listed above. ImpelLabs adds nothing else to the call.

Agents choose arguments from what a conversation contains. Check inputs on your side, as you would for any caller.

## Credentials

* Each business connects its own tool with its own key or sign-in. ImpelLabs does not use a key from its own settings
  for your tool.
* Keys are stored encrypted with a key of your workspace. The API never returns a key. It returns the last four
  characters, only when the key is long enough to make that safe.
* A key cannot contain line breaks, and it can be up to 4096 characters.
* The agent never sees a key. If your answer contains it, ImpelLabs replaces it with `[hidden]`.
* For a server that asks people to sign in, ImpelLabs uses OAuth with PKCE. It stores the token encrypted and renews it
  when it is about to expire.
* Never type a key into a chat. The connect card is the place for it.

## Permissions

* An operation does nothing until an admin or the owner of the connection turns it on.
* An agent calls only the operations granted to it. Granting is per operation.
* Every call goes through the workspace rules for its risk: run, ask a person, or refuse.
* A changed operation that does more is turned off until an admin reviews it.
* Removing a connection archives it. Its operations can no longer be called, and you can restore it later.
* Connecting, changing, removing and granting are recorded in the audit log.

## What you should assume

* Tool names, descriptions and schemas are text that agents read. ImpelLabs strips tags and line breaks from
  descriptions, but an agent still follows what a description says. Write descriptions that say what the tool does and
  nothing else.
* Treat each call as untrusted input from a caller that holds your credential.
* An agent may try again after an error that says a call may have run. See [Results and side effects](https://docs.impellabs.tech/developers/own-tools/results.md).

## Related

* [Connect your own tool](https://docs.impellabs.tech/developers/own-tools/overview.md)
* [Tool contract](https://docs.impellabs.tech/developers/own-tools/tool-contract.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.