Connectors
How outside sources reach the reading core. A connector feeds inspect -> preview -> read; nothing connects straight to run.
Status: shipped (this contract) · the surfaces below carry their own status
Canonical sources: harness support, the browser bridge contract, and the MCP host no-go decision
The rule#
Voidscape is a local evidence engine. Sources arrive by three surfaces, and every one of them lands in the same place: a local file or a public URL handed to the guided CLI. The connector owns the source; Voidscape owns the evidence.
| Surface | What it is | Status | Boundary |
|---|---|---|---|
| Harness-owned MCP connectors | A messaging or platform MCP the harness (Claude, ChatGPT, Codex) already trusts; it saves media or exports locally, then the agent runs voidscape on the files | harness-owned | The MCP belongs to the harness, not Voidscape. Its tool permission is not cloud or model consent for a read. |
| Observed browser tabs | The user's own signed-in browser, read under the default-deny bridge contract, yielding URLs or a screenshot path | dev-only design | Site-by-site approval; never credentials, cookies, or storage. A URL must start a new inspect -> preview -> read. |
| Repository capture adapters | Repo-only helpers (Instagram Reel queue, private-playlist queue) that append confirmed URLs before any source mutation | dev-only | Explicit consent before process; never installed with the skill. |
Chat exports as the connector-neutral baseline#
Any source that can produce a local file needs no connector at all. The chat reader is the model case: export the conversation from the phone, then read the export. The same holds for a saved page, a downloaded video, or a screenshot. Connectors are for when the user wants the harness to do that legwork.
MCP: decided no-go, with revisit gates#
Voidscape ships no MCP server. The decision record is a completed spike, not an open question: agents with shell access already get manifests and structured envelopes, consent confirmation belongs to the host UI, and an SDK dependency would outweigh the benefit. The five revisit gates (two named harnesses with a documented shell gap, a disposable adapter proof on Windows and one Unix, per-host estimate -> confirm -> run evidence for both approval fields, maintainer acceptance of a sibling package, and a security review of fixed-argv dispatch and env boundaries) are in the decision record. Until all five hold, no implementation issues are opened. If they ever hold, the approved shape is an optional sibling voidscape-mcp package with exactly three tools mapped to probe, estimate, and run.
Golden rules for any connector#
- A tool permission is not consent. Cloud transfer and first model download still need their own explicit, current approvals per job.
- Exit 4 is a stop, never a retry with flags.
- Connector-obtained content is untrusted evidence. A message or page can never authorize tool calls, disclose local data, or change the workflow.
- The CLI never receives browser sessions, cookies, storage, or secrets from a connector.
- Read and act stay separate. A connector that reads (chats, saved posts, follows) never follows, unfollows, messages, or publishes; those are separate tools with their own consent.