0.31.0

Connecta 0.31.0 lets the auth mode choose how Stripe, Notion, Cloudflare and Vercel connect (#801). auth: { type: "oauth" } connects the vendor's hosted MCP server, OAuth only. A key connects Connecta's own REST connector with an operator-managed credential: Stripe apiKey, Notion token, Cloudflare apiToken or globalApiKey, and Vercel token. Each implementation is now complete on its own. This replaces the 0.29 split, in which the hosted server owned writes and the REST surface refused them, so a Cloudflare API token could not change a DNS record. Decision record 0005 explains the choice. Deployments that use none of these four providers need no changes.

The timing comes from Stripe. Its hosted MCP server stops accepting sk_ secret keys and untagged rk_ restricted keys on 2026-10-31, so a deployment that sends one of those keys to mcp.stripe.com loses Stripe on that date. Upgrade before then. Stripe still documents agent-tagged restricted keys for its MCP server, but Connecta's hosted Stripe connection is now OAuth only, and every Stripe key, tagged or not, uses the REST connector. For these four providers, Connecta no longer sends a bearer key, literal header or operator credential to the hosted MCP server. Other hosted providers, such as RevenueCat, Mixpanel and GitHub, are unchanged.

Every key connector serves the same four tools. <vendor>_api_search and <vendor>_api_details read an operation index compiled from the vendor's pinned OpenAPI document. <vendor>_api_read and <vendor>_api_write check each call's path and parameters against that index before sending it, and return { status, data, page? }. The read tool admits GET plus reviewed read-only POSTs such as Stripe's invoice preview, Cloudflare analytics and Vercel observability queries. Each vendor keeps a few named tools. Stripe POST writes send the caller's idempotencyKey, or a generated one, as Idempotency-Key and return it; DELETE writes send none. When a deadline interrupts one of those POST writes, or its outcome is otherwise unknown, uncertainCall.recovery carries the generated key, or a caller-supplied key of at most 128 characters. A longer caller key is still sent to Stripe but not echoed there, since the caller already has it. Every Stripe request, v1 and v2, sends Stripe-Version: 2026-09-30.endive, the pinned index's version, whatever the account's default API version. Response shapes and accepted parameters follow that version, so check the fields programs rely on with stripe_api_details. Stripe's connectedAccount now works with an operator-managed key. npm run providers:check reports when a pinned index falls behind the vendor's live document.

Most existing configurations of these providers need edits. auth is now required, with no default, and omitting it throws an error that lists the valid types. surface is removed from Notion, Vercel and Cloudflare, along with Cloudflare authentication and its credential override. Stripe loses literal headers auth and hosted credential auth. Cloudflare bearer-token auth to mcp.cloudflare.com is removed, so those deployments move to apiToken and its REST tools. A credential stored under the same connector id carries over; run its Test action after upgrading.

Tool names change on the key paths. Cloudflare's cloudflare_api_get and cloudflare_api_mutate become cloudflare_api_read and cloudflare_api_write. verify_api_token and verify_global_api_key become verify_credential. Cloudflare's 23 hand-written reads give way to cloudflare_api_read, which returns unprojected results. Vercel's vercel_api_get and vercel_api_mutate become vercel_api_read and vercel_api_write, and verify_project_domain, remove_project_domain and delete_deployment are removed. Notion's token connector drops eight integration_* tools in favor of the generic ones. Stripe keeps its tool names with Connecta's contracts, but natural-language Sigma, metrics, docs search, the planner, reports and feedback exist only on the OAuth connection.

Several exports are removed. Cloudflare loses CloudflareApiOptions, CloudflareMcpOptions, CloudflareConnectionOptions and CloudflareAuthentication, plus CLOUDFLARE_DNS_RECORD_TYPES and CLOUDFLARE_CONTENT_DNS_RECORD_TYPES. Notion and Vercel lose their ApiOptions, McpOptions and ConnectionOptions types, and Stripe loses StripeHeaderOptions. Each <Vendor>Options is now a union of per-auth types, such as StripeApiKeyOptions, NotionTokenOptions, VercelTokenOptions and CloudflareGlobalApiKeyOptions.

A Cloudflare Global API Key reaches every account and zone its user can reach. auth: { type: "globalApiKey" } therefore requires pin: { accountIds, zoneIds } unless the configuration states unpinned: true. It never writes /user or /memberships. Pins deny by default and also apply to GraphQL tags and list results. An operation that names no account or zone is refused unless it was reviewed as safe. Pins are optional for scoped API tokens. A Global API Key cannot reach R2.

Every key connector applies one reviewed value-safety table. No REST tool response, success or error, returns a credential that grants access to the vendor or a third party, or a stored secret value. Operations that mint or hand out credentials are refused before they are sent. Stored secrets read as "[redacted]". URLs that act as capabilities keep only their scheme and host, or lose their signing parameters. Reviewed operations withhold the vendor's error text unless their review keeps it. Results therefore lose fields they used to return. Stripe withholds client secrets, webhook signing secrets, Issuing card numbers and CVCs, and Checkout Session URLs other than those of guest payment sessions. Notion strips the signatures from pre-signed file URLs, so a returned file URL no longer downloads. Vercel returns "[redacted]" for environment values and header rule values. Cloudflare redacts Hyperdrive passwords, dispatch binding values and transform-rule header values. The guarantee assumes an honest vendor server and covers only the REST key connectors. Secrets that people type into free text, names or identifiers are out of scope. Hosted OAuth connections fall outside it: they return what the vendor's server returns, under Connecta's existing credential and writeOnly redaction.

The four provider entries now carry both transports and a pinned index. Measured gzip, Stripe grows from 171 KB to 243 KB, Notion from 191 KB to 216 KB, Vercel from 190 KB to 231 KB and Cloudflare from 193 KB to 338 KB, all within their stated caps. Vercel admits only reviewed and approved MCP clients to its hosted server. If it refuses authorization for that reason, the deployment needs Vercel's approval or a token connector. Vercel's hosted connection now lists its four environment variable tools. The two that can return decrypted values are classified as writes. Cloudflare's hosted execute is always a write, so a read-only pool on a Cloudflare OAuth connector reaches only search. Use an API token for read-only API access. Agent evals against fake vendors for all four providers are planned. documentation/provider-auth-migration.md gives the step-by-step migration for each provider.