create_connection
Mint a new scoped, revocable DenkOps connection token for an agent/CLI to authenticate with. The token is returned exactly once in the response — store it immediately, it cannot be retrieved again.
This record as markdown: /tools/denkopsai-mcp/create-connection.md
What create_connection does on Denkopsai
AI agents use create_connection to create or update resources in Denkopsai, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Denkopsai environment.
| Parameter | Type | Required | Description |
|---|---|---|---|
label | string | — | |
projects | array | — | restrict to these project ids (default: all projects) |
env_scope | string | — | env var access scope (default none) |
agent_type | string | — | e.g. claude-code, codex, openclaw, hermes, other (default other) |
expires_in_days | object | — | null = never expires (default 90) |
Parameters from the server's own tool schema.
Why create_connection is rated Medium
This tool creates and returns a new authentication token. While token creation is reversible (tokens can be revoked, as noted), the act itself is a write operation that generates a new credential object. It is not Destructive because revocation is possible and the token is scoped/revocable. It is Write because it persistently creates a new authentication entity in the system.
From the tool's definition Tool name is 'create_connection' and description states it 'Mint a new scoped, revocable DenkOps connection token' — this creates a new authentication credential.
Attacks that exploit this kind of access
The rule that runs create_connection safely
PolicyLayer is an MCP gateway: it sits between your AI agents and Denkopsai, and checks every tool call against a rule you set before the call runs. Nothing changes on the server itself. For create_connection, this is the rule to start with:
create_connection stays usable, but capped: an agent stuck in a loop can't make hundreds of changes a minute. Everything else on the server is denied unless you say otherwise.
The button opens the PolicyLayer dashboard: create your workspace, connect Denkopsai, apply this rule, and every create_connection call is checked against it from then on.
Questions about create_connection
Mint a new scoped, revocable DenkOps connection token for an agent/CLI to authenticate with. The token is returned exactly once in the response — store it immediately, it cannot be retrieved again. It is categorised as a Write tool in the Denkopsai MCP Server, which means it can create or modify data. Consider rate limits to prevent runaway writes.
create_connection accepts 5 parameters: label, projects, env_scope, agent_type, expires_in_days. The full parameter table on this page comes from the server's own tool schema.
Register the Denkopsai MCP server in PolicyLayer and add a rule for create_connection: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Denkopsai. Nothing to install.
create_connection is a Write tool with medium risk. Write tools should be rate-limited to prevent accidental bulk modifications.
Yes. Add a rate_limit block to the create_connection rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.
Set action: deny in the PolicyLayer policy for create_connection. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.
create_connection is provided by the Denkopsai MCP server (@denkopsai/mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.
More on Denkopsai, and thousands of servers like it.
This server
Across the catalogue