Docs

Four steps to permissioned app access.

Start with Nango for token custody, then use CybrLink to create user connect flows and route agent tool calls.

The integrations catalog is every live connection you can authorize. Typed MCP tools, listed on /tools, are the smaller set with a published input schema. Apps without a schema stay callable through the scoped proxy. Connect stays on CybrLink — sign in, then the connect host at connect.cybrlink.dev.

01

Spin up Nango

Deploy or connect the Nango instance that will store provider credentials and OAuth tokens.

Self-host guide ↗02

Get an API key

Generate your CybrLink API key. It signs session-mint requests on your server.

Request access ↗03

Mint a session

Create a short-lived connect session for one user and one integration. The browser uses it to launch the consent flow.

Reference ↗04

Call the tool

Your agent calls the gateway. Policy and connection state are checked before Nango attaches the provider credential.

Proxy guide ↗

MCP gateway

One URL for every agent.

Point Claude, Codex, Cursor, or any HTTP MCP client at https://cybrlink.dev/api/mcp. Send a cbl_ key or a cks_ session as Authorization: Bearer or x-cybrlink-session. If both headers are set, they must match.

  1. Search. Call cybrlink_search_tools with the action you want. The reply is a short list, not the whole catalog. Schemas are included only for providers this credential may use.
  2. Connect. Call cybrlink_manage_connections with a provider_key. The link is on connect.cybrlink.dev. CybrLink will not send the browser to composio.dev or nango.dev.
  3. Wait. cybrlink_wait_for_connection polls until the user finishes Connect or the timeout hits. It does not return provider tokens.
  4. Call. Use a curated tool or call_api. CybrLink injects the stored credential and strips credential-shaped fields from the response.

Meta-tools: cybrlink_search_tools, cybrlink_manage_connections, cybrlink_wait_for_connection. Mint a session with POST /api/agent/sessions (mode ephemeral is 8 hours, durable is 24 hours, and both expire after 2 hours idle). Sessions are read-only; mutating proxy calls need a cbl_ key with write scope. Typed tools are the curated registry. Catalog apps without a curated tool still show up in search and run through call_api.

Drop-in API

Connect a user. Then let the agent act.

Create a connect session, send the user through consent, then route agent requests through a controlled access layer. Your credential layer holds provider credentials; CybrLink keeps the workflow manageable.

  • Connect sessions are not long-lived provider tokens.
  • Connections are scoped by user and integration.
  • Disconnect one user's access without disabling the whole app.
// Mint a session with a cbl_ key. The cks_ token is shown once.
const res = await fetch("https://cybrlink.dev/api/agent/sessions", {
  method: "POST",
  headers: {
    Authorization: `Bearer ${process.env.CYBRLINK_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ mode: "ephemeral", provider_keys: ["slack"] }),
});
const session = await res.json();

// One MCP URL. Header is the session, never a provider token.
//   https://cybrlink.dev/api/mcp
//   x-cybrlink-session: session.token
// Tools: cybrlink_search_tools, cybrlink_manage_connections,
//        cybrlink_wait_for_connection, then call_api.

Platform extras

Triggers

Register an https URL in the dashboard. Nango posts events to/api/webhooks/nango. CybrLink checks the HMAC, ties the event to your user, and signs the delivery. Unsigned requests are rejected.

Connect theme

Logo, title, and accent live in workspace branding. The Connect UI itself is the Nango host at connect.cybrlink.dev. Back applies the theme there. CybrLink does not open a shell on that host.

Payload pruning

Set prune: true on/api/agent/proxyor CYBRLINK_PAYLOAD_PRUNE=1 to truncate large tool JSON. This is structural. It does not call a model and it does not add a charge.

Shared connections

/api/shared-connections records a grant for a connection you own. Tool calls still use only the connecting user's credential. There is no plugin store and no CLI marketplace.

Full API reference

CybrLink works with Nango's OAuth and proxy primitives. Use Nango docs for provider auth, token refresh, and credential storage details.

Open Nango docs ↗
Stuck? Read the security model or email contact@cybrlink.dev.