ARMARA Course 05

Course 05 / Module 07

Give your agent a real tool

Find an MCP integration, prepare its credential boundary, and learn the connector, vault, and source cleanup lifecycle.

Level
Intermediate
Time
16 minutes
Commands
6
Finish
A safe integration runbook

Video / coming soon

The written lesson is complete now.

Prepare a least-privilege token first

No suitable credential was available on the course machine, so the verified state remains zero installed and an empty vault.

Do not paste a token into terminal history unless you accept that exposure.
01

Define the connector

MCP is a standard that lets an AI use an outside tool through a connector called an MCP server.

02

Get the direction right

An integration brings a tool into ArmaraOS. The next module exposes ArmaraOS to another MCP client.

03

Search the catalog

Run in your terminal
armaraos integrations
armaraos integrations github
Real GitHub integration search with zero installed and an empty vault
Fresh live output / one available / zero installed / vault empty

There is no JSON or installed-only flag. Search by connector name.

04

Install only with a real scoped token

Run in your terminal
armaraos add <NAME> --key <REAL_SCOPED_TOKEN>
Do not run this with a placeholder.

Create a minimal-permission token at the source service first. The token is persisted in the vault.

05

Verify observable state

Run in your terminal
armaraos integrations <NAME>
armaraos vault list

The course capture stops here because a fake credential would prove nothing and create unsafe state.

06

Begin with one read-only task

Keep approvals enabled and logs visible. The CLI does not reproduce the interactive per-call prompt, so use a narrowly scoped token and a read-only first request.

07

Remove connector and credential

Run in your terminal
armaraos remove <NAME>
armaraos vault remove <KEY>
Real help showing separate integration and vault credential removal commands
Fresh live help / two local cleanup steps

Then revoke the token at the source service. Removing the connector alone does not erase or revoke it.

Check it / write the cleanup before install

Name all three removal steps.

Remove the connector, remove the exact vault entry, then revoke the token at its source. Install only when a real scoped token is ready.

Safety note

An integration gives an agent a real outside-service credential. Add one at a time, begin read-only, and remove both local pieces plus the source token when finished.

Troubleshooting for this sitting
What you seeLikely causeWhat to do
Catalog is longNo installed-only filter exists.Search by name.
No scoped tokenCredential is not prepared.Stop before add.
Key remains after removeCleanup has two local steps.Remove the exact vault key.
No CLI per-call promptVerified CLI limitation.Keep permissions narrow and inspect logs.

Back to Module 5.6

Next / Module 5.8

Drive ArmaraOS from another tool

Lesson ready