AI Hub Configuration
The AI Hub is the part of Global Configurator that stores the reusable building blocks an AI agent uses at runtime. When the AI Agent node runs inside a workflow, it references these objects by id — it does not carry the configuration inline.
There are four configuration entities, each with its own CRUD surface:
| Entity | What it defines | Referenced by |
|---|---|---|
| Guardrail policy | Enforced safety and resource limits for an agent run | guardrails on the AI Agent node |
| MCP server | A registered Model Context Protocol server and its discovered tools | toolsConfig.mcpServers[] |
| AI skill | A reusable instruction document (a SKILL.md) injected into the agent | agentConfig.skillIds[] |
| Tool instance | A named, pre-configured catalog operation the agent may call | toolsConfig.tools[] |
Each entity is a stored document with a unique name. Create it once in Global Configurator, then reference it from any number of workflows.
Two features that existed in earlier drafts are no longer part of the product: AI Prompt Templates and per-entity versioning. Neither is documented here because neither exists in the current AI Hub.
Guardrail Policies
A guardrail policy is a named object that constrains what an agent run may do and how much it may consume. A run references one policy; the engine enforces it on every tool call and model response.
Fields
| Field | Type | Default | Description |
|---|---|---|---|
name | string | -- | Unique policy name |
description | string | -- | Human-readable summary |
tags | string[] | [] | Free-form labels for search |
requireApprovalForDestructiveActions | boolean | true | When true, destructive tool calls are gated |
destructiveApprovalMode | string | ask | ask pauses the run for human approval; deny blocks the call outright |
blockShellExecByDefault | boolean | true | Denies shell_exec |
sqlReadOnlyEnforcement | boolean | true | Denies sql:* operations that write |
limitHttpToInternalDomains | boolean | false | Denies http:* calls to external domains |
blockedTools | string[] | [] | Explicit deny list of tool ids |
maxToolCallsPerRun | int | 50 | Hard cap on tool calls in a single run |
maxConcurrentRuns | int | 10 | Maximum simultaneous runs under this policy |
agentRunTimeoutSeconds | int | 300 | Run wall-clock timeout |
maxTokensPerResponse | int | 4096 | Hard clamp on tokens per model response |
inputScan | boolean | false | Run a prompt-injection scan on the input before the first iteration |
blockOnInjection | boolean | false | Block the run when the input scan detects injection |
piiDetection | boolean | false | Detect PII (requires the Presidio service) |
piiRedaction | boolean | false | Redact detected PII from the final answer |
toolOutputScan | boolean | false | Audit-only injection scan on tool and MCP results |
How a policy becomes permissions
The engine turns the policy into an ordered list of permission rules and evaluates each tool call against them.
- First match wins. Rules are evaluated in order; the first rule that matches the tool decides the outcome.
- Strength order is
deny>ask>allow. Adenyrule is never softened by a laterallow. - A trailing
allow *rule lets any tool not otherwise restricted run. askmeans pause. A matchedaskrule pauses the run for human approval (see Building AI Agents).
In plain language, the toggles map to rules like this:
| Toggle | Effect when enabled |
|---|---|
requireApprovalForDestructiveActions + destructiveApprovalMode=ask | Destructive operations pause for approval |
requireApprovalForDestructiveActions + destructiveApprovalMode=deny | Destructive operations are blocked |
blockShellExecByDefault | shell_exec is denied |
sqlReadOnlyEnforcement | Writing sql:* operations are denied; reads pass |
limitHttpToInternalDomains | http:* calls to external domains are denied |
blockedTools | Each listed tool is denied |
Combining multiple guardrails
When more than one guardrail applies to a run, the engine merges them into the tightest effective policy:
- Permission rules union, keeping the strongest outcome per tool (
deny>ask>allow). - Numeric limits take the smallest value across policies.
maxTokensPerResponseis a hard clamp — the agent cannot exceed the tightest value even if a model request asks for more.
The R5 safety toggles (inputScan, blockOnInjection, piiDetection, piiRedaction, toolOutputScan) are nullable and OR-union across policies. A null value means "use the engine default," which is not the same as false — leaving a toggle unset defers to the engine rather than forcing it off.
MCP Servers
An MCP server entry registers an external Model Context Protocol server so the agent can call the tools it exposes. See MCP Server for the concept and the discovery flow; the stored fields are summarized here.
Fields
| Field | Type | Default | Description |
|---|---|---|---|
name | string | -- | Unique server name (duplicate returns 409) |
url | string | -- | Server endpoint |
description | string | -- | What the server provides |
authType | string | NONE | NONE, BEARER, API_KEY, BASIC, or CUSTOM |
authConfig | map | {} | Credentials; sensitive keys are Vault-encrypted (see below) |
status | string | UNKNOWN | ONLINE, OFFLINE, or UNKNOWN |
toolCount | int | 0 | Number of tools found at last discovery |
discoveredTools | object[] | [] | Each { name, description, inputSchema } |
tags | string[] | [] | Free-form labels |
lastCheckedAt | timestamp | -- | When discovery last ran |
Sensitive authConfig keys (token, apiKey, apikey, password, secret, clientSecret, privateKey) and nested header values are encrypted with Vault Transit before storage. Values already prefixed with vault: are left untouched. A normal read never returns decrypted credentials.
Tool discovery runs through POST /ai-hub/mcp-servers/{id}/discover, which delegates to connectivity-validator to perform the JSON-RPC initialize and tools/list handshake. See MCP Server for details.
AI Skills
An AI skill is a reusable instruction document — a Markdown SKILL.md — that the agent loads as guidance. The Markdown body is the source of truth for the skill's behavior.
Fields
| Field | Type | Notes |
|---|---|---|
name | string | Unique; capped at 100 characters on install |
description | string | Capped at 500 characters on install |
content | string | The full SKILL.md body (source of truth) |
systemPrompt | string | Deprecated; existing values are migrated into content |
type | string | BUILTIN or CUSTOM (default CUSTOM) |
tags | string[] | Up to 20, taken from the document front matter |
Installing a skill
POST /ai-hub/skills/install downloads a Markdown document and stores it as a CUSTOM skill. Install rules:
- HTTPS only. Plain HTTP sources are rejected.
- Markdown only. The source must be a
.mdfile. - GitHub-aware. A
github.comblob or repo URL is rewritten to itsraw.githubusercontent.comform using the ref and path. - SSRF-guarded. Private, loopback, link-local, and site-local addresses are rejected.
- Size-limited. The document must be 128 KB or smaller.
- Front matter required. The document must include YAML front matter with
nameanddescription.
The downloaded Markdown is stored as content, and up to 20 tags are read from the front matter. POST /ai-hub/skills/{id}/duplicate clones a skill, appending " Copy" to the name.
Tool Instances
A tool instance is a named, pre-configured catalog operation the agent may call. It binds a catalog operation id to a connection and a set of parameters, so the agent invokes a ready-to-run tool rather than assembling one.
Fields
| Field | Type | Notes |
|---|---|---|
name | string | Unique |
toolType | string | Stored lowercased on upsert |
entity | string | Catalog operation id the tool runs |
description | string | What the tool does |
configuration | map | Runtime config: connectionId, resource/operation, parameters, and {{...}} expressions |
tags | string[] | Free-form labels |
The configuration map carries the connection reference (connectionId, whose credentials are decrypted at call time), the resource and operation to run, and any parameter values. Parameter values may contain {{...}} expressions that are resolved from workflow data before the call. See MCP Tools Reference for the full model and the honest test behavior.
Key Endpoints
All AI Hub endpoints live under /ai-hub/* in Global Configurator and require the matching GlobalConfigurator:<Entity>:<perm> authority.
| Method | Path | Purpose |
|---|---|---|
POST | /ai-hub/guardrails/upsert | Create or update a guardrail policy |
POST | /ai-hub/guardrails/search | Search guardrail policies |
GET | /ai-hub/guardrails/{id} | Fetch a guardrail policy |
DELETE | /ai-hub/guardrails/delete | Delete a guardrail policy |
POST | /ai-hub/mcp-servers/upsert | Create or update an MCP server (Vault-encrypts credentials) |
POST | /ai-hub/mcp-servers/search | Search MCP servers |
GET | /ai-hub/mcp-servers/{id} | Fetch an MCP server |
POST | /ai-hub/mcp-servers/{id}/discover | Discover the server's tools |
DELETE | /ai-hub/mcp-servers/delete | Delete an MCP server |
POST | /ai-hub/skills/install | Install a skill from an HTTPS Markdown source (201) |
POST | /ai-hub/skills/upsert | Create or update a skill |
POST | /ai-hub/skills/search | Search skills |
GET | /ai-hub/skills/{id} | Fetch a skill |
POST | /ai-hub/skills/{id}/duplicate | Clone a skill |
DELETE | /ai-hub/skills/delete | Delete a skill |
POST | /ai-hub/tools/upsert | Create or update a tool instance (lowercases toolType) |
POST | /ai-hub/tools/search | Search tool instances |
GET | /ai-hub/tools/{id} | Fetch a tool instance |
POST | /ai-hub/tools/{id}/test | Test a tool instance (destructive operations are validated, never executed) |
DELETE | /ai-hub/tools/delete | Delete a tool instance |
Related Pages
- AI Integration Overview - how the AI Hub and the AI Agent node fit together
- MCP Server - registered servers and tool discovery
- MCP Tools Reference - discovered tools and tool instances
- Building AI Agents - guardrail enforcement and human approval
- AI Agent Node - running an agent inside a workflow