An integration is a tool server (MCP) that ODIN admits by hash, with every tool classed read, write or blocked. Write tools are hidden unless the server is write-enabled for that specialist, and blocked tools never reach the model. The server holds its own scoped, read-only credential, rendered at deploy time from the vault; the agent holds none.
01Integration classes
02Remote tool servers
A tool server can run elsewhere (another cluster, another team's platform) over an authenticated HTTP transport, reached through ODIN's loopback gateway with a token exchanged for the person who sent the turn, or ODIN's service account with read tools only. The remote side verifies issuer, audience, expiry and signature, and requires a write role for write tools.
03Everything else the orchestrator talks to
| System | Direction | For | Guards |
|---|---|---|---|
| Model gateway | out · HTTPS from the agent process | every model turn, plus small side calls (fresh-chat summary, next-prompt suggestion, spoken summary) | one credential per environment, given to the agent process only; endpoint and token overrides never pass |
| Identity provider | out · OIDC | sign-in; directory groups → roles | authorization code with PKCE, state, nonce; JWKS signature (an unsigned token is refused); issuer, audience, expiry; return URLs limited to the client's origins |
| Zero-trust edge | in · signed header | requests through the edge | optionally require the edge's signed assertion on every request that came through it, including the WebSocket upgrade |
| Push notifications | out | the on-call app (production mode only) | titles and ids only |
| Git host | out · API; in · webhook | the operations brief; merge-request approvals while a merge card waits | read token; timeouts; webhook secret compared in constant time; approvals count only at the checked head and only for mapped approvers |
| Alert senders | in · internal trigger | alert chats (SIEM, Alertmanager-compatible, event-driven automation, generic JSON) | trigger secret (bearer, header, query token, or an HMAC of the body); body size cap; dedupe and hourly limits; evidence capped |
| Dashboards | out | status dials in the web client | a relay that runs only fixed named queries; the token never reaches the browser |
| Metrics scrape | in | tokens, cost, turns, budget stops | loopback, listed addresses or a bearer token; no user names or chat ids in labels |
| Speech service (optional) | out · a standard speech protocol | hands-free status: speech to text and text to speech | voice requests rate-limited per person; timeouts |
04The contract with your infrastructure repository
ODIN and your infrastructure repository meet only through interfaces: change records and merge requests, automation job templates, the operations brief, secrets rendered by your deploy automation, and the platforms it builds. The rules both sides must agree on (API deny lists, parsed checks, the change-record schema and reserved words) should be compared in CI on both sides, so a drift between what the agent validates and what the pipeline enforces fails a build instead of a change.