Tool

Connect to a database, cluster, host, or API through a managed connection. Credentials are supplied to the tool so you do not need to type them into commands. Tools can still expose them in output.

Overview

A Tool is a managed connection. When you connect, the client is on the PATH and the credentials are in the environment, so psql, mysql, kubectl, or redis-cli runs without you touching the secret.

Credentials

Credentials live in Kubernetes Secrets and are injected at the boundary. You run psql with no host, user, or password on the line. Rotations propagate on their own.

Connector types

Each Tool has a type. Managed cloud variants work too (for example, pulling credentials from AWS Secrets Manager).

You can also integrate the Industric Identity catalog of 100+ resources as is.

Relational

postgresmysqlmariadbsqlserveroraclecockroachdbyugabytedb

Warehouses & analytics

snowflakebigqueryclickhouseredshift

NoSQL, cache & search

mongodbrediselasticsearch

Additional database connectors

mongo36mongodb_atlasmongodb_dodocumentdbelasticacheazuresqlserverkeyspacesazurecosmosnosql

AWS Secrets Manager variants

postgres_aws_secrets_managermysql_aws_secrets_managermongodb_aws_secrets_managerdocumentdb_aws_secrets_managersqlserver_aws_secrets_managercockroachdb_aws_secrets_managersnowflake_aws_secrets_manager

Messaging

kafkarabbitmq

Cloud providers

awsgcpazure

Infra & APIs

kubernetessshhttpgitgithub

Others

custom

See Tools & connectors for how to declare a Tool and its credentials.

Connect

The Tools page listing tools with their type and state — Tools and their connection state. Ready means the connectivity probe passed.

exo tool connect opens an interactive shell with the connection environment set:

terminal· bash

exo tool connect analytics-postgres -n default

psql

Run a one-off query

The Tool Calls audit page listing executed commands — Every exec lands in the Tool Calls audit: who ran what, against which tool, when.

For non-interactive use (scripts, CI, piping), exo tool exec streams a command, file, or stdin to the tool's client and returns its exit code:

terminal· bash

exo tool exec analytics-postgres -- psql -c "select count(*) from orders"

exo tool exec analytics-postgres -f report.sql | jq

exo tool exec bastion-prod -- "uptime"

exo tool exec prod-eks -- kubectl get pods -A

exo tool test analytics-postgres

Recorded and attributed

Tool execs routed through the platform are written to the tool-call audit trail (tool, command, exit status, duration) and attributed to the calling agent when EXO_AGENT_ID is set. Auditing never blocks the command.