23 of 23 integrations
General-purpose YAML actions — run committed scripts, drive Terraform workspaces, run Ansible playbooks, dispatch GitHub Actions workflows — with a snapshot bundled inside the server binary; its entitlement is granted on every tier.
Remote execution and file transfer over SSH, together with the transport-provider family its actions broker remote-host access through — one entitlement grants both.
MintPress controller-driven changes composed with YAML actions, asset templates and workflows, enforced at the governed change-create funnel.
Brokered remote-host access for the RPC action pack: provider records hold connection facts and credential references (ssh-static or ssh-ca), grants and scope bindings decide who reaches which hosts, and each admitted step gets a one-shot session.
Host-centric remote operation against registered infrastructure nodes: run commands, move files and trees, and gather facts uniformly across cloud-handed-over, virtualised and on-premise hosts.
The signed commercial content pack for Amazon Web Services: an enterprise aws:* action surface built on the official AWS SDK through the pack’s own awsu tool, never a wrapper around the vendor CLI.
The signed commercial content pack for Microsoft Azure: an enterprise azure:* action surface built on the official Azure SDK through the pack’s own azu tool, never a wrapper around the vendor CLI.
Consume OpsChain properties and vault-backed secrets natively from GitHub Actions workflows: each run authenticates with its own short-lived OIDC token, so the repository holds no OpsChain configuration and no standing credentials.
Registered, HMAC-signed HTTP entry points that let GitHub, Jira, CI servers and monitoring stacks fire OpsChain triggers — every verified delivery lands as an event and executes as the connection’s declared service account.
Bind governed changes to the JSM requests they serve: typed request references on governance metadata, request writes through one audited door, signed inbound webhooks as trigger sources, and evidence links attached on resolution.
Stream the server’s event feed to your SIEM — Splunk HTTP Event Collector, or CEF over syslog (UDP/TCP/TLS) — so OpsChain’s governance evidence lands in your existing alerting and retention.
Registered vault connections the server resolves secret references through — OpenBao and HashiCorp Vault in the base platform — with encrypted write-only credentials, per-connection health and a test verb; a second provider and scope bindings gate on secrets:multi-vault, and the AWS and Azure kinds on their packs.
AWS Secrets Manager as a secrets-provider kind: the same connection object, CRUD and test verbs, health recording and audit treatment as the vault kinds, with AWS-shaped configuration.
Azure Key Vault as a secrets-provider kind: the same connection object, CRUD and test verbs, health recording and audit treatment as the vault kinds, with Azure-shaped configuration.
Directory and federated sign-in through provider connections (LDAP, OIDC and GitHub kinds): LDAP and the Microsoft Entra common endpoint ship in the Basic defaults; other OIDC issuers and group-mapping writes gate on identity:sso.
Interest-based delivery of platform events through subscriptions, routes and connectors (allowlisted webhooks, Slack, Teams), with authorisation re-checked at match and dispatch; mandated-notification administration gates on packs:security-governance.
Brokered model credentials for AI agents — Anthropic, OpenAI, Azure AI Foundry and Azure OpenAI kinds: the model gateway injects the stored key server-side, so no model key ever lands on an agent host.
The agent platform’s entry licence: agent registration into the fleet registry and session establishment, with the licence’s agents limit bounding how many instances connect at once.
The governance funnel over the base agent capability — trust grants, grant decisions, recommendations and the review surfaces; the enforcement engine itself ships in the base platform and runs identically everywhere.
The LLM lane of the agent platform: AI-type enrolment, the Claude adapter and brokered model credentials, governed through the same trust funnel as every other agent.
Specialised domain-expert AI agents delivered as pack content, one separately-licensed entitlement per domain; each member requires the general AI-agent lane.
The compliance administration layer over machinery the base platform already runs: mandated-notification administration, the evidence ledger’s auditor surfaces, access-review campaigns, step-up by policy and the auditor security role.
Per-framework regulatory vocabularies (CPS 230/234, SOCI, DORA, …) mapped over the platform’s core classification metadata, so one classified estate answers many frameworks without re-classifying per regulator.