# System connectors Last validated Sep 29, 2026 System connectors operate on Aperture itself. They are always present on the gateway, without an entry under `connectors.servers`, and you cannot remove or disable them. They are the only connectors that can have the reserved `system` label. The `aperture` connector is currently the only system connector. The [built-in connectors][docs-built-in-connectors] `Tailnet` and `TailnetSSH` are not system connectors. Like verified connectors, they appear in the registry with known defaults and a brand icon, and you configure them under `connectors.servers`. Guided setup assigns the `restricted` label, which admins can edit. ## System tools and availability The system-tool inventory can change with Aperture releases. Tool availability depends on gateway configuration and user identity, and every tool requires a matching connector grant. MCP clients prepend `aperture_` to each tool name, such as `aperture_list_sessions`. For the current list of available tools, descriptions, and input schemas for your user identity, refer to [Discover and call tools][docs-discover-tools]. Calling MCP `tools/list` returns the active tools and their `inputSchema` rather than relying on a static reference. ### HTTP discovery and web tools The `list_connectors` tool requires at least one configured HTTP connector and is available only over MCP. The `web_search` and `web_fetch` tools require the web-search service configured for the gateway by Tailscale. In Chat, web search and fetching use the separate **Web** capability rather than these connector tool names. | Tool name | Purpose | | ----------------- | ------------------------------------------------- | | `list_connectors` | Discover HTTP API connectors the user can access. | | `web_search` | Search the web. | | `web_fetch` | Fetch web page content. | ### Session tools Session tools do not require an optional gateway capability, but they do require an authenticated user identity and a matching grant. They inspect your own recorded sessions and are available in Chat and over MCP. If data retention policies have removed captured request or response bodies, that content is unavailable. | Tool name | Purpose | | --------------------- | ------------------------------------------------------------------- | | `list_sessions` | List your recorded sessions and their summary metrics. | | `get_session` | Inspect one of your sessions and its recorded requests. | | `get_session_request` | Inspect one request's stored request and response data and metrics. | ### Skill tools Skill tools require skills to be enabled on the gateway and require the user to have a personal skills library: a signed-in personal identity with Chat access. Tagged-device identities do not qualify. Invoking or listing these tools also requires a matching connector grant. These prerequisites apply to both MCP and Chat. When a user lacks a personal library, Aperture omits these tools from MCP `tools/list`. The `import_skill` tool is MCP-only; the other five tools are also available in Chat. | Tool name | Purpose | | ------------------- | ---------------------------------------------------------------------------------------- | | `list_skills` | List personal, organization, and Aperture-provided skills. | | `get_skill` | Inspect a skill's details and files. | | `set_skill_enabled` | Enable or disable a skill for yourself. Required organization skills cannot be disabled. | | `rename_skill` | Rename a personal skill. | | `delete_skill` | Permanently delete a personal skill and all its versions. | | `import_skill` | Import a skill archive into your personal library. | Missing or withheld tools do not remove the `aperture` connector from the gateway. Conversely, a grant cannot make an unavailable tool available. ## Discover HTTP connectors An agent calls `aperture_list_connectors` through `/v1/mcp` to discover authenticated HTTP API proxies. The tool returns only HTTP connectors for which the user has a matching `connectorID/proxy` grant, including broader wildcard or label grants. It does not disclose connectors the user cannot access. The returned connector information helps the agent construct requests to `/v1/connectors//`. It includes the connector's `description` and `context`, so do not put secrets or sensitive information in those fields. Access to the system tool does not grant access to the HTTP proxies it describes. For a setup procedure and example response, refer to [Set up an HTTP API connector][docs-http-connector]. ## Grants for system tools System tools use the same grant checks as other connectors. There is no authorization bypass for a system connector. The `aperture` connector has the `system` label by default, and the shipped default configuration grants `label:system` to all users. Grants use the unprefixed tool name, while MCP clients use the connector-prefixed name. For example, grant `aperture/tools/list_connectors` to permit the MCP tool `aperture_list_connectors`. Choose a pattern for the access you want to provide: * `label:system` grants the whole connector while it has the `system` label. * `aperture/**` grants all capabilities of the `aperture` connector. * `aperture/tools/*` grants all registered tools of the `aperture` connector. * `aperture/tools/web_search` grants only the web search tool. If you remove the default grant, users need another matching grant. Chat hides connectors that a user's grants deny, including from admins. For the setup procedure, refer to [Grant access to MCP tools][docs-tool-grants]. ## System labels and reserved IDs The `system` label identifies the `aperture` system connector; it does not indicate data sensitivity. For reserved-label rules, refer to [the reserved `system` label][docs-system-label]. The `aperture` ID is reserved and cannot be used for a configured connector. Refer to [connector ID rules][docs-connector-ids] and [validation errors][docs-validation-errors]. [docs-built-in-connectors]: /docs/aperture/connectors/built-in-connectors [docs-connector-ids]: /docs/aperture/connectors/reference#connector-id-rules [docs-discover-tools]: /docs/aperture/connectors/use-a-connector#discover-and-call-tools [docs-http-connector]: /docs/aperture/how-to/set-up-http-api-connector [docs-system-label]: /docs/aperture/connectors/reference#the-reserved-system-label [docs-tool-grants]: /docs/aperture/how-to/grant-mcp-tool-access [docs-validation-errors]: /docs/aperture/connectors/reference#validation-errors