Connections
Connections is where you connect the infrastructure Polo works on: cloud accounts, clusters, databases and monitoring. It shows each system’s status and exactly what Polo can reach in it. The tools your team works in, such as Slack, Jira, Gmail and GitHub, are under Apps. Administrators add and disable connections; other members can read them.
The tabs
Section titled “The tabs”| Tab | What it shows |
|---|---|
| Connected | Every connected system with its status, what Polo can reach in it, and Manage or Disable. A summary line counts how many are connected, registered and failing. |
| Add new | The catalog of systems you can connect, with search and the filters All, Engineering, Workspace and Advanced. |
| Runners | The runners of this workspace. See Runners and the vault. |
| Vault | Keys and tokens you store once and use by name. |
Each row on Connected opens to What Polo can reach: the exact targets (a stack, a namespace, a database, a set of tags) and the actions enabled on each, with those that make changes marked after approval. Endpoints and identifiers are under Technical details.
Add a connection
Section titled “Add a connection”- Press Add connection, or choose a system under Add new.
- Give the connection a name.
- Choose where it Runs on: Polo’s default runner where it is offered, one of your runners, or a runner at a public address.
- Enter the scope Polo may reach. Give Polo the narrowest access that does the job: an account, a cluster, a namespace.
- Save, then check the status on the Connected tab.
To let an agent use a connection, edit the agent on the Agents page and tick it under Tools it may use.
What you can connect
Section titled “What you can connect”| System | What Polo does with it |
|---|---|
| AWS, Google Cloud | Maps the account and shows its architecture. Opens on Infrastructure. |
| Terraform | A skill you add to an agent: it plans from a repository and applies after a person approves the plan. |
| Kubernetes & Helm | Inspects workloads, deploys Helm releases and verifies rollbacks. |
| Containers & registries | Builds exact source, scans images and publishes verified image digests. |
| PostgreSQL | Runs approved named queries, manages backups and verifies restores. |
| AWS Secrets Manager | Inspects secret metadata and manages approved rotations. |
| Microsoft Azure | Reads machines, disks, IP addresses and the daily cost of tagged resources; if you allow it, starts, stops or restarts a machine after approval. |
| Prometheus | Reads service metrics and evaluates availability objectives. |
| Loki logs | Reads a service’s recent log lines, with secrets masked. |
| Tempo traces | Finds slow or failed requests and shows where their time went. |
| Network diagnostics | Checks DNS, HTTPS endpoints and certificate health for a registered public origin. No credentials needed. |
| Custom MCP servers | Discovers tools from an MCP server; you choose which ones agents may use. |
Under Advanced are tag-scoped connections that need a runner you set up yourself: AWS cost and inventory for agents and Google Cloud machines and cost for agents.
Each of these is at its own level of testing. Settings → What Polo can do shows, for every area, how far it has been verified beside this workspace’s connection state. See Capabilities.
Connection states
Section titled “Connection states”| State | Meaning |
|---|---|
| Connected | Polo reached the system, or checked it when it was set up, and its latest request did not fail. The row says when. |
| Registered | Saved by an administrator but not reached yet. Polo first reaches a runner or endpoint when a task uses it, and hears from an alert source only when it delivers a signed alert. |
| Set up | Something set up inside Polo itself, such as an uptime monitor or a schedule. Shown on What Polo can do. |
| Error (reach failed) | Polo’s latest request failed. The row gives the reason, for example that the system did not answer in time, refused Polo’s credential, or answered outside the registered scope. |
| Paused | A monitor or schedule that an area depends on is paused, so nothing runs. Resume it where it is managed. |
| Needs a connection | Nothing is connected for this area of work yet. Shown on What Polo can do. |
| Reconnect required | A Google or Outlook account whose grant the provider revoked or expired. Reconnect the account to use it again. An MCP server in the same situation reads Reconnect needed. |
| Needs authorization | An MCP server that waits for an administrator to authorize it on the Tools page. |
| Disabled | Turned off. Tasks can no longer use it. Disabled connections are listed at the bottom of the tab. |
Disable a connection
Section titled “Disable a connection”Press Disable on its row and confirm. Agents lose access to everything Polo could reach through it, and tasks can no longer use it.
Secrets
Section titled “Secrets”Passwords and tokens you enter are encrypted and are not shown again, to a person or to an agent. When a connection runs on your own runner, the cloud, registry and database credentials stay on that runner; Polo keeps only the key it signs requests with. Store a key once in the Vault and choose it by name when you add a connection. See Runners and the vault.