Adapter Config Reference

Top Level

name: source_portal
version: 0.1.0
label: Source Portal
origin:
  appUrl: https://app.example.test
  apiHosts:
    - api.example.test

Auth

auth:
  strategy: cookie_jar
  csrf:
    cookiePattern: csrf
    header: x-sitekit-csrf-token
  probe:
    operation: users.current
    expect: nonEmpty

Adapters declare auth strategy and probes. Connections hold credentials and session state:

adapter: [email protected]
credentials:
  provider: env
  prefix: SITEKIT_SOURCE_PORTAL
session:
  cookieJar: ~/.sitekit/jars/source_portal-cron.json
onExpiry:
  notify:
    webhook: https://hooks.example.test/sitekit/session-expired

LLM

LLM settings belong to the SiteKit workspace or command environment, not to the generated runtime client.

llm:
  provider: openai
  model: gpt-5
  apiKey:
    env: OPENAI_API_KEY
  redaction:
    mode: strict

Provider-specific keys can also come from 1Password, Keychain, or a cloud secret reference. Generated clients and MCP servers do not read this section.

Endpoints

endpoints:
  searchEvents:
    method: POST
    path: /api/events/search
    requestSchema: EventSearchRequest
    responseSchema: EventSearchResponse

Discovery

discovery:
  mode: human
  deterministic:
    bundleAnalysis: true
    graphql: true
    conventionSniffing: true
  browser:
    allowedHosts:
      - app.example.test
    maxMinutes: 10
    maxActions: 100
  safety:
    defaultWriteMode: preview
    requireHumanForSubmit: true

mode: autonomous lets an LLM drive the browser during onboarding. The same guardrails are useful for human recording because they define what SiteKit is allowed to observe and automate.

If an anti-automation challenge appears, SiteKit should stop with an unsupported site result rather than attempting to bypass it.

Operations

operations:
  events.list:
    backend: http
    endpoint: searchEvents
    input:
      workspaceId: string
      start: string?
      end: string?
    transform: transforms/events/list.ts
    sideEffects:
      category: read
    verification:
      status: verified
      verifiedAt: 2026-08-27T10:22:00Z
      freshness:
        liveProbeMaxAgeDays: 30
        demoteTo: raw
      declaredExposure:
        sdk: true
        mcp: true
        pipeline: true

  records.createDraft:
    backend: browser
    script: playwright/records/createDraft.ts
    sideEffects:
      category: create
      externalEffects:
        - submits_external_record
      defaultMode: preview
      requiresConfirm: true
    runtime:
      rateLimit:
        maxParallel: 1
        minDelayMs: 2000

Effective exposure is computed from declared exposure, freshness, drift signals, and trust policy.

Capabilities And Provenance

capabilities:
  transforms:
    network: none
    filesystem: none
    environment: none
    timers: none
  browser:
    allowHosts:
      - app.example.test
    allowDownloads: false
    blockNavigationOutsideAllowlist: true

provenance:
  source: local://adapters/source_portal
  captureIds:
    - cap_2026_08_27_a91f
  llm:
    provider: openai
    model: gpt-5
  signature: ed25519:example-signature

Registry artifacts fail validation if they contain credentials or session data. Unsigned adapters can be used for raw exploration, but should not auto-expose to MCP or pipeline surfaces.

Tests

tests:
  events.list:
    fixtures:
      - event-list
    live:
      - expect: array
      - minCount: 1
      - allHave:
          workspaceId: $input.workspaceId

Known Facts

knownFacts:
  - id: active_workspace_scope
    text: Events search is scoped by server-side active workspace.
    enforcement:
      beforeCall: /settings/active_workspace/:workspaceId
      assert: every result has workspace.id == input.workspaceId

Adapter Config Reference

On this page