Integrations
Integrations are the second tier of the Pawz extensibility system. They connect your agents to third-party APIs and CLI tools with full credential management, binary detection, and optional dashboard widgets. The 40 built-in integrations are compiled into the Rust binary. Community integrations can be installed via TOML manifests from PawzHub or manually from~/.paw/skills/.
Integrations vs. Skills: A Skill is a SKILL.md file that injects instructions into an agent’s prompt — zero config. An Integration is a pawz-skill.toml file that additionally declares credentials (encrypted in the vault), required binaries (auto-detected), and optional dashboard widgets.
How Integrations Work
- Author creates a
pawz-skill.tomlmanifest declaring what the integration does, what credentials it needs, and how the agent should use it - Install via PawzHub (in-app browser) or manually into
~/.paw/skills/{id}/ - Configure credentials in the Skills tab — Pawz generates the input form automatically from the manifest
- Assign to agents — open the Agents tab, select an agent, and enable the integration in their Skills sub-tab
- Use — the agent receives decrypted credentials and instructions in its system prompt, then calls APIs via
fetchor CLI tools viaexec
The Manifest Format
Every integration is a singlepawz-skill.toml file:
Manifest Fields
[skill] — Required
| Field | Type | Required | Description |
|---|---|---|---|
id | string | ✓ | Unique identifier. Alphanumeric + hyphens only. |
name | string | ✓ | Display name. |
version | string | ✓ | Semver version (e.g. 1.0.0). |
author | string | ✓ | Author name or GitHub username. |
category | string | ✓ | One of: vault, cli, api, productivity, media, smart_home, communication, development, system. |
icon | string | — | Material Symbols icon name (e.g. edit_note). |
description | string | ✓ | Short description (10–500 chars). |
install_hint | string | — | Instructions for getting credentials. |
[[credentials]] — Optional, repeatable
Declare API keys, tokens, or secrets the integration requires. Users enter these in the Skills tab. Pawz encrypts them with XOR (32-byte random key in the OS keychain) and injects decrypted values into the agent’s system prompt at runtime.
| Field | Type | Required | Description |
|---|---|---|---|
key | string | ✓ | Env var name (e.g. NOTION_API_KEY). |
label | string | ✓ | UI label shown to the user. |
description | string | — | Help text for where to find this credential. |
required | bool | ✓ | Whether the integration works without it. |
placeholder | string | — | Example value in the input field. |
paw-skill-vault). Decrypted values exist only in the agent’s system prompt at runtime — never logged, never written to disk unencrypted, never transmitted externally. An AES-GCM upgrade is planned.
:::
[instructions] — Required
| Field | Type | Required | Description |
|---|---|---|---|
text | string | ✓ | Agent instructions. |
[widget] — Optional
Declare a dashboard widget for persistent visual output on the Today/Dashboard view.
| Field | Type | Required | Description |
|---|---|---|---|
type | string | ✓ | status, metric, table, log, or kv. |
title | string | ✓ | Widget card title. |
refresh | string | — | Auto-refresh interval (e.g. 5m, 1h). |
Widget Types
Integrations can declare a dashboard widget to display persistent structured data. The widget card appears on the Dashboard alongside weather, tasks, and quick actions.Status
Single status indicator — service health, connection state, on/off checks.Metric
Single large number with trend — KPIs, revenue, counts.Table
Rows of structured data — issues, deployments, records.Log
Chronological event feed — incidents, messages, activity.Key-Value (KV)
Key-value pairs — stats, config summaries, metadata.Field Types
| Type | Rendering | Example |
|---|---|---|
text | Plain text | ”Deploy to production” |
number | Locale-formatted | ”1,234,567” |
badge | Colored pill (green/yellow/red) | “Active” |
datetime | Relative time | ”2 hours ago” |
percentage | Progress bar + number | ”94.5%“ |
currency | Dollar symbol + formatted | ”$12,450.00” |
Built-in Integrations
Pawz ships with 40 built-in integrations across 9 categories. These are compiled into the binary and cannot be uninstalled — only enabled or disabled per agent.| Category | Count | Examples |
|---|---|---|
| Vault | 10 | Email, Slack, GitHub, Coinbase, DEX Trading, Solana DEX |
| API | 4 | Notion, Trello, Google Workspace, Google Places |
| CLI | 3 | Weather, Blog Watcher, Summarize |
| Productivity | 5 | Apple Notes, Reminders, Things 3, Obsidian, Bear Notes |
| Media | 7 | Whisper, Image Gen, Video Frames, ElevenLabs, Spotify, GIF Search |
| Smart Home | 4 | Philips Hue, Sonos, Eight Sleep, Camera Capture |
| Communication | 2 | WhatsApp, iMessage |
| Development | 2 | tmux, Session Logs |
| System | 3 | 1Password, Peekaboo, Security Audit |
Per-Agent Scoping
Integrations are scoped to specific agents. When you install a community integration, you assign it to one or more agents.- A Marketing Agent might have Notion, SendGrid, and X/Twitter integrations enabled
- A DevOps Agent might have GitHub, Vercel, and Cloudflare enabled
- A Trading Agent might have Coinbase and DEX Trading enabled
Assigning integrations to agents
Skill and integration assignment is managed from the Agents tab, not from the Skills view:- Open the Agents tab in the sidebar
- Select an agent (e.g. your Marketing Agent)
- Go to the agent’s Skills sub-tab
- Enable or disable individual skills and integrations for that agent
- Only enabled items are injected into that agent’s prompt
Installing Integrations
From PawzHub (In-App)
- Open the Skills tab in the sidebar
- Search or browse the PawzHub catalog
- Click Install on any integration (look for the 🟣 purple badge)
- Configure credentials in the auto-generated form
- Assign to agents via Agents → [agent] → Skills
Manual Install
Place apawz-skill.toml file in the skills directory:
Uninstalling
Click Uninstall in the Skills tab. This removes the skill folder from~/.paw/skills/, cleans up stored credentials, and removes enabled state.
Creating Integrations
In-App Wizard
The Create Skill wizard in the Skills tab walks you through building an integration without writing TOML by hand:- Basic Info — name, category, icon, description
- Credentials — add API key fields with labels and placeholders
- Instructions — write or paste agent instructions (templates available for REST APIs, CLI tools, and web scrapers)
- Widget — optionally declare dashboard output
- Test — enable the integration and verify it works with a live agent
- Publish — save locally, export TOML, or publish directly to PawzHub
AI-Assisted Creation
Ask your agent:“Create an integration for the Linear API”The agent fetches the API docs, generates a complete
pawz-skill.toml with endpoints, auth headers, and instructions, then pre-fills the wizard for review.
Template Starters
- REST API —
fetchcalls with auth headers, JSON parsing - CLI Tool —
execcommands with flag reference and binary detection - Web Scraper —
fetch+ HTML parsing instructions
Publishing to PawzHub
- Fork the
elisplash/pawzhubrepository - Create
skills/{your-skill-id}/pawz-skill.toml - Open a Pull Request — CI validates your manifest automatically
- Maintainer reviews and merges
- Your integration appears in the in-app PawzHub browser
CI Validation
| Check | Description |
|---|---|
| Valid TOML | Syntax correct, required fields present |
| Unique ID | No collision with existing skills |
| Valid category | Must be an allowed category |
| Safe ID format | Alphanumeric + hyphens (no path traversal) |
| Semver version | X.Y.Z format |
| Description length | 10–500 characters |
| Widget validation | Field types match allowed values |
| Instruction-only | No executable code patterns |
Security
What integrations can do
- Inject instructions into the agent’s system prompt
- Declare credential fields (encrypted by the engine)
- Declare widget schemas (rendered by the app)
What integrations cannot do
- Execute arbitrary Rust code
- Bypass domain allowlist/blocklist
- Access the OS keychain directly
- Read engine source code
- Install blocked packages
- Run unsandboxed commands when Docker sandbox is enabled
Runtime protections
| Layer | Protection |
|---|---|
| Credentials | XOR-encrypted, 32-byte key in OS keychain |
| Network | Domain allowlist/blocklist on every fetch |
| Shell | Docker sandbox routing when enabled |
| File system | Engine source read-blocked |
| Packages | Blocked package list on exec |
| Agent isolation | Per-agent working directories |
Readiness Check
Each integration card in Settings shows a status indicator:| Status | Meaning |
|---|---|
| Ready ✅ | All credentials provided, binaries detected |
| Missing credentials ⚠️ | API keys needed — click to configure |
| Missing binary ⚠️ | CLI tool not on PATH — install hint shown |
| Disabled 🔘 | Integration is off for this agent |

