Start a session

Skills the agent loads for this run, each by public URL, as a string or {url}: a GitHub tree URL to a directory holding SKILL.md, a URL to a SKILL.md file (github.com/…/blob/…, raw.githubusercontent.com/… or any https host), or a .zip URL. Fetched when the run is created; a GitHub source is pinned to the commit its branch or tag points at, and the pin is kept with the run. All of a run's skills pack to at most 96 KiB compressed. An unreachable URL is 422 SKILL_FETCH_FAILED; no SKILL.md, a bad name or too large is 422 SKILL_INVALID.

What this run connects to, each entry in one of three forms:

• An id of one of the caller's own connections (GET /me/connections): an MCP server (connected with a token, by OAuth, or with no auth), a Google or Microsoft product (Gmail, Outlook, OneDrive, ...) of one account, or a GitLab account. Secrets are never named: a session gets every secret of its Project (/o/{org}/secrets).
• A name of one of them, the name GET /me/connections lists: the name the caller gave an MCP server ("deepwiki", "EXA_API_KEY"), or the provider of an account or a built-in connector, which GET /me/connections lists as {type: "app", name: "linear"} ("linear", "gmail"). Only the caller's own rows match, and only user-level ones or ones in this run's Project. A name that matches two of them is 422 CONNECTION_AMBIGUOUS, whose message lists their ids; send one id instead.
• An inline MCP server {url, name?, auth?}, used by this run and its follow-ups only and never added to /me/connections. url is a streamable HTTP endpoint on https whose host resolves to public addresses only (else 422 MCP_SERVER_URL_INVALID). auth is the shape POST /me/connections takes: {mode: "bearer", token} sends the token as Authorization: Bearer; {mode: "none"} or no auth sends none. A token beside url is 400 FIELD_REMOVED. The token is stored encrypted on the run and never returned. name defaults to a slug of the host (mcp-deepwiki-com), and may not be a built-in connection's or share a name with another entry (422 CONNECTION_AMBIGUOUS when it matches a named server).

Ids and names fit Anthropic's stored-credential model (a vault id per run); the inline form fits OpenAI's inline authorization and Cursor's mcpServers headers. An id or name that is unknown, still connecting, or waiting on a reconnect is 422 CONNECTION_NOT_READY. Follow-ups keep all three.

What Rush puts in front of the agent before it starts, each by URL, with connection naming the account that reaches it when more than one could: https://github.com/<owner>/<repo> clones the repository at its default branch, …/tree/<branch> at that branch, and …/pull/<n> on that open pull request's branch; at most one repository per run, reached through a GitHub App installation of the caller (connection is an installation id from GET /o/{org}/github). On a Project run it may only name the Project's repository. https://linear.app/<workspace>/issue/<ID> puts the issue in the prompt, read through the caller's Linear connection. Any other URL is 422 RESOURCE_UNSUPPORTED; a repository no installation covers, or an issue with no Linear connection, is 422 RESOURCE_NOT_ACCESSIBLE.

Every file the agent saved to /workspace/.rush/artifacts/. url downloads it from this API with no credential until url_expires_at, an hour after the read; read the session again for a fresh link. GET …/artifacts/{name} with the key also downloads it.

The files the session was started or followed up with. url downloads one with no credential until url_expires_at, as for artifacts; GET …/attachments/{id} with the key also downloads it.