> ## Documentation Index
> Fetch the complete documentation index at: https://docs.kapso.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Resources

> Connect MCP servers, GitHub repositories, environment variables, and sandboxes to Kapso Agent.

Resources define which external tools, repositories, and secrets each mode can access. Create project resources once, then assign only the resources that each mode needs.

## Assign resources to a mode

Open **Kapso Agent → Modes**, select a mode, then open **Resources**. Only enabled resources assigned to that mode are available during a run.

Assigned MCP tools appear directly in the current mode. Conflicting tool names receive a `{connection}__{tool}` namespace so both tools remain available.

Assigning a GitHub repository gives the mode read-only file access and turns on its sandbox. Secret values never appear in the agent instructions.

## Connect an MCP server

Add the server URL and its required headers under **Kapso Agent → Resources**. Use `${ENV:NAME}` in a header to reference an encrypted project variable.

Test the connection, then assign it to each mode that needs its tools.

<div style={{ position: 'relative', paddingBottom: '66.9792%', height: 0 }}>
  <iframe style={{ position: 'absolute', top: 0, left: 0, width: '100%', height: '100%', border: 0 }} src="https://www.tella.tv/video/vid_cmtbmvkhb00iy0ahx8p6v8itn/embed?b=0&title=0&a=1&loop=0&t=0&muted=0&wt=0&o=0" title="Connect an MCP server to Kapso Agent" allow="autoplay; fullscreen" allowTransparency />
</div>

## Connect GitHub

Connect the GitHub App once, then select repositories for the project. You can also add a repository manually with its owner, name, branch, and personal access token.

A personal access token is optional for public repositories. Assign each repository to the modes that need its files.

<div style={{ position: 'relative', paddingBottom: '65.9375%', height: 0 }}>
  <iframe style={{ position: 'absolute', top: 0, left: 0, width: '100%', height: '100%', border: 0 }} src="https://www.tella.tv/video/vid_cmtbnon3k006n0ahpabyx1p6z/embed?b=0&title=0&a=1&loop=0&t=0&muted=0&wt=0&o=0" title="Connect GitHub to Kapso Agent" allow="autoplay; fullscreen" allowTransparency />
</div>

## Environment variables

Create encrypted project variables under **Kapso Agent → Resources**. MCP connections can reference them in headers, and custom-mode sandboxes can receive selected variables.

Kapso masks stored values in the settings page. It injects values only into the MCP connections and sandboxes that use them.

## Sandbox

A sandbox gives a custom mode an isolated workspace. Open **Kapso Agent → Modes**, select a custom mode, then open **Sandbox**.

Built-in modes use sandbox settings managed by Kapso. Assigning a repository to a custom mode keeps its sandbox enabled.

| Setting               | Behavior                                                                                                  |
| --------------------- | --------------------------------------------------------------------------------------------------------- |
| Environment variables | Inject selected project variables into the sandbox.                                                       |
| Workspace access      | Read-only access exposes file-reading tools. Execute access also exposes shell and file-editing tools.    |
| Require approval      | When enabled, shell commands and file changes ask for approval.                                           |
| Network access        | Allow all outbound hosts or only selected hosts. Kapso and assigned GitHub hosts are added automatically. |
| Setup command         | Run once when a new sandbox starts, before the agent begins work.                                         |