rl-protect-connect

name	rl-protect-connect
description	Configures the rl-protect tool by connecting it to a Spectra Assure Community (free) or Spectra Assure Portal account (enterprise). Use when the user wants to set up rl-protect, add or update a server connection, or provide an API token.

rl-protect configuration

Use this skill when the user wants to connect rl-protect to a Spectra Assure account. There are two account types with different required arguments. Always identify which account type applies before running any command.

---

Account types

	Community	Enterprise
Token prefix	rlcmm-*	rls3c-*
Server required	No	Yes
Org required	No	Yes
Group required	No	Optional

---

Tasks

---

Connect — Community account

Trigger: user provides a token starting with rlcmm-, or says they have a free or community account.

Required inputs: --rl-token Optional inputs: --connection-id, --ca-path, proxy settings

Command:

rl-protect server connect \
            --rl-token={token}

With a named connection (use when the user wants to manage multiple connections):

rl-protect server connect {connection-id} \
            --rl-token={token}

The token is always persisted to the config file and does not need to be supplied on every scan.

---

Connect — Enterprise account

Trigger: user provides a token starting with rls3c-, or mentions a portal URL or organisation name.

Required inputs: --rl-server, --rl-org, --rl-token Optional inputs: --connection-id, --rl-group, --ca-path, proxy settings

Command:

rl-protect server connect \
            --rl-server={portal-url} \
            --rl-org={organisation} \
            --rl-token={token}

With an optional group and named connection:

rl-protect server connect {connection-id} \
            --rl-server={portal-url} \
            --rl-org={organisation} \
            --rl-group={group} \
            --rl-token={token}

---

Update an existing connection

Trigger: user wants to change a token, server URL, org, or any other setting on an existing connection.

Use the same flags as connect. The connection-id must match the existing connection name. If no connection ID was set, the target is the default connection.

rl-protect server update {connection-id} \
            --rl-token={new-token}

---

Remove a connection

Trigger: user wants to delete a saved connection.

rl-protect server remove {connection-id}

If no connection ID is specified, the default connection is removed.

---

List connections

Trigger: user wants to see what connections are configured, or is unsure which connection is active.

rl-protect server list

---

Proxy configuration

If the user mentions a proxy, append these flags to any connect or update command:

Flag	Value
--proxy-server	Local proxy URL
--proxy-port	Proxy port
--proxy-user	Proxy username
--proxy-password	Proxy password

---

Custom CA or config path

Flag	When to use
--ca-path	User has a custom Certificate Authority store (common in enterprise environments with TLS inspection)
--config-path	User wants to use a non-default config file location

---

Information gathering

Before running any command, confirm any missing required inputs with the user. Do not substitute placeholder values.

For Community: if no token is provided, ask:

"Please provide your Spectra Assure Community token. It starts with rlcmm-."

For Enterprise: if any of server, org, or token are missing, ask for all three together:

"Please provide your Spectra Assure Portal URL, organization name, and PAT token (starts with rls3c-)."

Never log, echo, or include tokens in any response text or summary after the command has run. Treat tokens as secrets.

---

Post-connect verification

After any connect or update command completes successfully, confirm the connection is working by listing configured connections:

rl-protect server list

Then report the result to the user in this format:

### rl-protect connection configured

| Setting | Value |
|---|---|
| Connection | {connection-id or "default"} |
| Account type | {Community / Enterprise} |
| Server | {portal URL or "Spectra Assure Community"} |
| Organisation | {org or "—"} |
| Token saved | Yes |

---

General rules

• The token is always saved implicitly — do not pass --save-token.
• Never store, repeat, or summarise a token value in any response.
• If the user supplies a token with an unrecognised prefix, ask them to confirm whether it is a Community (rlcmm-*) or Enterprise (rls3c-*) token before proceeding.
• If rl-protect server list shows an existing connection with the same ID, warn the user before running connect and suggest using update instead.
• Do not add --rl-server, --rl-org, or --rl-group flags to Community account commands — they are not valid for that account type.