| name | trellis-connect-providers |
| description | Connect Trellis providers as Cloudflare Worker secrets one provider at a time. |
Trellis Connect Providers
Use this skill when a user needs to connect outside services to a Trellis Cloudflare app.
Keep the sequence narrow. Do not push every provider at once.
Read First
Use:
npm run doctor -- --json
npm run verify -- --json
Also read:
src/agent.ts
wrangler.jsonc
.trellis/providers/ if it exists
Provider Order
Prefer this order:
- first Cloudflare boot and deploy
- protected route secret
- research provider
- trace export provider, if requested
- CRM
- email and handoff
- discovery
- enrichment
- outbound send enablement
For the novice flow, the minimum demo set is Cloudflare only:
npm run deploy -- --json
npm run verify -- --json
npm run verify -- --live --url "$APP_URL" --api-key "$TRELLIS_API_KEY"
- remote MCP
- one safe signal
Only after that, add providers.
Commands
Use the CLI as the contract:
npm run trellis -- connect <provider> --json
Examples:
npm run trellis -- connect firecrawl --json
npm run trellis -- connect attio --json
npm run trellis -- connect agentmail --json
npm run trellis -- connect apify --json
npm run trellis -- connect prospeo --json
npm run trellis -- connect langfuse --json
npm run trellis -- connect braintrust --json
The command writes a non-secret manifest and tells the user which npx wrangler secret put <NAME> commands to run.
Explain Providers Plainly
- Firecrawl = search and extraction
- Attio = CRM sync
- AgentMail = outbound email and inbound reply webhooks
- Apify = discovery source
- Prospeo = enrichment
- Slack = handoff and operator channel
- Langfuse = optional trace export
- Braintrust = optional trace export
- Cloudflare AI Gateway = default model gateway
Cloudflare Secret Rule
Deployed agents read provider credentials from Cloudflare Worker secrets.
Do not put secrets in:
wrangler.jsonc
.trellis/providers/
knowledge/
skills/
- MCP host config
Use:
npx wrangler secret put FIRECRAWL_API_KEY
npx wrangler secret put ATTIO_API_KEY
npx wrangler secret put AGENTMAIL_API_KEY
Novice Rule
After each provider step:
- say what the provider does
- say the exact missing secret names
- rerun
npm run doctor -- --json
- rerun
npm run verify -- --json
- tell the user only the next blocker
Use explicit handoffs:
Next: set Worker secrets
Next: run doctor
Next: deploy again
Next: verify live
Next: connect remote MCP
Safe Demo Rule
Do not push discovery automation or real send providers before:
- Cloudflare deploy is green
- live verify is green
- remote MCP is connected
- one safe signal has been inspected
- approval and no-send behavior is understood