Bridge (Private Networks)

Securely reach private services from anywhere in Connic: connectors, LLM providers, and your own tools and middlewares, without opening inbound firewall rules.

What is the Connic Bridge?

The Connic Bridge is a lightweight agent that runs inside your private network and creates a secure outbound tunnel to Connic Cloud. Anything in your project (connectors, custom LLM providers, and your own tools and middlewares) can then reach services that are not publicly accessible, as if they were running next to them.

Because the bridge only makes outbound connections, you do not need to open any inbound firewall rules or expose your services to the internet.

When do you need it?

You need the bridge if your target service is:

• Inside a private AWS VPC, GCP VPC, or Azure VNet
• Running on-premises behind a corporate firewall
• Accessible only via private DNS or internal IPs
• Behind an IP allowlist that cannot include Connic's IPs

If your services are publicly reachable (e.g. managed Kafka on Confluent Cloud, AWS SQS via public endpoint), you do not need the bridge.

Architecture

Setup Instructions

docker run -d --name connic-bridge \
  -e BRIDGE_TOKEN=cbr_your_token_here \
  -e ALLOWED_HOSTS=kafka:9092,postgres:5432 \
  connicorg/bridge:latest

pip install connic-bridge

connic-bridge \
  --token cbr_your_token_here \
  --allow kafka:9092 \
  --allow postgres:5432

services:
  connic-bridge:
    image: connicorg/bridge:latest
    restart: always
    environment:
      BRIDGE_TOKEN: cbr_your_token_here
      ALLOWED_HOSTS: kafka:9092,postgres:5432,my-db:5432
      LOG_LEVEL: INFO

Once the bridge is online, four different parts of Connic can route through it. Each one is set up independently. Pick the ones you need.

Where bridges are used

# tools/lookup_order.py
import psycopg
from aiokafka import AIOKafkaProducer
import httpx

BRIDGE_ID = "abc123"  # copy from Project Settings > Bridge

async def lookup_order(order_id: str) -> dict:
    # Postgres in a private VPC
    with psycopg.connect(
        host=f"postgres-primary.cnc-bridge-{BRIDGE_ID}",
        port=5432, dbname="orders", user="reader", password="...",
    ) as conn:
        row = conn.execute(
            "SELECT data FROM orders WHERE id = %s", (order_id,)
        ).fetchone()

    # Internal Kafka topic
    producer = AIOKafkaProducer(
        bootstrap_servers=f"kafka.cnc-bridge-{BRIDGE_ID}:9092"
    )
    await producer.start()
    await producer.send("order-lookups", order_id.encode())
    await producer.stop()

    # Internal HTTP service
    r = httpx.get(f"http://billing.cnc-bridge-{BRIDGE_ID}/v1/orders/{order_id}")
    return {"row": row, "billing": r.json()}

from connic import bridge_host

host = bridge_host("abc123", "postgres-primary")
# -> "postgres-primary.cnc-bridge-abc123"

mcp_servers:
  - name: internal-mcp
    url: http://mcp.internal:8080/mcp
    bridge: ${INTERNAL_BRIDGE_ID}

Configuration Reference

Security

• Outbound-only - the bridge never accepts inbound connections. No ports need to be opened.
• Allowed hosts - you control exactly which services the bridge can reach. Connections to unlisted hosts are rejected.
• Token authentication - each bridge has its own token tied to a single Connic project. Tokens can be rotated at any time, and you can run multiple bridges in different networks for the same project.
• TLS encryption - all communication between the bridge and relay uses WSS (WebSocket over TLS).

Troubleshooting