Bridge

Securely reach private services from anywhere in Connic: connectors, LLM providers, MCP servers, and your own tools and middlewares, without opening inbound firewall rules.

What is the Connic Bridge?

The Connic Bridge is a lightweight agent that runs inside your private network and creates a secure outbound tunnel to Connic Cloud. Anything in your project (connectors, custom LLM providers, MCP servers, and your own tools and middleware) can then reach services that are not publicly accessible, as if they were running next to them.

Because the bridge only makes outbound connections, you do not need to open any inbound firewall rules or expose your services to the internet.

When do you need it?

You need the bridge if your target service is:

• Inside a private AWS VPC, GCP VPC, or Azure VNet
• Running on-premises behind a corporate firewall
• Accessible only via private DNS or private IPs
• Behind an IP allowlist that cannot include Connic's IPs

If your services are publicly reachable (e.g. managed Kafka on Confluent Cloud, AWS SQS via public endpoint), you do not need the bridge.

Connection Flow

Setup Instructions

docker run -d --name connic-bridge \
  -e BRIDGE_TOKEN=cbr_your_token_here \
  -e ALLOWED_HOSTS=kafka:9092,postgres:5432 \
  connicorg/bridge:latest

pip install connic-bridge

connic-bridge \
  --token cbr_your_token_here \
  --allow kafka:9092 \
  --allow postgres:5432

services:
  connic-bridge:
    image: connicorg/bridge:latest
    restart: always
    environment:
      BRIDGE_TOKEN: cbr_your_token_here
      ALLOWED_HOSTS: kafka:9092,postgres:5432,my-db:5432
      LOG_LEVEL: INFO

Once the bridge is online, connectors, LLM providers, custom code, and MCP servers can route through it. Configure each connection independently.

Where bridges are used

import psycopg
from aiokafka import AIOKafkaProducer
import httpx

BRIDGE_ID = "abc123"  # copy from Project Settings > Bridge

async def lookup_order(order_id: str) -> dict:
    # Postgres in a private VPC
    with psycopg.connect(
        host=f"postgres-primary.cnc-bridge-{BRIDGE_ID}",
        port=5432, dbname="orders", user="reader", password="...",
    ) as conn:
        row = conn.execute(
            "SELECT data FROM orders WHERE id = %s", (order_id,)
        ).fetchone()

    # Private Kafka topic
    producer = AIOKafkaProducer(
        bootstrap_servers=f"kafka.cnc-bridge-{BRIDGE_ID}:9092"
    )
    await producer.start()
    await producer.send("order-lookups", order_id.encode())
    await producer.stop()

    # Private HTTP service
    r = httpx.get(f"http://billing.cnc-bridge-{BRIDGE_ID}/v1/orders/{order_id}")
    return {"row": row, "billing": r.json()}

from connic import bridge_host

host = bridge_host("abc123", "postgres-primary")
# -> "postgres-primary.cnc-bridge-abc123"

{
  "routes": [
    {
      "match_type": "exact",
      "target": "redis-sentinel.internal",
      "port": 26379
    },
    {
      "match_type": "regex",
      "target": "^redis-[a-z0-9-]+\\.internal$",
      "port": 6379
    }
  ]
}

from redis.sentinel import Sentinel

sentinel = Sentinel(
    [("redis-sentinel.internal", 26379)],
    socket_timeout=1,
)
redis = sentinel.master_for("orders-primary", socket_timeout=1)

# The master hostname returned by Sentinel is routed automatically.
value = redis.get("health")

mcp_servers:
  - name: internal-mcp
    url: http://mcp.internal:8080/mcp
    bridge: ${INTERNAL_BRIDGE_ID}

Configuration Reference

Security

• Outbound-only - the bridge never accepts inbound connections. No ports need to be opened.
• Optional allowed hosts - configure exact host:port values to restrict what the bridge can reach. Unset or empty allows every target available from its network.
• Token authentication - each bridge has its own token tied to a single Connic project. Tokens can be rotated at any time, and you can run multiple bridges in different networks for the same project.
• TLS encryption - communication between the bridge and the Connic tunnel endpoint uses WSS (WebSocket over TLS).