Connect Hugging Face to Conduit

This walkthrough connects Hugging Face (developer tools) to Conduit. Hugging Face is a hosted integration: Conduit forwards tool calls to Hugging Face’s own hosted MCP server. The credential is an access token (hf_...) — and unusually, it’s optional: you can connect anonymously, but anonymous access is rate-limited and read-only, so a token is recommended for real use.

Menu labels can change

The Hugging Face steps below reflect the token-settings flow at time of writing; labels can shift as the site updates. Tokens are managed at huggingface.co/settings/tokens.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A Hugging Face account — only if you want authenticated access. To connect anonymously (rate-limited, read-only), you can skip straight to Step 2 and leave the token field blank.

Step 1 — Create an access token in Hugging Face (recommended)

1. Sign in to Hugging Face and open your token settings. Expected: the Access Tokens page.
2. Create a new token. A read-scoped (or fine-grained read) token is enough for browsing models, datasets, and Spaces; grant more only if you want the AI acting on your account.
3. Copy the token (hf_...). Hugging Face shows the full value only at creation.

Caution

Copy the token now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the token, invalidate it at huggingface.co/settings/tokens first; the exposed token becomes useless immediately.

Step 2 — Connect Hugging Face in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find Hugging Face in the catalog (under Developer Tools) and click Connect. Expected: a credential form with a single field: Access Token (optional — anonymous access is rate-limited & read-only), placeholder hf_....
3. Paste the token from Step 1 — or leave the field blank to connect anonymously.
4. Click Connect. Expected: Conduit opens a real session against Hugging Face’s hosted MCP server (with your token, if provided) and shows a green Connected status. A bad token is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this Hugging Face connection — and shares its rate limits. (For per-technician tokens, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only Hugging Face tool, such as searching for a model or dataset. You should get real data back, and the call appears in your audit log with the correct user, vendor (huggingface), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid Hugging Face access token.”	The token is wrong, was invalidated, or was copied incompletely. Create a fresh token at huggingface.co/settings/tokens and reconnect — or leave the field blank for anonymous access.
Connect fails with “Hugging Face MCP returned HTTP NNN”	Hugging Face’s MCP server responded with an unexpected status — often a transient outage. Retry after a few minutes.
Tool calls hit rate limits or write actions fail	The connection was made without a token — anonymous access is rate-limited and read-only. Reconnect with an access token.
Tool calls return 403 “no credentials for vendor”	Hugging Face isn’t connected at a scope this user can resolve. Connect it at the organization scope (even an anonymous connection counts), or confirm the user’s team has one.
Need to rotate the token	Create a new token at huggingface.co/settings/tokens, update the credential at /org/catalog, then invalidate the old token.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.
• Hugging Face MCP — what the hosted server exposes.