Connect runZero to Conduit

This walkthrough connects runZero (asset discovery and exposure management) to Conduit. You create an Account API token in the runZero console, then add it as an organization connection in Conduit. runZero is a hosted integration — Conduit talks to runZero’s own MCP endpoint, so the only thing you supply is the token.

Menu labels can change

The runZero steps below reflect the console flow at time of writing; menu labels can shift between releases. If a label differs, follow runZero’s guide to leveraging the API.

Before you start

You need:

• A Conduit role that can manage connections — owner or admin on your organization.
• A runZero console login that can create account-level API tokens.
• The right token type: runZero issues more than one kind of API token, and Conduit needs an Account API token — the kind that starts with CT-. Other token types are rejected at validation.

Step 1 — Create an Account API token in runZero

1. Sign in to the runZero console. Expected: the runZero dashboard.
2. Create an Account API token following runZero’s API guide. Expected: a token value beginning with CT-.
3. Copy the token. If the value you copied doesn’t start with CT-, you created the wrong token type — go back and create an account token. (The runZero API reference covers what the token can access.)

Caution

Copy the token now and store it somewhere safe. Don’t paste it into chat, email, or a shared document — the next step moves it directly into Conduit, which encrypts it at rest. If you accidentally expose the token, revoke it in the runZero console first; the exposed token becomes useless immediately.

Step 2 — Connect runZero in Conduit

1. In Conduit, go to Connections (/org/catalog). Expected: the vendor catalog.
2. Find runZero in the catalog (under Security) and click Connect. Expected: a credential form with a single Account API Token field (placeholder CT-...).
3. Paste the token from Step 1 into the Account API Token field.
4. Click Connect. Expected: Conduit validates the token against runZero’s hosted MCP endpoint immediately and shows a green Connected status. A bad or wrong-type token is rejected here, not on the first tool call.

The credential is stored at the organization scope, so every technician in your org shares this runZero connection. (For per-technician tokens, connect at the personal scope instead — see Vendor connections.)

Verify it worked

Connect an MCP client to Conduit — Claude Desktop, Claude Code, Cursor, or any MCP-compatible client (see Connecting an AI client) — and ask it to run a read-only runZero tool, such as listing discovered assets. You should get real data back, and the call appears in your audit log with the correct user, vendor (runzero), and a successful status.

Troubleshooting

Symptom	Likely cause
Connect fails with “Invalid API token. Use an Account API token (CT-… prefix) from runZero console.”	The token is wrong, revoked, or the wrong type — organization/other token types don’t work here. Create an Account API token (it starts with CT-) and re-connect.
Connect fails with “Access denied. Ensure your token has the required permissions.”	The token authenticated but runZero refused access. Check the token’s permissions in the runZero console, or create a new account token with broader access.
Connect fails with “runZero returned HTTP <status>”	runZero’s MCP endpoint answered with a non-auth error — usually a transient vendor-side issue. Wait and retry; if it persists, check runZero’s status.
Tool calls return 403 “no credentials for vendor”	runZero isn’t connected at a scope this user can resolve. Connect it at the organization scope, or confirm the user’s team has a token.
Need to rotate the token	Create a new Account API token in the runZero console, then update the credential at /org/catalog. Revoke the old token in runZero once the new one validates.

Related

• Vendor connections — credential scopes, rotation, and the full vendor catalog.
• Security — how Conduit encrypts and resolves the credential you just stored.