🔌 Integrations & MCP servers

One screen holds it all: open Integrations from the grid icon in the sidebar's bottom strip (or Settings → Integrations). The Connected apps tab is the catalog - mail, calendars, project trackers, analytics, payments, CRMs and more - and the Custom integrations tab holds credentials for anything without a native integration, plus any MCP server you add.

Connected apps: each connection supports multiple accounts, a primary, renames, and scope presets - connect read-only where read-only is enough. Per-agent access lives one click deeper: Manage on a connected account can pin an agent to a narrower level or block it from the app entirely, enforced on every call with no restart. Every account row shows its health (expired credentials get a Reconnect), and "last used" jumps to that integration's runs - so "what has it been doing with my calendar?" always has a receipt.

Custom integrations: grouped credential fields for tools we don't natively support. Your agents use them to do the work; the dashboard never shows a saved value again - masked on screen, write-only from then on.

Recommended is the first row of the catalog: products we vouch for, with dedicated agent tools. SiteGPT (AI support chatbot: sign in and approve), Revid (short-form video: paste your API key), PostSyncer (social scheduling: paste your API token), and Bazzly (Reddit marketing: paste your API key) are live today. Connect from the card and the tools reach your agents within a couple of minutes. Agents can never buy anything in these products; spending stays in the vendor's own dashboard, yours to do.

Add any MCP server

Any MCP server connects from the Custom tab: Add MCP server, then paste either the server's https URL or the JSON config from its docs. The exact "name": { ... } snippet vendors publish works as-is, trailing comma and all, for hosted servers and command-based ones alike. Your agents get every tool the server exposes within a minute or two, each carrying the server's own prefix (add "Acme CRM" and its tools arrive as acme_crm_…).

If the config carries a key or token, it lands in the credential vault like every custom credential: masked in the dashboard, write-only on screen. A server that needs no key can also go straight to an agent in chat - paste the URL and the agent sets it up and reports back. When a key is involved, add it in the dashboard instead, so the secret never touches chat history.

Servers that sign in with OAuth (Notion-style: no API key to paste) are detected automatically. Paste the URL and Connect: the card shows Open sign-in page; approve access and the connection finishes by itself. The tokens live in the vault and renew themselves. If the server ever revokes access, the entry shows Expired - add the same URL again, approve, done.

⚠️ Heads up: Scope discipline beats trust: give the narrowest preset that does the job, and expand only when a real task needs it. You can change scopes any time - agents adapt on their next run.