Connections
It reaches your services. It never holds the credential.
A connection is one credential for one service, scoped to the channels you choose. The model gets a tool and a URL; the secret is injected at the network edge and scrubbed back out of everything that comes home.
The pieces
Five nouns, and they compose.
Access is not a switch on the bot. It is a small set of things you attach to a scope, so “what can #support reach?” has an answer you can read off a page rather than infer from a config file.
A connection can also be attached to a scope on its own, without the rest of its bundle. That grants just the connection — plus its preset’s tool pack, where the bundle enables it — and not the bundle’s instructions, skills or domains.
bundle/connection everywhere. It carries a preset, a credential type — bearer, header, basic, a GCP service account, custom, or MCP — allowed hosts, optional path prefixes and methods, extra headers, and a writes policy.Presets & tool packs
The common services arrive already configured.
A preset fills in the hosts, the auth style, a test request and the usage notes, so connecting a service is pasting a token rather than reading its API documentation.
Five of them also ship tool packs: thin, named tools that make an open-weight model reliable on the asks people actually make. A model handed a generic HTTP tool and an API reference will improvise; a model handed sentry_issues will not.
Test connection makes the preset’s check call through the proxy and reports the status, so a wrong host or a rejected token shows up while you are still in the dialog.
Presets
- ClickUp
- GitHub
- GCP logs
- GCP monitoring
- Sentry
- HubSpot
- Linear
- Jira
- Confluence
- Notion
- Google Drive
- Datadog
- Stripe
- PagerDuty
- Custom HTTP API
- Custom MCP server
Tool packs
clickup_search_tasksgithub_get_prgcp_query_logssentry_issueshubspot_searchAnd anything else with an HTTP API
Google Drive and the GCP presets are read-only. Packs are enabled per bundle. The second row has no preset — each is an ordinary custom connection: a host, a token, a writes policy.
The proxy
Five steps between the model and your service.
Every outbound call goes through an in-process proxy. This is where access is decided, where the credential joins, and where the write is stopped — none of it in the model, and none of it somewhere the model can talk its way past.
The model
emits http_request with a URL and no secret
- 1ResolveWhat may this channel reach? The union of its scopes and bundles, cached for a minute.
- 2MatchHost, path prefix and method against the connection. Anything else is refused, with a reason the model can act on.
- 3InjectThe credential joins here, at the network edge. 30-second timeout, redirects not followed.sealed credential store
- 4HoldWrites wait for a Confirm in the thread. Reads are never held.
- 5ScrubCredential values and anything secret-shaped are stripped from the response, then audited.
Your service
GitHub · ClickUp · Sentry · Jira · an MCP server · your own API
Writes policy
Three settings, per connection.
A write is any method other than GET, HEAD or OPTIONS. Reading through a connection is never held by default: a channel that may reach a service may look at it.
confirmautoallAllow rules short-circuit the hold. An admin writes a plain sentence — “Creating tasks in ClickUp is expected and approved.” — and before a write is held, a strict model check asks whether a rule clearly covers that exact action: the service, the kind of change, the scope of its effect. Only then does it run, and the reply says which rule applied. Anything unclear, and every write in a channel without rules, still waits for a person. The member-facing Configure page shows the channel what is pre-approved.
Dan2:41 PM
@attest_tag the Vasquez account is still on the old plan — can you bump their seat count to 40 and note it on the ticket?
attest_tagApp2:41 PM
Found them: acct_8813, Growth plan, 25 seats, renewed 3 weeks ago. The ticket is SUP-2291. Two writes, so I’ll wait.
Waiting on a human
Raise Vasquez Ltd from 25 to 40 seats
billing/stripePOST /v1/subscription_items/si_88…Remote MCP servers
Their tools load when a request needs them.
A connection of type mcp points at a remote MCP server. Its tools are listed once per connection, cached for ten minutes, and offered to the model prefixed with the connection name.
Auth is a bearer token, or OAuth 2.0 authorization code per the MCP spec: resource discovery, authorization-server metadata, dynamic client registration where needed, PKCE, and automatic refresh. You sign in from the console.
Test connection performs a real handshake against the server — initialize plus a tool listing — and reports the tools it found, so a wrong URL or a rejected token is visible before you save.
Whether an MCP tool counts as a write is decided from its name, not from the server’s own read-only hint. That hint is a remote server’s claim about itself, and trusting it would let anyone skip the Confirm card by setting a flag.
Why it matters
Listing everything up front
~60 tools · ~20k input tokens · every round
Loading on demand
connection names + use_connection · tools sent from the round they are needed
A message that names the connection, or a thread that has already used it, loads the tools before the first call — so no round is spent asking.
Repositories
Connect a repo once; every channel that needs it gets the tools.
Give it a repository — owner/name or its URL — and an access token. The token is checked against that repository first, then stored sealed as a GitHub connection in a Repositories bundle and attached to that scope on its own, so the channel gets the GitHub tools and nothing else the bundle might grow later.
A default repository decides which one it assumes when a question does not name one: the workspace sets one for everyone, and a channel can override it. Each repository row also takes a test command, which the fix worker runs — leave it empty and the worker detects one.
Setup links
The person with the secret is rarely the person in the console.
An admin who does not hold a credential generates a one-time setup link, valid for seven days, and sends it to whoever does. They paste the secret on that page, the connection is created as pending, and an admin approves it in the console.
The secret never passes through chat, never lands in a DM, and is never something an admin has to ask someone to read out.
Bring the service. We will show you the hold.
In a demo we connect one of your own services, in a channel you pick, and let it try to change something.