Integrations
Register a remote MCP server as a connector, connect an account, and add it to an assistant so it can use outside services, with a person approving each call.
What integrations do#
Integrations brings outside services' MCP servers into your workspace, so Agent Lab can read or act on your data in other systems, such as a Notion page or a GitHub issue. Connectors and accounts are managed once for the whole workspace. Add a connector to an assistant and it can call the connector's tools during a conversation.
Agent Lab calls an outside MCP server a connector. There are four steps:
- Add a connector Open Integrations in the sidebar. Pick one of the Popular services, or enter an MCP server's address yourself.
- Test it Check that Agent Lab can reach the server, and see which tools it offers.
- Connect an account For a service that needs authentication, hand over a token or sign in.
- Add it to an assistant On the assistant's page, choose the connector and pick the tools the assistant may call.
When an assistant wants to call one of a connector's tools during a conversation, it stops and waits for a person to approve the call. See Authorizing and approving in a conversation.
Who can do what#
| Action | Workspace owners and admins | Members |
|---|---|---|
| See connectors and their status, use Probe and Review tools | Yes | Yes |
| Add a connector (Add a custom connector) | Yes | No |
| Vouch as read-only for a tool | Yes | No |
| Connect your own account with the Only me scope | Yes | Yes |
| Connect an account with the Shared with the workspace scope | Yes | No |
| Disconnect your own connection | Yes | Yes |
| Disconnect a connection shared with the workspace | Yes | No |
| Approve a call to a tool that writes data or hasn't been vouched for | Yes | No |
| Approve a call to a tool vouched for as read-only | Yes | Yes |
A member who opens Add a custom connector sees "Changing this is available to workspace owners and admins. You can read what is here; ask one of them to make a change."
Adding a connector to an assistant takes permission to edit that assistant. On a published assistant shared with the workspace, it has to be someone who can publish it: an owner, an admin, or the team's manager for a team assistant. See Assistants for the details.
Add a connector#
Open the Connectors tab of Integrations.
Pick a popular service
Popular services, near the bottom of the page, lists MCP servers for common services: GitHub, Notion, Linear, Sentry, Atlassian (Jira and Confluence), Asana, Figma, Intercom, Webflow, monday.com, Airtable, GitLab, Wix, Supabase, Vercel, Shopify Storefront, Stripe, PayPal, Zapier, Postman, Hugging Face, Cloudflare Docs, DeepWiki and Context7. Each card shows how that service authenticates.
Choose Use and Agent Lab fills the name, address, authentication and description into the Add a custom connector form below. The card only fills the form; nothing is added to the workspace until you register it. Services do move these addresses, so check it against the service's own docs before you register it. A card for a service you've already added shows Added.
Zapier
The Zapier card connects to the actions you've set up in Zapier, which lets an assistant reach thousands of services through them. It authenticates with Sign in (OAuth).
For Shopify Storefront, replace your-store in the address with your shop's domain.
Enter your own
You can add any remote MCP server served over HTTPS, including one you host. Fill in Add a custom connector:
| Field | What to enter |
|---|---|
| Name | The name shown in the console and on assistant pages. |
| Server URL (https) | The MCP server's full address. It must start with https://. |
| Authentication | How Agent Lab authenticates to the server (see below). |
| Description (optional) | What the connector is for. |
Choose Register. The connector then appears in the Connectors list.
Authentication has four options:
| Option | Use it when | What connecting asks for |
|---|---|---|
| None (public) | The server is public and needs no account | Nothing. Add it to an assistant and it works |
| API token | The server takes a fixed token | A Bearer token |
| OAuth client credentials | The server uses the OAuth client credentials grant | A Client ID and Client secret |
| Sign in (OAuth) | You sign in on the service's site and approve access | Signing in on the service's page. No password is typed into Agent Lab |
You can't delete or disable a connector from the console yet. When you stop using one, disconnect its accounts and remove it from your assistants.
Test a connector and review its tools#
Each row in the Connectors list has three actions:
- Probe connects to the server, reads its tool list, and tells you how many tools it found and how many the server describes as read-only. Agent Lab also probes connectors on its own in the background.
- Review tools lists every tool on the connector with its risk labels.
- Connect opens the form for connecting an account (see Connect an account). A connector set to None (public) doesn't have this button.
The Status column reads Available, Unavailable or Not tested. Owners and admins also see the reason for the last failure underneath. Agent Lab keeps up to 200 tools per server, and a note under the status says when a server has more.
Vouch for a tool as read-only
In Review tools, every tool has two labels:
- What the server says: Server says: read-only, Server says: changes data or Server doesn't say. This is for information and changes no rules.
- What your workspace decided: You vouched: read-only or Not reviewed by you.
Until you confirm that a tool only reads data, Agent Lab treats it as one that can change data, so only owners and admins can approve its calls. Once an owner or admin has checked that a tool really only reads, they can choose Vouch as read-only, and members can then approve its calls too. Withdraw takes the vouch back.
Connect an account#
A connector that needs authentication has to have an account connected before assistants can use it. Choose Connect on its row in the Connectors list:
- Choose the Scope. Only owners and admins see this choice; for members it's always Only me. - Shared with the workspace: the workspace holds one credential. Calls run as that credential, not as the person asking, so everyone who uses the assistant can reach everything the credential can. - Only me: your own credential. An assistant uses it only when you are the one asking, and sees exactly what you can see.
- For a shared connection you can add an Identity label (optional), such as "Read-only queries", to tell several shared credentials for the same service apart (one read-only and one read-write, for example).
- Provide the credential for the connector's authentication: - API token: enter the Bearer token and choose Submit credential. - OAuth client credentials: enter the Client ID and Client secret and choose Submit credential. - Sign in (OAuth): choose Continue to authorize, sign in on the service's site and approve. You're sent back to Agent Lab afterwards.
If the service supports device codes, you can choose Connect with a device code instead. Agent Lab shows a code; choose Open the provider's page, enter the code there, then come back and choose I've authorized — check.
Credentials are stored encrypted and used only at the moment a tool runs.
Connected accounts are listed under Connected accounts with the connector, its Scope and its status. A line under the scope says whose permission applies:
- "Acts as each member with a credential that expires." or "Acts as each member with their own key. The key doesn't expire.": each person reaches only what their own account can reach.
- "Acts as the workspace, not the person asking. Everyone who uses it can reach everything it can.": any separation between people has to be set up in the service itself.
Give an assistant access#
A connector in the workspace isn't available to any assistant until you add it to that assistant.
Open the assistant's page and find Connected systems in the Actions (advanced) step (on a private assistant, the section is Your connectors):
- Choose the connector Pick it from Choose a connector.
- Pick the tools Under Tools this assistant may call, select the tools to allow. You must pick at least one; allow only the ones the assistant actually needs.
- Choose the identity A connector that needs authentication adds an Identity used menu, explained below.
- Add it Choose Add to this assistant.
Identity used decides whose credential the assistant uses:
- Each member's own credential (unpinned): when someone asks, the assistant uses the account that person connected with Only me. If they haven't connected one, the assistant has none of the connector's tools for them, and the conversation offers to connect their account (see Authorizing and approving in a conversation).
- A pinned shared identity: pick one of the workspace's Shared with the workspace credentials, and the assistant uses that one identity for everyone. This is the only way an assistant uses a shared credential. On a private assistant, only owners and admins can pin a shared identity.
Each connector on the assistant lists its identity mode (such as Each member's own account or One shared identity), a sentence about whose permission applies, and the tools allowed. Remove takes it off the assistant.
If nothing can be added, you'll see "No connectors available to add. Register one on the Integrations page, then add it here." For the rest of an assistant's settings, see Assistants.
Authorizing and approving in a conversation#
When you haven't connected your account
If an assistant can use a service you haven't connected, the conversation shows This assistant can reach a service you have not connected. Until you connect it, the assistant answers without those tools. How you connect depends on how the service authenticates:
- A service you connect with a token: choose Connect my account, paste your token into Your access token and choose Authorize. The conversation carries on with the tools available.
- Any other service (such as Sign in (OAuth)): the prompt has no token field. It shows Connect in Integrations instead, which opens Integrations with this connector's connect form open and the scope set to Only me. Once connected, come back to the conversation and send your message again.
These services can only be connected from Integrations; Agent Lab refuses a token stored for them directly.
Approving a tool call
Every time an assistant wants to call a connector's tool, it stops and shows The assistant wants to run an action, with what it will send and a risk label:
| Label | Meaning | Who can approve |
|---|---|---|
| Read-only | Your workspace vouched for the tool as read-only | Any workspace member |
| Writes to an external system | The tool changes data | Owners and admins |
| Undeclared risk — treated as destructive | Not vouched for yet, so Agent Lab treats it as able to change data | Owners and admins |
Review what it will send, then choose Approve and run or Decline. A member who can't approve sees only Decline, with the note Only a workspace owner or admin can approve this action. Ask one of them to approve it here, or decline it. Connector tools never run without a person's approval. For more on conversations, see Conversations.
Disconnect#
Find the row under Connected accounts and choose Disconnect. Members can disconnect only their own Only me connections; owners and admins disconnect the ones shared with the workspace. The status changes to Disconnected, and assistants can no longer use that credential.
A status of Sign in again means the authorization has lapsed. Choose Connect on the connector again.
To stop one assistant from using a connector, choose Remove under the assistant's Connected systems. You don't need to disconnect the workspace's account.
Troubleshooting#
- "Couldn't add the connector. Check the name and https URL." Both fields are required, and the address must start with
https://. - A probe fails. The server may be unreachable, or the credential may not have enough access. Owners and admins see the server's reason under Status.
- Signing in fails. Sign in (OAuth) needs a server that supports OAuth dynamic client registration. If yours doesn't, add the connector again with API token or OAuth client credentials.
- "The device flow could not be started. The provider may not offer one." Use Continue to authorize instead.
- The assistant doesn't use the connector's tools. Check that the connector is added to this assistant with the tools you need selected. If it isn't pinned, the person asking has to connect their own account with Only me first.
- "This connector's tools are not known yet. Check its health on the Integrations page first." Choose Probe on Integrations, and add the connector once its tools appear.