---
title: Integrations
description: Register a remote MCP server as a connector, connect an account, and add it to an assistant so it can use outside services, with a person approving each call.
url: https://agentlab.cresclab.com/docs/en/studio/integrations
language: en
updated: 2026-11-06
---

# Integrations

Register a remote MCP server as a connector, connect an account, and add it to an assistant so it can use outside services, with a person approving each call.

## What integrations do

**Integrations** brings outside services' MCP servers into your workspace, so Agent Lab can read or act on your data in other systems, such as a Notion page or a GitHub issue. Connectors and accounts are managed once for the whole workspace. Add a connector to an assistant and it can call the connector's tools during a conversation.

Agent Lab calls an outside MCP server a **connector**. There are four steps:

1. **Add a connector** Open **Integrations** in the sidebar. Pick one of the **Popular services**, or enter an MCP server's address yourself.
2. **Test it** Check that Agent Lab can reach the server, and see which tools it offers.
3. **Connect an account** For a service that needs authentication, hand over a token or sign in.
4. **Add it to an assistant** On the assistant's page, choose the connector and pick the tools the assistant may call.

When an assistant wants to call one of a connector's tools during a conversation, it stops and waits for a person to approve the call. See [Authorizing and approving in a conversation](https://agentlab.cresclab.com/docs/en/studio/integrations.md#in-conversation).

## Who can do what

| Action                                                               | Workspace owners and admins | Members |
| -------------------------------------------------------------------- | --------------------------- | ------- |
| See connectors and their status, use **Probe** and **Review tools**  | Yes                         | Yes     |
| Add a connector (**Add a custom connector**)                         | Yes                         | No      |
| **Vouch as read-only** for a tool                                    | Yes                         | No      |
| Connect your own account with the **Only me** scope                  | Yes                         | Yes     |
| Connect an account with the **Shared with the workspace** scope      | Yes                         | No      |
| Disconnect your own connection                                       | Yes                         | Yes     |
| Disconnect a connection shared with the workspace                    | Yes                         | No      |
| Approve a call to a tool that writes data or hasn't been vouched for | Yes                         | No      |
| Approve a call to a tool vouched for as read-only                    | Yes                         | Yes     |

A member who opens **Add a custom connector** sees "Changing this is available to workspace owners and admins. You can read what is here; ask one of them to make a change."

Adding a connector to an assistant takes permission to edit that assistant. On a published assistant shared with the workspace, it has to be someone who can publish it: an owner, an admin, or the team's manager for a team assistant. See [Assistants](https://agentlab.cresclab.com/docs/en/studio/assistants.md) for the details.

## Add a connector

Open the **Connectors** tab of **Integrations**.

### Pick a popular service

**Popular services**, near the bottom of the page, lists MCP servers for common services: GitHub, Notion, Linear, Sentry, Atlassian (Jira and Confluence), Asana, Figma, Intercom, Webflow, monday.com, Airtable, GitLab, Wix, Supabase, Vercel, Shopify Storefront, Stripe, PayPal, Zapier, Postman, Hugging Face, Cloudflare Docs, DeepWiki and Context7. Each card shows how that service authenticates.

Choose **Use** and Agent Lab fills the name, address, authentication and description into the **Add a custom connector** form below. The card only fills the form; nothing is added to the workspace until you register it. Services do move these addresses, so check it against the service's own docs before you register it. A card for a service you've already added shows **Added**.

> [!TIP] Zapier
> The Zapier card connects to the actions you've set up in Zapier, which lets an assistant reach thousands of services through them. It authenticates with **Sign in (OAuth)**.

For Shopify Storefront, replace `your-store` in the address with your shop's domain.

### Enter your own

You can add any remote MCP server served over HTTPS, including one you host. Fill in **Add a custom connector**:

| Field                      | What to enter                                                 |
| -------------------------- | ------------------------------------------------------------- |
| **Name**                   | The name shown in the console and on assistant pages.         |
| **Server URL (https)**     | The MCP server's full address. It must start with `https://`. |
| **Authentication**         | How Agent Lab authenticates to the server (see below).        |
| **Description (optional)** | What the connector is for.                                    |

Choose **Register**. The connector then appears in the **Connectors** list.

**Authentication** has four options:

| Option                       | Use it when                                          | What connecting asks for                                              |
| ---------------------------- | ---------------------------------------------------- | --------------------------------------------------------------------- |
| **None (public)**            | The server is public and needs no account            | Nothing. Add it to an assistant and it works                          |
| **API token**                | The server takes a fixed token                       | A **Bearer token**                                                    |
| **OAuth client credentials** | The server uses the OAuth client credentials grant   | A **Client ID** and **Client secret**                                 |
| **Sign in (OAuth)**          | You sign in on the service's site and approve access | Signing in on the service's page. No password is typed into Agent Lab |

You can't delete or disable a connector from the console yet. When you stop using one, [disconnect](https://agentlab.cresclab.com/docs/en/studio/integrations.md#disconnect) its accounts and remove it from your assistants.

## Test a connector and review its tools

Each row in the **Connectors** list has three actions:

- **Probe** connects to the server, reads its tool list, and tells you how many tools it found and how many the server describes as read-only. Agent Lab also probes connectors on its own in the background.
- **Review tools** lists every tool on the connector with its risk labels.
- **Connect** opens the form for connecting an account (see [Connect an account](https://agentlab.cresclab.com/docs/en/studio/integrations.md#connect)). A connector set to **None (public)** doesn't have this button.

The **Status** column reads **Available**, **Unavailable** or **Not tested**. Owners and admins also see the reason for the last failure underneath. Agent Lab keeps up to 200 tools per server, and a note under the status says when a server has more.

### Vouch for a tool as read-only

In **Review tools**, every tool has two labels:

- What the server says: **Server says: read-only**, **Server says: changes data** or **Server doesn't say**. This is for information and changes no rules.
- What your workspace decided: **You vouched: read-only** or **Not reviewed by you**.

Until you confirm that a tool only reads data, Agent Lab treats it as one that can change data, so only owners and admins can approve its calls. Once an owner or admin has checked that a tool really only reads, they can choose **Vouch as read-only**, and members can then approve its calls too. **Withdraw** takes the vouch back.

## Connect an account

A connector that needs authentication has to have an account connected before assistants can use it. Choose **Connect** on its row in the **Connectors** list:

1. Choose the **Scope**. Only owners and admins see this choice; for members it's always **Only me**.
   - **Shared with the workspace**: the workspace holds one credential. Calls run as that credential, not as the person asking, so everyone who uses the assistant can reach everything the credential can.
   - **Only me**: your own credential. An assistant uses it only when you are the one asking, and sees exactly what you can see.
2. For a shared connection you can add an **Identity label (optional)**, such as "Read-only queries", to tell several shared credentials for the same service apart (one read-only and one read-write, for example).
3. Provide the credential for the connector's authentication:
   - **API token**: enter the **Bearer token** and choose **Submit credential**.
   - **OAuth client credentials**: enter the **Client ID** and **Client secret** and choose **Submit credential**.
   - **Sign in (OAuth)**: choose **Continue to authorize**, sign in on the service's site and approve. You're sent back to Agent Lab afterwards.

If the service supports device codes, you can choose **Connect with a device code** instead. Agent Lab shows a code; choose **Open the provider's page**, enter the code there, then come back and choose **I've authorized — check**.

Credentials are stored encrypted and used only at the moment a tool runs.

Connected accounts are listed under **Connected accounts** with the connector, its **Scope** and its status. A line under the scope says whose permission applies:

- "Acts as each member with a credential that expires." or "Acts as each member with their own key. The key doesn't expire.": each person reaches only what their own account can reach.
- "Acts as the workspace, not the person asking. Everyone who uses it can reach everything it can.": any separation between people has to be set up in the service itself.

## Give an assistant access

A connector in the workspace isn't available to any assistant until you add it to that assistant.

Open the assistant's page and find **Connected systems** in the **Actions (advanced)** step (on a private assistant, the section is **Your connectors**):

1. **Choose the connector** Pick it from **Choose a connector**.
2. **Pick the tools** Under **Tools this assistant may call**, select the tools to allow. You must pick at least one; allow only the ones the assistant actually needs.
3. **Choose the identity** A connector that needs authentication adds an **Identity used** menu, explained below.
4. **Add it** Choose **Add to this assistant**.

**Identity used** decides whose credential the assistant uses:

- **Each member's own credential** (unpinned): when someone asks, the assistant uses the account that person connected with **Only me**. If they haven't connected one, the assistant has none of the connector's tools for them, and the conversation offers to connect their account (see [Authorizing and approving in a conversation](https://agentlab.cresclab.com/docs/en/studio/integrations.md#in-conversation)).
- A pinned shared identity: pick one of the workspace's **Shared with the workspace** credentials, and the assistant uses that one identity for everyone. This is the only way an assistant uses a shared credential. On a private assistant, only owners and admins can pin a shared identity.

Each connector on the assistant lists its identity mode (such as **Each member's own account** or **One shared identity**), a sentence about whose permission applies, and the tools allowed. **Remove** takes it off the assistant.

If nothing can be added, you'll see "No connectors available to add. Register one on the Integrations page, then add it here." For the rest of an assistant's settings, see [Assistants](https://agentlab.cresclab.com/docs/en/studio/assistants.md).

## Authorizing and approving in a conversation

### When you haven't connected your account

If an assistant can use a service you haven't connected, the conversation shows **This assistant can reach a service you have not connected**. Until you connect it, the assistant answers without those tools. How you connect depends on how the service authenticates:

- **A service you connect with a token**: choose **Connect my account**, paste your token into **Your access token** and choose **Authorize**. The conversation carries on with the tools available.
- **Any other service** (such as **Sign in (OAuth)**): the prompt has no token field. It shows **Connect in Integrations** instead, which opens **Integrations** with this connector's connect form open and the scope set to **Only me**. Once connected, come back to the conversation and send your message again.

These services can only be connected from **Integrations**; Agent Lab refuses a token stored for them directly.

### Approving a tool call

Every time an assistant wants to call a connector's tool, it stops and shows **The assistant wants to run an action**, with what it will send and a risk label:

| Label                                        | Meaning                                                            | Who can approve      |
| -------------------------------------------- | ------------------------------------------------------------------ | -------------------- |
| **Read-only**                                | Your workspace vouched for the tool as read-only                   | Any workspace member |
| **Writes to an external system**             | The tool changes data                                              | Owners and admins    |
| **Undeclared risk — treated as destructive** | Not vouched for yet, so Agent Lab treats it as able to change data | Owners and admins    |

Review what it will send, then choose **Approve and run** or **Decline**. A member who can't approve sees only **Decline**, with the note **Only a workspace owner or admin can approve this action. Ask one of them to approve it here, or decline it.** Connector tools never run without a person's approval. For more on conversations, see [Conversations](https://agentlab.cresclab.com/docs/en/studio/conversations.md).

## Disconnect

Find the row under **Connected accounts** and choose **Disconnect**. Members can disconnect only their own **Only me** connections; owners and admins disconnect the ones shared with the workspace. The status changes to **Disconnected**, and assistants can no longer use that credential.

A status of **Sign in again** means the authorization has lapsed. Choose **Connect** on the connector again.

To stop one assistant from using a connector, choose **Remove** under the assistant's **Connected systems**. You don't need to disconnect the workspace's account.

## Troubleshooting

- **"Couldn't add the connector. Check the name and https URL."** Both fields are required, and the address must start with `https://`.
- A probe fails. The server may be unreachable, or the credential may not have enough access. Owners and admins see the server's reason under **Status**.
- Signing in fails. **Sign in (OAuth)** needs a server that supports OAuth dynamic client registration. If yours doesn't, add the connector again with **API token** or **OAuth client credentials**.
- **"The device flow could not be started. The provider may not offer one."** Use **Continue to authorize** instead.
- The assistant doesn't use the connector's tools. Check that the connector is added to this assistant with the tools you need selected. If it isn't pinned, the person asking has to connect their own account with **Only me** first.
- **"This connector's tools are not known yet. Check its health on the Integrations page first."** Choose **Probe** on **Integrations**, and add the connector once its tools appear.