Extend Integrations
Extend Integrations
Choose the narrowest provider contract that keeps executable configuration trusted and credentials backend-side.
Decision Guide
| Provider Need | Extension |
|---|---|
| Public hosted MCP with reviewable tools | Managed hosted MCP |
| Organization-operated public HTTPS MCP | Custom remote MCP |
| Pinned server shipped in the agent image | Trusted local STDIO MCP |
| Vendor command with deterministic read/write classification | Trusted CLI integration |
| User consent and incremental scopes | OAuth-backed managed integration |
Do not force a provider into a CLI integration when schema or dry-run output cannot reliably classify effects, or when the provider requires a shared persistent login home. Prefer a managed MCP with trustworthy annotations or defer the integration.
Three Ownership Layers
Git catalog → immutable published catalog → organization installation → run-local capability- Git owns built-in display, setup, grants, auth contract, runtime key, and tool policy.
- PostgreSQL owns organization connection state, encrypted credentials, selected tools, access mode, and retirement state.
- Shared types own the small trusted runtime registry.
- The backend owns credential resolution and provider gateways.
- The agent receives only execution-scoped gateway configuration.
Non-negotiable Rules
- Never accept a command, package, path, or arbitrary environment from the database.
- Never place credentials in URLs, manifests, prompts, workspaces, or logs.
- Missing read-only annotations fail closed.
- Newly discovered tools are not automatically approved.
- Consequential chat actions are blocked.
- Consequential task actions use the durable action lifecycle.
- An uncertain provider result is reconciled, not retried.