Integrations
There is no catalogue of supported apps, because that is the wrong shape. If your software has an API, a database or an MCP server, it is supported.
Model Context Protocol
MCP server
Point at an MCP endpoint and its tools are imported with their schemas intact. Streamable HTTP and SSE transports.
- ✓Tools, resources and prompts
- ✓JSON-RPC 2.0
- ✓Schemas used as-is
OpenAPI or by hand
REST API
Give it an OpenAPI document and every operation becomes a tool. No document? Describe the endpoints and it compiles them the same way.
- ✓OpenAPI 3.x parsing
- ✓API key, bearer, basic auth
- ✓Per-tool timeouts and rate limits
PostgreSQL and MySQL
Database
Schema introspection turns tables and relationships into read, analytics and mutation tools, each with structural query validation — and writes respect the conventions your schema already keeps.
- ✓Auto-discovered relationships
- ✓created_at and updated_at maintained
- ✓Soft-delete columns marked, not bypassed
- ✓Row and time limits enforced
- ✓No DDL, ever
Connect it, and this is what you get
Discovery reads what is actually there — tables, columns, relationships, endpoints, MCP tools — and turns each capability into a tool with its own schema, operation type and risk level.
The operation type is not cosmetic. It is what decides whether a call runs straight through, or stops and waits for a person.
discovery · MySQL
ready- list_customers READ
- get_order READ
- sales_report ANALYTICS
- create_customer CREATE
- update_order UPDATE
- delete_customer DELETE
Writes appear only if you enabled them on the connection, and destructive ones require approval until you say otherwise.
Two that need no connecting
These are the platform itself rather than something you own, so there is no host, no key, and nothing that can fall out of sync.
The platform itself
Built-in toolkit
Today’s date, date arithmetic, a sum worked out properly, a reference code — and sending email. The pure functions exist because a model cannot know the date, and because its arithmetic is wrong in the worst possible way: confidently.
- ✓Recipient domains allow-listed, empty by default
- ✓A cap on recipients per message
- ✓Sending needs approval unless you relax it
Your agents, to each other
Agent delegation
Each agent becomes a tool the others can call, so a generalist can hand a billing question to the agent that knows billing rather than being given every billing tool itself.
- ✓A delegated run is a full run, with its own approvals
- ✓Depth limit, and a loop cannot form
- ✓Choose who may call whom, per agent
delegation
“Refund order 4471 and tell the customer when it lands.”
- its own execution, its own trace
- its own approval gates
- cannot reach what it could not reach alone
The caller waits for an answer. If the billing agent needs a person, the caller is told that rather than left hanging.
Agents that hand work over
A generalist does not need every billing tool. It needs to know who does. Each hop is a complete run with its own checks, so nothing is relaxed because the caller happened to be an agent rather than a person.
Everything becomes the same thing
Whatever the source, a discovered capability is normalised into one shape — which is what lets a single set of safety checks cover all of them. Adding a connector adds no new security surface.
Name and description
What the model reads.
Input schema
The contract for arguments, enforced before execution.
Operation type
Read, analytics, create, update, delete, execute or export.
Risk level
A floor set by the operation. An operator can raise it, never lower it.
Nothing to connect yet?
There is a built-in demo connection: a sample commerce back office with customers, orders, products and payments. It behaves exactly as a real connection does — real discovery, real tools, real approval gates — so you can see the whole product work before wiring up anything of your own.
Where people talk to it
Web chat, Telegram, Slack and WhatsApp. Each routes through the same runtime rather than around it, which is what keeps policy, permissions and audit identical no matter where a message arrives from — a destructive request from WhatsApp stops for approval exactly as one typed in the dashboard does.
Email, a browser extension and a desktop agent are designed but not yet built. They are listed here as plans rather than features, because a page that cannot tell the difference is not worth reading.
Connect something and see what it builds.
Free plan available. No credit card required.
Create your AI agent