Connections overview

Connections are MCP apps Brain can call during a chat turn. Manage them on /tools or from the composer Integrations menu.

Credentials and grants are per signed-in user × active workspace. Enabling a tool for one chat does not share another user’s tokens. Brain calls the live API at request time — it does not copy Slack, ClickUp, or warehouse tables into a local search index. See Architecture.

Auth modes

Mode	Apps	What you do
Dynamic client registration (DCR)	ClickUp, Notion, Linear, Atlassian, Zernio, Sentry, dFlow	Click Connect — no client id/secret required
Static OAuth app	Slack, Asana, Gmail, GitHub	Workspace/instance admin Set up client id/secret, then each user Connect
PAT	Snowflake	Admin Set up MCP URL + programmatic access token
HTTP MCP URL	MongoDB, MCP Toolbox, Rybbit, Bytebot	Admin Set up Streamable HTTP URL (+ bearer; required for Rybbit)

Members without configure rights see a message that a workspace admin must set the app up first.

Typical flow

Open /tools (or composer Integrations → Manage tools)
For static OAuth / PAT / HTTP apps: Set up (workspace or host credentials)
Connect when the app needs your sign-in
Toggle the app on for the current chat
Use Agent mode and ask the agent to use that app

Write tools may prompt for approval mid-turn before executing.

Mid-turn authorization

If a turn needs OAuth and you are not signed in, Brain surfaces an authorize URL in the stream. Complete sign-in in the browser, then continue the chat.

Credential scopes

Static OAuth / PAT / HTTP apps can store secrets at workspace, host, or env scope. See BYOA credentials.

Persist tokens on the host

Menu Connect stores tokens under .eve/ on the host. Persist that directory across deploys so users are not forced to reconnect after every restart.