Build access. Keep control.

Your first working server

1. Create an account, confirm your email, sign in and name your workspace.
2. Add a JSON connector called “Sample product catalog”. Keep the fictional records or replace them with your own non-sensitive sample data.
3. Open Tool builder. Select the connector and name the tool lookup_inventory. Add a string parameter sku.
4. Save, then run the tool with {"sku":"SL-1001"} in the playground.
5. Publish a server. Paste its URL into Claude or ChatGPT as a custom connector and approve access, or use the one-time bearer key in your own agent.

Connectors

REST and enterprise APIs

The deployment operator adds exact hostnames to MCP_ALLOWED_HOSTS, including identity provider hosts such as login.microsoftonline.com for client credentials. Credentials live in the workspace credential vault; connectors store secret names only. OAuth access tokens obtained with client credentials are cached in memory until shortly before they expire.

Paths can contain placeholders such as /v1/orders/{orderId}. Placeholders must be required parameters; values are URL-encoded and single quotes are doubled for OData literals. Tools support GET, POST, PUT, PATCH and DELETE; every method except GET requires approval. Remaining GET and DELETE arguments become query parameters; other methods send a JSON body, either flat or shaped by a body template with {{argument}} placeholders. Requests have a 12-second timeout and a 512 KB response limit. Redirects, IP literals and unapproved hosts are blocked.

PostgreSQL

Each tool holds one SQL statement with named parameters, for example SELECT id, status FROM orders WHERE id = :orderId. Parameters are bound, never concatenated. Reads must start with SELECT or WITH and run in a read-only transaction with a 10-second statement timeout and a row limit. Writes (INSERT, UPDATE, DELETE) always require approval. Multiple statements, comments, DDL, permission statements and pg_* functions are rejected. Use a dedicated least-privilege database role.

Credential vault

Each workspace has its own vault. Owners and admins store API tokens, client secrets and database URLs in Settings; values are encrypted with AES-256-GCM using MCP_VAULT_KEY and bound to the workspace and secret name, so a copied ciphertext cannot be used elsewhere. Values are write-only: the dashboard and API never return them.

Connectors resolve secrets from the workspace vault first. Deployment variables are reachable only when listed in MCP_SHARED_SECRETS; platform variables such as DATABASE_URL can never be referenced by a connector.

Microsoft 365

1. An owner or admin chooses Add connector → Microsoft 365 and continues with Microsoft.
2. A Microsoft 365 administrator signs in. The tenant is taken from the identity token Microsoft returns to the server, never from browser parameters.
3. The administrator grants consent to the application permissions.
4. Add tools from the connector card: directory lookup, Outlook search and send, calendar read and create, OneDrive and SharePoint search, SharePoint lists, Teams and channels.

Application permissions apply to the whole tenant. Restrict mailbox access with an Exchange application access policy or RBAC for Applications. Reading Teams messages is a Microsoft protected API and is not included.

OpenAPI import

Choose a REST connector, paste or upload an OpenAPI 3.x or Swagger 2.0 specification (JSON or YAML, up to 3 MB) or load it from an approved URL. The analysis resolves local references, maps path, query and JSON body parameters, flattens nested bodies into arguments with a body template, and renames parameters such as page-size to page_size while sending the original name upstream.

Operations that need custom headers, non-JSON bodies, required arrays or deeply nested objects are listed as skipped with the reason. Reads are preselected; writes are imported only when selected and always require approval. Up to 100 tools per import; every tool remains a draft until published.

Compose an explicit operation

The visual canvas represents the execution pipeline: source → operation → privacy → governance → MCP server. Select each node to configure it. Inputs support string, number and boolean parameters with required-field validation; unknown arguments are rejected.

Human approvals

Every write requires approval; reads can require it too. Approval freezes the tool configuration and arguments, and a successful claim executes that request at most once. Requests expire after 24 hours. Failed upstream operations are not retried automatically.

A gated MCP call returns an approvalId. Servers with gated tools also expose get_approval_status, which returns the status and, once approved, the result. Lookups are scoped to the server that created the request.

Personal data masking

Responses are masked before they reach the model. Detection covers e-mail addresses (partially masked), international and Romanian phone numbers, IBANs with checksum validation, payment cards with Luhn validation, Romanian CNP with checksum validation, IPv4 addresses, and fields named like e-mail, phone, IBAN, CNP, passport or date of birth. Secret-like fields are always redacted.

Masking is on by default for every tool. Only owners and admins can disable it; the change is recorded in the audit log. Pattern-based masking reduces exposure but does not replace a data protection impact assessment.

Roles and single sign-on

Invite members by e-mail in Settings. They join when they sign in with the same verified address. Separation of duties: when another reviewer exists, nobody can approve a request they initiated.

Company SSO uses Supabase SAML. Configure the identity provider in Supabase (paid plan feature), then set AUTH_SSO_ENABLED=true. Users choose “Continue with company SSO” and enter their work e-mail; the domain selects the identity provider.

Connect AI clients

Every server URL, /api/mcp/{serverId}, is an OAuth 2.1 protected resource. Clients that implement MCP authorization discover it automatically: an unauthenticated request returns 401 with a resource_metadata pointer, the client registers itself dynamically, and an owner or admin approves access on the consent screen. Access tokens last one hour and refresh tokens rotate on every use.

1. Publish a server and copy its URL.
2. Add it as a custom remote MCP connector in your AI client (for example Claude or ChatGPT).
3. Sign in, choose the server and select Allow access.
4. Revoke OAuth grants at any time from the MCP servers page. Rotating the key also revokes them.

GET /.well-known/oauth-protected-resource/api/mcp/<server-id>
GET /.well-known/oauth-authorization-server
POST /api/oauth/register      (RFC 7591 dynamic client registration)
GET  /oauth/authorize         (PKCE S256 required)
POST /api/oauth/token         (authorization_code, refresh_token)
POST /api/oauth/revoke        (RFC 7009)

Custom agents can use the one-time bearer key instead: send Authorization: Bearer mcp_….

Protocol reference

Stateless Streamable HTTP with JSON responses: initialize, ping, tools/list and tools/call for protocol versions 2025-03-26, 2025-06-18 and 2025-11-25. SSE streams, resources and prompts are not implemented. GET returns 405.

POST /api/mcp/<server-id>
Authorization: Bearer <access-token-or-key>
Content-Type: application/json

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "initialize",
  "params": {
    "protocolVersion": "2025-11-25",
    "capabilities": {},
    "clientInfo": {"name": "your-agent", "version": "1.0.0"}
  }
}

{ "jsonrpc": "2.0", "id": 2, "method": "tools/list" }

{
  "jsonrpc": "2.0", "id": 3, "method": "tools/call",
  "params": { "name": "lookup_inventory", "arguments": { "sku": "SL-1001" } }
}

Security boundaries

• Supabase Auth validates sessions with getUser(). Every dashboard action is authorized against the member’s role in the selected workspace.
• Server keys, OAuth codes and tokens use 256 bits of entropy; only SHA-256 hashes are stored. Upstream credentials stay in runtime secrets.
• Cross-origin dashboard writes are rejected. Redirects cannot bypass the outbound hostname lists.
• Operational events record the acting user or agent. The dashboard and export show the latest 200.
• No certification is claimed. Functions run in Frankfurt (fra1); use an EU database region for full EU data residency.

Deployment

NEXT_PUBLIC_SUPABASE_URL=<project-url>
NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY=<publishable-key>
DATABASE_URL=<transaction-pooler-postgresql-url>
NEXT_PUBLIC_APP_URL=https://<production-domain>
MCP_ALLOWED_HOSTS=api.your-company.example,login.microsoftonline.com,graph.microsoft.com
MCP_ALLOWED_DB_HOSTS=db.your-company.example
AUTH_SSO_ENABLED=false
MCP_VAULT_KEY=<32-byte-base64-key-from-setup-page>
MS365_CLIENT_ID=<entra-application-id>
MS365_CLIENT_SECRET=<entra-client-secret>
MCP_SHARED_SECRETS=

Never commit secret values. Migrations in db/migrations create a private mcp schema and revoke browser-role access. They are not run during a Vercel build.

Release scope

Supported: roles and invitations, SSO, OAuth 2.1 for MCP clients, PostgreSQL and enterprise REST connectors, personal data masking, approval outcomes for agents, tool snapshots, pause, rotation and audit export.

Planned: native SQL Server and Oracle adapters, billing, usage quotas, SSE and resources, chained workflows, observability integrations and ISO 27001 certification.