Tools and integrations
An integration is an MCP server your agents use while they work: a mail service, an issue tracker, a database, your own tool. You add it once, for the whole account, and switch it on only where it is needed: for your agent, and for each project. A squad gets what its project enables; a run started by an assignment gets its project’s.
This is the other direction from the connector: the connector lets Claude and ChatGPT use Kedalio; integrations let your agents use other servers.
Everything is in the app, under System → Tools.
Adding a server
Section titled “Adding a server”Add a server asks for:
| Field | What it is |
|---|---|
| Name | Letters, numbers, - and _. It cannot be changed afterwards. kedalio is taken: it is Kedalio’s own connector inside a run. |
| Kind | Remote: Kedalio calls its address itself. Local: a command (and its arguments) that a host runs; it needs a connected host. |
| Address / Command | The URL of a remote server (with no login inside it), or the command of a local one. |
| Headers / Environment | Remote servers take headers, local ones environment variables. Each value is the name of a secret in the vault, never the value itself. |
| Where its data goes | Local, Self-hosted or Third party: see the data rule. |
If the secret a row needs is not in the vault yet, the form links to System → Keys and tokens: add it there first. The vault has no secret of that name, and the form says so.
Signing in
Section titled “Signing in”- A token in a header (remote, or an environment variable for a local server): you paste the token once in the vault, and the server’s row names it.
- OAuth (remote only): most hosted servers speak only this. Save the server with its address, then press Connect. You sign in at the service, and come back; Kedalio is the OAuth client (discovery, registration and PKCE as the MCP specification has them). The tokens are a secret in the vault, as any other: Kedalio renews the access token and hands a current one to every run. Disconnect forgets it, Connect again is what you press when a sign-in has ended and could not be renewed. A sign-in started and not finished in ten minutes must be started again.
OAuth is not a fourth kind of credential: its tokens are vault secrets, written and never read back (Accounts and access).
Test asks the server for its tools: a remote one directly from Kedalio’s server, a local one through a connected host. The row then shows Reachable and how many tools it has, or Failed with the reason, and when it was last tried. The list of tools is kept with the server, so you can set rules tool by tool; test again to refresh it.
Kedalio only calls public addresses when it tests or connects: an address on a private network is refused, unless the server was started with KEDALIO_PROBE_PRIVATE=1 (for an MCP server you run at home), and loopback and link-local addresses are always refused. A secret that appears in an error is cut from it.
Switching it on
Section titled “Switching it on”A server does nothing until it is enabled. Where:
- Your agent: System → My agent → Tools → Servers.
- A project: the project’s Settings → Integrations.
Each server there has a switch («Use …») and a policy, what it may do:
- Ask each time (the default): every tool asks you first.
- Allow all its tools, or Deny all its tools.
- Per tool, once the server has been tested: Ask, Allow or Deny for each one. A server not tested yet says so.
The rules are the run’s delegation, in the same syntax as the rest (mcp__<server> or mcp__<server>__<tool>): they show up as the requests that climb to you, and a deny wins. An agent never widens them.
On System → Tools, each server shows where it is used («the agent», the projects) or «Not used yet». Deleting a server also switches it off everywhere, and so does deleting a project.
The agent’s built-in tools
Section titled “The agent’s built-in tools”Besides the connector, My agent → Tools has two switches for what the agent may do without asking: Web reading (WebFetch) and Web search (WebSearch). Each one writes a delegation line.
The data rule
Section titled “The data rule”Every server has a destination, as every engine account does, and it is checked against the project’s data class when you enable it:
| Destination | Meaning | Which projects may use it |
|---|---|---|
| Local | Stays on your machine | Any |
| Self-hosted | Runs on a server of yours | Any |
| Third party | Someone else’s service | Not a client project |
A client project (the default class) cannot enable a third-party server: the app refuses, and says which class and which server. A personal or public project can. The table that decides it is the one in Engines and costs.
Secrets and runs
Section titled “Secrets and runs”The vault keeps every value: the server’s row holds only names. A run gets a secret only when it needs it, in memory on the host, and what a tool returns that looks like a secret is masked. A local server is started by the host that runs the run. A server that runs on a host as a pinned package (Gitea / Forgejo and Coolify come ready to add, Forgejo with an option that adds its whole API) is reached through the gateway: the host downloads it by its digest, starts it with the secrets in its environment only, keeps it warm a few minutes and cuts every secret out of what it returns; creating one takes your passkey.
Not built yet
Section titled “Not built yet”- A ready-made list of servers to choose from: today you add each one by its address or command.
- A workspace as a built-in tool (a folder per chat on the host).
- Claude Desktop’s and Claude Code’s own settings on your machines: they belong to the desktop app.