Integrations

Native integrations bundle system-provided capabilities—such as tools, agents, or provider adapters—with tenant-scoped credential requirements. The integration catalog tells clients what is available, which credential fields are required, whether the tenant is configured, and whether the last connection test succeeded.

integrations = await client.integrations.list()
weather = next(item for item in integrations if item.id == "openweather")

configured = await client.integrations.configure(
    weather.id,
    credentials={"api_key": api_key},
)
probe = await client.integrations.test(configured.id)
if not probe.ok:
    raise RuntimeError(probe.message)

configure(...) replaces the full required credential set for that integration. Credentials are write-only: list and retrieve responses expose status and field metadata, never plaintext secret values. test(...) performs the provider’s cheapest authenticated probe. Its result is persisted when the tenant has a stored integration record. The catalog exposes three credential_mode values:

Mode	Lifecycle
`external_api_key`	Configure tenant credentials, test them, and remove the tenant override. `install(...)` is rejected.
`managed_key_pair`	Call `install(...)` to converge built-in tools and agent bindings. Snowflake uses this mode and does not accept a generic credential payload.
`managed_oauth_installation`	Use the provider-specific admin and OAuth APIs. Slack uses this mode; generic configure, install, and remove operations are rejected.

The generic remove operation is only for external_api_key integrations. It soft-deletes the tenant credential override; it is not a generic uninstall for native tools or agents. A platform fallback credential may therefore remain active after removal. MCP servers and toolkits are different extension paths: use MCP servers for remote protocol tools and Tools for persisted custom tools or toolkit imports. See SDK: Integrations and the Integrations API reference.

Getting Started

Core Concepts

Guides