Connectors

Connectors let agents reach other services; this page covers how they work and the controls admins hold over them.

How people use a connector in a task, an agent or an applet is on Connect your apps. Where each connector control sits among the layers is on Enterprise controls.

How connectors work

• One connector service, built by Context, runs in your cluster and updates with each release.
• A connector is a remote MCP server or an HTTP API that an admin adds. Agents call its tools as MCP tools.
• Data is fetched live on each call, not copied or indexed. Results are capped at 50 MB.
• Box file sync is the exception: it copies files into a workspace, and is off unless enabled.
• Composio-backed integrations are optional and need their own install setting. Without them, every connector call runs through Context’s connector service inside your cluster.

Turn connectors on for the install

Connectors stay off until the install admin turns them on, with Enable MCP Connectors in the Admin Console (default off).

Credentials

Sign-in is one of two kinds:

Kind	Who sets it	Whose access a call uses
OAuth per person	Each person signs in	Calls act with that person’s access
API key	An admin sets it for an agent, a workspace or the organization	The key’s access

OAuth asks for basic identity by default; the admin adds the scopes the service needs.

Tokens and keys are stored in your database, encrypted (AES-256-GCM). The encryption key is generated inside your cluster at install. The agent holds no connector token or key: the connector service gets the credential from the Context server for each call only.

Enable a connector for workspaces

A connector installed for the organization starts available to everyone in it (Everyone in the organization). An organization admin can narrow who can use it, in Settings > Admin > Connectors (or Manage connectors):

Choice	What it means
Everyone in the organization	Every workspace can use this connector, including ones created later.
Specific workspaces	Only the workspaces you pick can use it. Everything else has no access. Picking none keeps it off.
Just me	A private connector only you can use; no workspace gets it.

Use Install connector to add a custom one.

Turn a connector off for the organization

An organization admin can switch any connector off for the whole organization in Settings > Admin > Connectors. Each change is audited.

1. Turn the connector’s switch off.
2. Confirm with Turn off. The dialog explains: “It disappears for everyone in your organization and agents stop using it. Connections people already made are kept, so turning it back on restores them.”

Off only narrows: this switch cannot make a connector reach further than the install allows.

Destinations

The install admin sets connector destinations in the Admin Console: public services only (Public only, the default), or public plus an allowlist of approved private hosts (Public plus allowlist). Cloud metadata addresses are always blocked, whatever the mode.

Public plus allowlist is offered when Connector Deployment Boundary is Customer VPC; a Public internet / Prosumer boundary is always public only. Every connector setting, with its options and default, is in Security configuration reference.

Audit

The audit log records:

• credentials added or rotated
• connections added, changed, paused or revoked
• each organization-wide connector switch change

Agent tool calls are also recorded in the agent action log. See Audit log.

Request path

Every connector call takes the same path:

Step	What it does	Detail
Agent	Sees each connector’s tools as MCP tools	Holds no connector token or key.
Context server	Checks the agent and the call	Confirms which agent and person is calling, applies policy, and issues a short-lived session token.
Connector service	Built by Context; one service	Gets the credential from the server for this call only. Applies the destination rules.
Your database	Tokens and keys, encrypted (AES-256-GCM)	The encryption key is generated inside your cluster at install.
Connected service	Public, or an approved private host	Fetched live on each call, with the signed-in account’s access.

The agent, Context server, connector service and database all run inside your cluster; the connected service is outside it.

flowchart TD
  subgraph cluster["Your cluster"]
    A["Agent: sees connector tools as MCP tools"] --> S["Context server: checks the agent and the call"]
    S --> C["Connector service: gets the credential for this call, applies destination rules"]
    D[("Your database: tokens and keys, AES-256-GCM")] -.-> S
  end
  C --> X["Connected service: public, or an approved private host"]