SaaS app connectors

Reference for the connector packages that link Console to SaaS and public web services: sign-in methods, what to create on the vendor side, and the actions each one gives agents.

Enterprise module

Connectors are an enterprise module. Install a package from Build → Connectors, create a connector from it and connect one organisation account (see Install packages and Create and connect).

Databases, object storage and email have their own pages: Database connectors, Object storage connectors and Email (SMTP) connector.

Every connector has a Setup guide in Console with the step-by-step vendor screens, exact for the sign-in method you pick. This page tells you what to prepare and what you get.

How access is marked

Each action is marked read, write or destructive. Whether a tool asks for approval is decided on the agent, not on the connector: read tools run, everything else asks by default, and the agent owner can set a tool to Never ask. See Tools and approvals and which tools ask.

Most packages with write actions have a Read only setting, on by default. While it is on, the write actions are not offered. For OAuth sign-in, Read only also decides which method is shown: a read-only method asks the vendor for read scopes only, and a read and write method adds the write scopes. After you change Read only, connect again with the other method.

OAuth apps

OAuth sign-in uses an OAuth app. In most packages you register your own app at the vendor and enter its client ID and secret in Console (an admin can add them under OAuth apps). The callback URL to register is shown on the connect screen. Change it at the vendor if your Console address changes. The signed-in person's own permissions at the vendor always apply on top of the scopes.

The GitHub packages are the exception on Cognipeer's cloud (SaaS): the GitHub.com sign-in can use an app provided by the deployment. On-prem you register your own.

Overview

App	Sign-in methods	Read	Write	Destructive
AccuWeather	API key	9	0	0
Asana	Personal access token; OAuth (read only, read and write)	7	4	0
Bitbucket	Email and API token; Access token; HTTP access token; OAuth (read only, read and write)	9	3	0
Calendly	Personal access token; OAuth (read only, read and write)	9	1	1
Confluence	API token; Personal access token; OAuth (read only, read and write)	6	3	0
Earthquakes	Public access (no sign-in)	6	0	0
GitHub	Personal access token; OAuth (GitHub.com, or your organization's OAuth app)	15	7	1
GitHub MCP	Personal access token; OAuth	GitHub's own tool list
Grafana	Service account token	7	1	1
Jira	Email and API token; Personal access token; OAuth (read only, read and write)	6	5	0
MediaWiki	Public access (no sign-in); Access token	3	0	0
monday.com	Personal API token; OAuth (read only, read and write)	6	4	0
Notion	Integration secret; OAuth	6	4	0
Pexels	API key	9	0	0
Trello	API key and token; OAuth 2.0 (read only, read and write)	5	4	0
WeatherAPI.com	API key	9	0	0
YouTube	API key (public data); Google sign-in (read only, or with captions)	9	0	0

AccuWeather

Weather for agents from AccuWeather's Core Weather API: places, current conditions, forecasts, warnings and lifestyle indices.

Sign-in. API key from a Core Weather subscription on the AccuWeather developer portal. The free plan is a 14-day trial with 500 calls a day, so plan for a paid plan. A 403 means the key is valid but the plan does not include that data. Check the plan's terms before you connect it to an organization.

Settings. Language (a code such as en-us or tr-tr, default en-us) and Metric units (on by default).

Actions.

• Read: search_locations, autocomplete_locations, locate_by_coordinates, get_current_conditions, get_conditions_history, get_hourly_forecast, get_daily_forecast, get_daily_indices, get_alerts.

Every tool call is one API call of your plan. Weather for a place usually takes two: find the location key, then ask for the forecast.

Asana

Projects, tasks and comments in Asana.

Sign-in.

• Personal access token: acts as one Asana user. Create it for a dedicated user with a full or guest seat, added to the projects the agents use. On an Enterprise plan a super admin can create a service account token instead.
• Asana sign-in, read only (OAuth) and Asana sign-in, read and write (OAuth): register an app in the Asana developer console, add the callback URL, and select the scopes. Read only: workspaces:read, projects:read, tasks:read, stories:read, users:read. Read and write adds tasks:write and stories:write. Do not use the full permissions option.

Actions.

• Read: list_workspaces, list_projects, get_project, list_tasks, get_task, search_tasks, list_users.
• Write: create_task, update_task, move_task_to_section, add_comment.

Asana limits requests per token (150 a minute on a free plan, 1,500 on a paid one), and agents that share one connection share that limit.

Bitbucket

Repositories, branches, commits and pull requests on Bitbucket Cloud or Bitbucket Data Center / Server, and repository files as a knowledge source.

Settings. Bitbucket edition (Bitbucket Cloud or Bitbucket Data Center / Server (your own servers)), Workspace (optional), Server address (Data Center only, with its context path if it has one), Read only.

Sign-in and what to create.

Method	Edition	Create
Email and API token	Cloud	An Atlassian API token with scopes for a dedicated bot account. Read: read:user:bitbucket, read:workspace:bitbucket, read:project:bitbucket, read:repository:bitbucket, read:pullrequest:bitbucket. Write also: write:repository:bitbucket, write:pullrequest:bitbucket.
Access token (repository, project or workspace)	Cloud	Repository access tokens work on every plan; project and workspace tokens need a plan that offers them. Read: Repositories Read, Pull requests Read (project and workspace tokens also Projects Read). Write also: Repositories Write, Pull requests Write.
HTTP access token	Data Center	Read: Project Read, Repository Read. Write: Project Read, Repository Write.
Bitbucket sign-in, read only / read and write (OAuth)	Cloud	An OAuth consumer. Read only scopes: account, repository, pullrequest, project. Read and write adds repository:write and pullrequest:write.

Actions.

• Read: list_workspaces, list_repositories, get_repository, list_branches, list_commits, get_file, search_code, list_pull_requests, get_pull_request.
• Write: create_branch, create_pull_request, add_pull_request_comment.

The connector never merges pull requests. The Repository files source syncs files into a knowledge base; it carries no per-file permissions, so everyone who can use the knowledge base can read everything synced.

Calendly

Event types, scheduled events and availability in Calendly.

Sign-in.

• Personal access token: select users:read, organizations:read, event_types:read, scheduled_events:read, availability:read, routing_forms:read. For the write tools also scheduled_events:write and scheduling_links:write.
• Calendly sign-in, read only / read and write (OAuth): create an application at developer.calendly.com with the same scopes. A production application needs an HTTPS redirect URI.

Actions.

• Read: get_current_user, list_event_types, list_scheduled_events, get_scheduled_event, list_event_invitees, list_organization_members, list_availability_schedules, get_user_busy_times, list_routing_forms.
• Write: create_scheduling_link.
• Destructive: cancel_scheduled_event.

Calendly allows 50 API requests a minute per user on the free plan and 500 on paid plans.

Confluence

Spaces, pages, comments and search on Confluence Cloud or Data Center, and pages as a knowledge source.

Settings. Confluence type (Confluence Cloud or Confluence Data Center / Server), Site address (Cloud), Base address (Data Center, with its context path if it has one), API token type (Scoped or Classic, Cloud), Read only.

Sign-in and what to create.

• API token (email and token), Cloud: create the token for a dedicated account or service account. A scoped token needs read:space:confluence, read:page:confluence, read:attachment:confluence, read:comment:confluence, read:content-details:confluence and search:confluence. For writing add write:page:confluence and write:comment:confluence. A scoped token and a classic one are used through different addresses, so set API token type to match.
• OAuth 2.0, read only / read and write (your own Atlassian app), Cloud: create an OAuth 2.0 (3LO) app with the same scopes and the callback URL. OAuth traffic counts against Atlassian's hourly quota, so use an API token for a very large first sync.
• Personal access token, Data Center: create it for a dedicated user. Data Center tokens have no scopes. The token can do whatever its user can.

Actions.

• Read: search, list_spaces, list_pages, get_page, get_page_comments, list_attachments.
• Write: create_page, update_page, add_comment.

The Confluence pages source carries no permissions. Use a separate knowledge base for each audience.

Earthquakes

Earthquake data from Turkey's AFAD event service, with an optional Kandilli list.

Sign-in. Public access (no sign-in). Nothing to create.

Settings. Contact (optional; an email or web address added to the User-Agent) and Kandilli list address (HTTPS relay) (optional, advanced). The Kandilli tool is off until you give an HTTPS address that returns the Kandilli page unchanged, because the Observatory answers only over plain HTTP.

Actions.

• Read: list_recent_earthquakes, search_earthquakes, get_earthquake, nearby_earthquakes, largest_earthquakes, and list_kandilli_earthquakes (when the Kandilli address is set).

AFAD holds only its latest 1000 events (a window of days to weeks), so older earthquakes are not available. Name AFAD as the source when you show the data.

GitHub

Repositories, issues, pull requests and code on GitHub.com, GitHub Enterprise Cloud with data residency (GHE.com) and GitHub Enterprise Server, and repository files as a knowledge source.

Settings. GitHub host (GitHub.com, GitHub Enterprise Cloud with data residency (GHE.com), GitHub Enterprise Server (self-hosted)), GHE.com subdomain, Server URL (Enterprise Server), Read only.

Sign-in and what to create.

• Personal access token: classic with repo and read:org, or fine-grained with the repository permissions you need. A fine-grained token reaches only the repositories you select. Create it for a dedicated account.
• Sign in with GitHub (OAuth): GitHub.com. Console asks for the repo and read:org scopes. On-prem, register an OAuth app (Settings → Developer settings → OAuth Apps) with Console's callback URL.
• Sign in with your organization's OAuth app: GHE.com and Enterprise Server. Register the OAuth app on your own installation.

Actions.

• Read: list_repos, get_repo, list_branches, get_branch, list_commits, get_commit, compare_commits, get_file_content, search_code, list_issues, get_issue, search_issues, list_pull_requests, get_pull_request, list_pull_request_files.
• Write: create_issue, update_issue, comment_on_issue, comment_on_pr, create_pull_request, create_or_update_file, create_status_check.
• Destructive: merge_pull_request.

The Repository files source carries no per-file permissions.

GitHub MCP

GitHub's official remote MCP server as agent tools. GitHub maintains the tool list, and this package has no actions or sources of its own. For Console's own GitHub tools and for repository files in a knowledge base, use the GitHub connector.

Settings. GitHub host (GitHub.com or GHE.com; GitHub Enterprise Server has no remote MCP server and is not offered), GHE.com subdomain, MCP toolsets (default context, repos, issues, pull_requests, users), Read only (on by default; the server then hides every tool that changes something).

Sign-in. Personal access token (classic or fine-grained), Sign in with GitHub (OAuth) (scopes repo, read:org) or Sign in with your organization's OAuth app (GHE.com).

Console sorts each MCP tool into read, write or destructive by name. A tool it does not know counts as destructive until the connector is updated. More toolsets add more tools to the model's context, so enable only what an agent needs.

Grafana

Dashboards, data sources, alerts and annotations in Grafana Cloud or a self-managed Grafana.

Settings. Grafana edition (Grafana Cloud or Self-managed Grafana), Stack address (Cloud), Server address (self-managed), Read only.

Sign-in. Service account token, the only method. Create a service account in the organization the agents should use. Choose Viewer for read only, or Editor to also add annotations or create silences. A service account and its token work in one organization only.

Actions.

• Read: search_dashboards, get_dashboard, list_datasources, query_datasource, list_alert_rules, list_firing_alerts, list_annotations.
• Write: create_annotation.
• Destructive: create_silence. It requires a comment, limits the duration to 7 days, and refuses a matcher set without an exact matcher.

Delete is not offered for anything.

Jira

Issues, projects and transitions in Jira Cloud or Jira Data Center / Server.

Settings. Jira edition (Jira Cloud or Jira Data Center / Server (self-hosted)), Site address (Cloud), Server address (Data Center), Read only.

Sign-in and what to create.

• Email and API token, Cloud: create the token for a dedicated user with a Jira license and the project roles it needs. Browse projects for reading; for writing also Create issues, Edit issues, Transition issues, Assign issues and Add comments. A scoped token works with read:jira-work and read:jira-user, and write:jira-work for writing.
• Atlassian sign-in, read only / read and write (OAuth), Cloud: create an OAuth 2.0 (3LO) app with Jira API scopes read:jira-work, read:jira-user and, for read and write, write:jira-work.
• Personal access token, Data Center: create it for a dedicated user with the project roles above.

Actions.

• Read: search_issues, get_issue, list_projects, get_project, list_transitions, find_users.
• Write: create_issue, update_issue, transition_issue, assign_issue, add_comment.

MediaWiki

Search and read pages of Wikipedia, other Wikimedia projects or your own MediaWiki site, and wiki pages as a knowledge source.

Settings. Site address, API path (advanced; /w/api.php by default, often /api.php on a wiki at the web root), Contact (optional).

Sign-in. Public access (no sign-in) for wikis anyone can read, or Access token (private wiki): create an owner-only consumer on the wiki, which needs no review and no callback address.

Actions.

• Read: search_pages, get_page, list_category_members.

monday.com

Boards, items and updates in monday.com.

Sign-in.

• Personal API token: monday tokens have no scopes. The token can read and change whatever its user can, so create it for a dedicated user added only to the workspaces and boards the agents use.
• monday sign-in, read only / read and write (OAuth): create an app with the redirect URL and the scopes me:read, account:read, boards:read, users:read, workspaces:read, updates:read. Read and write adds boards:write and updates:write.

Actions.

• Read: list_boards, get_board, list_items, get_item, search_items, list_users.
• Write: create_item, change_column_values, move_item_to_group, create_update.

monday limits API calls per account: 1,000 a day on Free, Standard and Basic plans, 10,000 on Pro and 25,000 on Enterprise.

Notion

Pages, databases and comments in Notion.

Sign-in.

• Integration secret (internal integration): a workspace owner creates an internal connection in the Notion developer portal. Enable Read content, plus Read comments and User information if needed. Only to write, also enable Update content, Insert content and Insert comments. Then share the pages and databases with the integration. It sees nothing else.
• Notion sign-in (OAuth, your own public integration): Cognipeer provides no Notion OAuth app. Create a public connection in your Notion developer portal, add the redirect URI, and enter its client ID and secret. Sign in with a dedicated bot user. On the consent screen that person chooses which pages the integration may use.

Actions.

• Read: search, get_page, get_database_schema, query_data_source, list_comments, list_users.
• Write: create_page, update_page, append_blocks, add_comment.

Pexels

Search and fetch free photos and videos from Pexels.

Sign-in. API key from your free Pexels account at www.pexels.com/api. By default a key may make 200 requests an hour and 20,000 a month, and every tool call is one request.

Settings. Search language.

Actions.

• Read: search_photos, get_photo, curated_photos, search_videos, get_video, popular_videos, featured_collections, my_collections, get_collection_media.

Trello

Boards, lists and cards in Trello.

Sign-in.

• API key and token: Trello has no organization-wide service account, so create a dedicated member, add it to the boards the agents use, create a Power-Up to get an API key, and authorize a token while signed in as that member with scope read (or read,write to write).
• Trello sign-in, read only / read and write (OAuth 2.0): create an OAuth 2.0 app with the callback URL and the scopes read:board:trello, read:member:trello, and write:board:trello for read and write. Console asks for offline_access itself.

Actions.

• Read: list_boards, get_board, list_cards, get_card, search_cards.
• Write: create_card, update_card, add_comment, add_checklist_item.

WeatherAPI.com

Weather, forecasts, history, astronomy, marine data and alerts from WeatherAPI.com.

Sign-in. API key from a WeatherAPI.com account. The free plan allows 100,000 calls a month. A plan error (HTTP 403, code 2009) means the plan lacks the data, for example history older than a day or a forecast longer than 3 days. Results carry source: WeatherAPI.com; show that name to whoever reads the answer.

Settings. Language and Units (Metric (Celsius, km/h, mm) or Imperial (Fahrenheit, mph, inches)).

Actions.

• Read: search_locations, get_current_weather, get_forecast, get_history, get_future, get_astronomy, get_marine, get_timezone, get_alerts.

YouTube

Search and read public YouTube data, and caption text for videos you manage.

Sign-in.

• API key (public data): enable YouTube Data API v3 in a Google Cloud project and create a key. Quota is shared by every tool: 10,000 units a day for everything except search, and 100 search calls a day in a separate allowance. It resets at midnight Pacific Time, and when it is used up every tool fails until then.
• Google sign-in, read only (OAuth): create your own OAuth client with the youtube.readonly permission. It also reads the private data of the signed-in account.
• Google sign-in with captions (OAuth): the same client with youtube.force-ssl added. Google names this permission for captions, and it also allows editing YouTube data, but this connector never writes. download_caption also needs edit rights on the video: the signed-in account must own or manage the channel.

Actions.

• Read: search_youtube, get_video, get_channel, list_channel_uploads, get_playlist, list_playlist_items, list_comment_threads, list_captions, download_caption.

Network and limits

These packages call the vendor's public API over https. On Cognipeer's cloud (SaaS), Console reaches public addresses only. Self-hosted products (Bitbucket Data Center, Confluence Data Center, Jira Data Center, GitHub Enterprise Server, self-managed Grafana and your own MediaWiki) need an address Console can reach. An on-prem Console can reach private addresses, and its operator can narrow the allowed private ranges with CONNECTOR_EGRESS_PRIVATE_CIDRS. See Security and limits and Troubleshooting.