Connectors catalog
Use this catalog to choose a connector and check its provider-side requirements. Verified connectors connect to upstream MCP servers. Configured built-in connectors provide Tailnet and Tailscale SSH tools. The aperture system connector needs no configuration and is separate from both.
Verified connectors registry
Aperture's verified connectors provide pre-configured defaults in the Add connector menu. The following catalog lists public providers, their defaults, and provider-side prerequisites. To configure one, follow Add a verified connector.
Verified connectors use one of two authentication types. Both require each user to authorize access:
oauth2_dcr: Aperture discovers the authorization server and uses dynamic client registration to register an OAuth client. You do not create an OAuth app or enter client credentials. Provider-side access controls and approvals still apply.oauth2_authorization_code: Register an OAuth app with the provider, add Aperture's callback URL, and supply a client ID and a client secret if required. Providers with a pre-registered Aperture OAuth client can skip this manual credential setup.
QuickSetup means Aperture can configure a connector without asking you for OAuth client credentials. DCR providers support it through automatic registration. Some oauth2_authorization_code providers, such as Gmail, Google Calendar, and Google Drive, support it through an OAuth client that Aperture pre-registers. The QuickSetup column identifies these providers. QuickSetup does not bypass provider prerequisites, connector grants, or per-user consent.
For OAuth callback selection and authorization behavior, refer to Connector authentication. Authorization-code defaults can include auth_url and token_url. DCR discovers these URLs rather than defining them in the registry.
In the table, Discovered means the registry does not specify default scopes. For the Google Workspace rows, prefix each scope with https://www.googleapis.com/auth/. Their Google Cloud app setup requirements apply only when you supply your own OAuth client.
| Provider ID | Protocol | Auth type | QuickSetup | Default endpoint URL | Default scopes and parameters | Provider-side setup and requirements | Upstream documentation |
|---|---|---|---|---|---|---|---|
Salesforce | MCP | oauth2_authorization_code | No | https://api.salesforce.com/platform/mcp/v1/platform/sobject-all | mcp_api, refresh_token | In Setup > External Client App Manager, create an app with OAuth enabled. Add the callback URL and scopes, enable JWT-based access tokens and PKCE, and copy the Consumer Key as the client ID. Enable SObject-All under API Catalog > MCP Servers. | Salesforce setup |
Atlassian | MCP | oauth2_dcr | Yes (DCR) | https://mcp.atlassian.com/v1/mcp/authv2 | Discovered | In Atlassian Administration > Rovo > MCP server settings, allow Atlassian-supported domains or add your Aperture gateway's hostname. | Atlassian MCP settings |
Slack | MCP | oauth2_authorization_code | No | https://mcp.slack.com/mcp | channels:read, channels:history, users:read, search:read.public, chat:write | Create an internal or directory-published Slack app with OAuth enabled and add the listed user scopes. Under Agents, enable Slack Model Context Protocol (MCP) Server. Add the callback URL under OAuth & Permissions > Redirect URLs and enable Token Rotation for refresh tokens. Copy the client ID and secret. Workspaces with app approval policies need admin approval. | Slack MCP setup |
GitHub | MCP | oauth2_authorization_code | No | https://api.githubcopilot.com/mcp/ | repo, read:org | Create an OAuth App under Settings > Developer settings > OAuth Apps. Use your Aperture gateway URL as the homepage and register the callback URL. Copy the client ID and secret. Organization repositories might require owner approval under Settings > Third-party access. | GitHub OAuth apps |
Gmail | MCP | oauth2_authorization_code | Yes (pre-registered client) | https://gmailmcp.googleapis.com/mcp/v1 | gmail.readonly, gmail.compose. Parameters: access_type=offline, prompt=consent. | No manual OAuth app setup for QuickSetup. For your own client, enroll the Google Cloud project in Workspace Developer Preview and enable the Gmail and Gmail MCP APIs. Configure the consent screen with the listed scopes and create a Web OAuth client with the callback URL. External apps can require restricted-scope verification. | Gmail MCP setup |
GoogleCalendar (Google Calendar) | MCP | oauth2_authorization_code | Yes (pre-registered client) | https://calendarmcp.googleapis.com/mcp/v1 | calendar.readonly, calendar.events. Parameters: access_type=offline, prompt=consent. | No manual OAuth app setup for QuickSetup. For your own client, enroll the Google Cloud project in Workspace Developer Preview and enable the Calendar and Calendar MCP APIs. Configure the consent screen with the scopes you use and create a Web OAuth client with the callback URL. External apps in Testing have seven-day refresh tokens. | Google Calendar MCP setup |
GoogleDrive (Google Drive) | MCP | oauth2_authorization_code | Yes (pre-registered client) | https://drivemcp.googleapis.com/mcp/v1 | drive.readonly, drive.file. Parameters: access_type=offline, prompt=consent. | No manual OAuth app setup for QuickSetup. For your own client, enroll the Google Cloud project in Workspace Developer Preview and enable the Drive and Drive MCP APIs. Configure the consent screen with the listed scopes and create a Web OAuth client with the callback URL. drive.readonly is a restricted scope. | Google Drive MCP setup |
IncidentIO (incident.io) | MCP | oauth2_dcr | Yes (DCR) | https://mcp.incident.io/mcp | Discovered | Enable the remote MCP server under Settings > MCP and add your Aperture gateway's hostname to Allowed redirect domains. | incident.io remote MCP |
Linear | MCP | oauth2_dcr | Yes (DCR) | https://mcp.linear.app/mcp | read, write | Enterprise workspaces with third-party app approvals enabled need admin approval under Settings > Administration > Security. | Linear MCP |
Notion | MCP | oauth2_dcr | Yes (DCR) | https://mcp.notion.com/mcp | Discovered | Enterprise workspace admins must approve the app under Settings > Connections > Permissions > AI apps. | Notion MCP |
Asana | MCP | oauth2_authorization_code | No | https://mcp.asana.com/v2/mcp | Parameter: resource=https://mcp.asana.com/v2 | Create an MCP app in Asana. Register the callback URL, copy the client ID and secret, and set distribution to your workspace. | Asana MCP setup |
Clay | MCP | oauth2_dcr | Yes (DCR) | https://api.clay.com/v3/mcp | mcp | Connect directly with DCR. No manual OAuth app setup is required. | Clay MCP |
CommonRoom (Common Room) | MCP | oauth2_dcr | Yes (DCR) | https://mcp.commonroom.io/mcp | openid, profile, email, offline_access | Verify that MCP is enabled under Settings > MCP Server. | Common Room MCP |
Crossbeam | MCP | oauth2_dcr | Yes (DCR) | https://mcp.crossbeam.com/mcp | email, offline_access, openid, profile | Available on all plans. Users need a Full Access or Sales seat. Under Settings > Roles & Permissions, the user's role must have the MCP permission set to Access. | Crossbeam MCP access |
Datadog | MCP | oauth2_dcr | Yes (DCR) | https://mcp.datadoghq.com/api/unstable/mcp-server/mcp | Discovered | Enable MCP Access under Organization Settings > Preferences and grant MCP read/write permissions to user roles. For organizations outside US1, change the endpoint hostname to match your Datadog region. | Datadog MCP setup |
Granola | MCP | oauth2_dcr | Yes (DCR) | https://mcp.granola.ai/mcp | Discovered | Enterprise admins configure note access under Settings > Workspace > General > Apps & connectors. Find MCP access for members, select Manage, and enable the desired access. | Granola MCP |
Pylon | MCP | oauth2_dcr | Yes (DCR) | https://mcp.usepylon.com | email, offline_access, openid, profile | Enable MCP Server under Settings > AI Controls. Users need a Member or Admin seat and a role with MCP Access. Viewer and Integration seats cannot authenticate. | Pylon MCP |
SiftHub | MCP | oauth2_dcr | Yes (DCR) | https://app.sifthub.io/api/v1/mcp-server/mcp | sifthub:read, sifthub:ask | Available to existing SiftHub customers only. | SiftHub MCP |
Spekit | MCP | oauth2_dcr | Yes (DCR) | https://mcp.spekit.co/mcp | openid, profile, email, read | Confirm that your organization has Spekit MCP (Beta) enabled. Each user signs in when connecting. | Spekit MCP |
Vercel | MCP | oauth2_dcr | Yes (DCR) | https://mcp.vercel.com | openid, email, profile, offline_access | Requires Aperture's public OAuth callback. Refer to Connector authentication. | Vercel MCP |
Zapier | MCP | oauth2_dcr | Yes (DCR) | https://mcp.zapier.com/api/v1/connect | openid, profile, email | Each user must enable the apps and actions they want in Zapier MCP before tools appear. | Zapier MCP setup |
The connector form shows provider-specific setup guidance and documentation links.
Verified connector defaults are starting points. Once an admin saves a connector, the stored configuration values are the authoritative source of truth. The registry values are not enforced at runtime.
The verified registry supplies the presets in Add connector on the Connectors page in Administration, which lists configured connectors. In Chat, the Connectors page lists catalog and built-in entries that are not yet configured. They appear under Available to add for admins and under Requires admin setup for other users. For a verified connector, Configure opens its setup on Administration > Connectors. For a built-in connector, Configure starts setup in Chat.
Configured built-in connectors
Aperture supplies these connectors' tools directly rather than connecting to an upstream MCP server. Configure them under connectors.servers with the reserved, case-sensitive provider values in this table. For setup instructions, refer to Built-in connectors.
| Provider ID | Tools | Authentication and requirements |
|---|---|---|
Tailnet | provision_node | oauth2_authorization_code, brokered through the tool. Configure a Tailscale OAuth app. After user approval, the tool returns a one-time URL that serves a single-use, short-lived auth key to connect one node on that user's behalf. The key itself is not in the tool result. The default node attributes are custom:createdByAperture and custom:createdByAI. |
TailnetSSH | list_machines, run_command | No connector OAuth credentials. Uses the Aperture gateway's Tailscale node. Target machines must have Tailscale SSH enabled, and tailnet policy must permit access from the gateway. |
Tool names use the configured connector ID as a prefix. With the default connector IDs, clients receive Tailnet_provision_node, TailnetSSH_list_machines, and TailnetSSH_run_command. Both connectors need explicit grants. They are not system connectors.
System connectors
The aperture system connector is always present, without an entry under connectors.servers. Its tools depend on gateway capabilities and matching grants. Refer to System connectors for the tool inventory and availability conditions.