# Connectors catalog Last validated Oct 16, 2026 Use this catalog to choose a connector and check its provider-side requirements. Verified connectors connect to upstream MCP servers. Configured built-in connectors provide `Tailnet` and Tailscale SSH tools. The `aperture` system connector needs no configuration and is separate from both. ## Verified connectors registry Aperture's verified connectors provide pre-configured defaults in the **Add connector** menu. The following catalog lists public providers, their defaults, and provider-side prerequisites. To configure one, follow [Add a verified connector][docs-add-verified-connector]. Verified connectors use one of two authentication types. Both require each user to authorize access: * **`oauth2_dcr`**: Aperture discovers the authorization server and uses [dynamic client registration][docs-connector-authentication-dcr] to register an OAuth client. You do not create an OAuth app or enter client credentials. Provider-side access controls and approvals still apply. * **`oauth2_authorization_code`**: Register an OAuth app with the provider, add Aperture's callback URL, and supply a client ID and a client secret if required. Providers with a pre-registered Aperture OAuth client can skip this manual credential setup. **QuickSetup** means Aperture can configure a connector without asking you for OAuth client credentials. DCR providers support it through automatic registration. Some `oauth2_authorization_code` providers, such as Gmail, Google Calendar, and Google Drive, support it through an OAuth client that Aperture pre-registers. The **QuickSetup** column identifies these providers. QuickSetup does not bypass provider prerequisites, connector grants, or per-user consent. For OAuth callback selection and authorization behavior, refer to [Connector authentication][docs-connector-authentication]. Authorization-code defaults can include `auth_url` and `token_url`. DCR discovers these URLs rather than defining them in the registry. In the table, **Discovered** means the registry does not specify default scopes. For the Google Workspace rows, prefix each scope with `https://www.googleapis.com/auth/`. Their Google Cloud app setup requirements apply only when you supply your own OAuth client. | Provider ID | Protocol | Auth type | QuickSetup | Default endpoint URL | Default scopes and parameters | Provider-side setup and requirements | Upstream documentation | | ---------------------------------- | -------- | --------------------------- | --------------------------- | ----------------------------------------------------------------- | -------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------- | | `Salesforce` | MCP | `oauth2_authorization_code` | No | `https://api.salesforce.com/platform/mcp/v1/platform/sobject-all` | `mcp_api`, `refresh_token` | In **Setup > External Client App Manager**, create an app with OAuth enabled. Add the callback URL and scopes, enable JWT-based access tokens and PKCE, and copy the Consumer Key as the client ID. Enable **SObject-All** under **API Catalog > MCP Servers**. | [Salesforce setup][xt-salesforce-mcp] | | `Atlassian` | MCP | `oauth2_dcr` | Yes (DCR) | `https://mcp.atlassian.com/v1/mcp/authv2` | Discovered | In **Atlassian Administration > Rovo > MCP server settings**, allow Atlassian-supported domains or add your Aperture gateway's hostname. | [Atlassian MCP settings][xt-atlassian-mcp] | | `Slack` | MCP | `oauth2_authorization_code` | No | `https://mcp.slack.com/mcp` | `channels:read`, `channels:history`, `users:read`, `search:read.public`, `chat:write` | Create an internal or directory-published Slack app with OAuth enabled and add the listed user scopes. Under **Agents**, enable **Slack Model Context Protocol (MCP) Server**. Add the callback URL under **OAuth & Permissions > Redirect URLs** and enable **Token Rotation** for refresh tokens. Copy the client ID and secret. Workspaces with app approval policies need admin approval. | [Slack MCP setup][xt-slack-mcp] | | `GitHub` | MCP | `oauth2_authorization_code` | No | `https://api.githubcopilot.com/mcp/` | `repo`, `read:org` | Create an OAuth App under **Settings > Developer settings > OAuth Apps**. Use your Aperture gateway URL as the homepage and register the callback URL. Copy the client ID and secret. Organization repositories might require owner approval under **Settings > Third-party access**. | [GitHub OAuth apps][xt-github-oauth] | | `Gmail` | MCP | `oauth2_authorization_code` | Yes (pre-registered client) | `https://gmailmcp.googleapis.com/mcp/v1` | `gmail.readonly`, `gmail.compose`. Parameters: `access_type=offline`, `prompt=consent`. | No manual OAuth app setup for QuickSetup. For your own client, enroll the Google Cloud project in Workspace Developer Preview and enable the Gmail and Gmail MCP APIs. Configure the consent screen with the listed scopes and create a Web OAuth client with the callback URL. External apps can require restricted-scope verification. | [Gmail MCP setup][xt-gmail-mcp] | | `GoogleCalendar` (Google Calendar) | MCP | `oauth2_authorization_code` | Yes (pre-registered client) | `https://calendarmcp.googleapis.com/mcp/v1` | `calendar.readonly`, `calendar.events`. Parameters: `access_type=offline`, `prompt=consent`. | No manual OAuth app setup for QuickSetup. For your own client, enroll the Google Cloud project in Workspace Developer Preview and enable the Calendar and Calendar MCP APIs. Configure the consent screen with the scopes you use and create a Web OAuth client with the callback URL. External apps in Testing have seven-day refresh tokens. | [Google Calendar MCP setup][xt-google-calendar-mcp] | | `GoogleDrive` (Google Drive) | MCP | `oauth2_authorization_code` | Yes (pre-registered client) | `https://drivemcp.googleapis.com/mcp/v1` | `drive.readonly`, `drive.file`. Parameters: `access_type=offline`, `prompt=consent`. | No manual OAuth app setup for QuickSetup. For your own client, enroll the Google Cloud project in Workspace Developer Preview and enable the Drive and Drive MCP APIs. Configure the consent screen with the listed scopes and create a Web OAuth client with the callback URL. `drive.readonly` is a restricted scope. | [Google Drive MCP setup][xt-google-drive-mcp] | | `IncidentIO` (incident.io) | MCP | `oauth2_dcr` | Yes (DCR) | `https://mcp.incident.io/mcp` | Discovered | Enable the remote MCP server under **Settings > MCP** and add your Aperture gateway's hostname to **Allowed redirect domains**. | [incident.io remote MCP][xt-incident-mcp] | | `Linear` | MCP | `oauth2_dcr` | Yes (DCR) | `https://mcp.linear.app/mcp` | `read`, `write` | Enterprise workspaces with third-party app approvals enabled need admin approval under **Settings > Administration > Security**. | [Linear MCP][xt-linear-mcp] | | `Notion` | MCP | `oauth2_dcr` | Yes (DCR) | `https://mcp.notion.com/mcp` | Discovered | Enterprise workspace admins must approve the app under **Settings > Connections > Permissions > AI apps**. | [Notion MCP][xt-notion-mcp] | | `Asana` | MCP | `oauth2_authorization_code` | No | `https://mcp.asana.com/v2/mcp` | Parameter: `resource=https://mcp.asana.com/v2` | Create an MCP app in Asana. Register the callback URL, copy the client ID and secret, and set distribution to your workspace. | [Asana MCP setup][xt-asana-mcp] | | `Clay` | MCP | `oauth2_dcr` | Yes (DCR) | `https://api.clay.com/v3/mcp` | `mcp` | Connect directly with DCR. No manual OAuth app setup is required. | [Clay MCP][xt-clay-mcp] | | `CommonRoom` (Common Room) | MCP | `oauth2_dcr` | Yes (DCR) | `https://mcp.commonroom.io/mcp` | `openid`, `profile`, `email`, `offline_access` | Verify that MCP is enabled under **Settings > MCP Server**. | [Common Room MCP][xt-common-room-mcp] | | `Crossbeam` | MCP | `oauth2_dcr` | Yes (DCR) | `https://mcp.crossbeam.com/mcp` | `email`, `offline_access`, `openid`, `profile` | Available on all plans. Users need a Full Access or Sales seat. Under **Settings > Roles & Permissions**, the user's role must have the **MCP permission** set to **Access**. | [Crossbeam MCP access][xt-crossbeam-mcp] | | `Datadog` | MCP | `oauth2_dcr` | Yes (DCR) | `https://mcp.datadoghq.com/api/unstable/mcp-server/mcp` | Discovered | Enable **MCP Access** under **Organization Settings > Preferences** and grant MCP read/write permissions to user roles. For organizations outside US1, change the endpoint hostname to match your Datadog region. | [Datadog MCP setup][xt-datadog-mcp] | | `Granola` | MCP | `oauth2_dcr` | Yes (DCR) | `https://mcp.granola.ai/mcp` | Discovered | Enterprise admins configure note access under **Settings > Workspace > General > Apps & connectors**. Find **MCP access for members**, select **Manage**, and enable the desired access. | [Granola MCP][xt-granola-mcp] | | `Pylon` | MCP | `oauth2_dcr` | Yes (DCR) | `https://mcp.usepylon.com` | `email`, `offline_access`, `openid`, `profile` | Enable **MCP Server** under **Settings > AI Controls**. Users need a Member or Admin seat and a role with **MCP Access**. Viewer and Integration seats cannot authenticate. | [Pylon MCP][xt-pylon-mcp] | | `SiftHub` | MCP | `oauth2_dcr` | Yes (DCR) | `https://app.sifthub.io/api/v1/mcp-server/mcp` | `sifthub:read`, `sifthub:ask` | Available to existing SiftHub customers only. | [SiftHub MCP][xt-sifthub-mcp] | | `Spekit` | MCP | `oauth2_dcr` | Yes (DCR) | `https://mcp.spekit.co/mcp` | `openid`, `profile`, `email`, `read` | Confirm that your organization has Spekit MCP (Beta) enabled. Each user signs in when connecting. | [Spekit MCP][xt-spekit-mcp] | | `Vercel` | MCP | `oauth2_dcr` | Yes (DCR) | `https://mcp.vercel.com` | `openid`, `email`, `profile`, `offline_access` | Requires Aperture's public OAuth callback. Refer to [Connector authentication][docs-connector-authentication]. | [Vercel MCP][xt-vercel-mcp] | | `Zapier` | MCP | `oauth2_dcr` | Yes (DCR) | `https://mcp.zapier.com/api/v1/connect` | `openid`, `profile`, `email` | Each user must enable the apps and actions they want in Zapier MCP before tools appear. | [Zapier MCP setup][xt-zapier-mcp] | The connector form shows provider-specific setup guidance and documentation links. Verified connector defaults are starting points. Once an admin saves a connector, the stored configuration values are the authoritative source of truth. The registry values are not enforced at runtime. The verified registry supplies the presets in **Add connector** on the **Connectors** page in **Administration**, which lists configured connectors. In Chat, the **Connectors** page lists catalog and built-in entries that are not yet configured. They appear under **Available to add** for admins and under **Requires admin setup** for other users. For a verified connector, **Configure** opens its setup on **Administration** > **Connectors**. For a built-in connector, **Configure** starts setup in Chat. ## Configured built-in connectors Aperture supplies these connectors' tools directly rather than connecting to an upstream MCP server. Configure them under `connectors.servers` with the reserved, case-sensitive provider values in this table. For setup instructions, refer to [Built-in connectors][docs-connectors-built-in]. | Provider ID | Tools | Authentication and requirements | | ------------ | ------------------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `Tailnet` | `provision_node` | `oauth2_authorization_code`, brokered through the tool. Configure a Tailscale OAuth app. After user approval, the tool returns a one-time URL that serves a single-use, short-lived auth key to connect one node on that user's behalf. The key itself is not in the tool result. The default node attributes are `custom:createdByAperture` and `custom:createdByAI`. | | `TailnetSSH` | `list_machines`, `run_command` | No connector OAuth credentials. Uses the Aperture gateway's Tailscale node. Target machines must have Tailscale SSH enabled, and tailnet policy must permit access from the gateway. | Tool names use the configured connector ID as a prefix. With the default connector IDs, clients receive `Tailnet_provision_node`, `TailnetSSH_list_machines`, and `TailnetSSH_run_command`. Both connectors need explicit grants. They are not system connectors. ## System connectors The `aperture` system connector is always present, without an entry under `connectors.servers`. Its tools depend on gateway capabilities and matching grants. Refer to [System connectors][docs-system-connectors] for the tool inventory and availability conditions. [docs-add-verified-connector]: /docs/aperture/connectors/add-verified-connector [docs-connector-authentication]: /docs/aperture/connectors/authentication [docs-connector-authentication-dcr]: /docs/aperture/connectors/authentication#dynamic-client-registration-oauth2_dcr [docs-connectors-built-in]: /docs/aperture/connectors/built-in-connectors [docs-system-connectors]: /docs/aperture/connectors/system-connectors [xt-asana-mcp]: https://developers.asana.com/docs/using-asanas-mcp-server [xt-atlassian-mcp]: https://support.atlassian.com/security-and-access-policies/docs/control-atlassian-rovo-mcp-server-settings/ [xt-clay-mcp]: https://university.clay.com/docs/using-clay-in-claude [xt-common-room-mcp]: https://www.commonroom.io/docs/using-common-room/mcp-server/ [xt-crossbeam-mcp]: https://help.crossbeam.com/en/articles/12601327-crossbeam-mcp-server [xt-datadog-mcp]: https://docs.datadoghq.com/mcp_server/setup/ [xt-github-oauth]: https://docs.github.com/en/apps/oauth-apps/building-oauth-apps/creating-an-oauth-app [xt-gmail-mcp]: https://developers.google.com/workspace/gmail/api/guides/configure-mcp-server [xt-google-calendar-mcp]: https://developers.google.com/workspace/calendar/api/guides/configure-mcp-server [xt-google-drive-mcp]: https://developers.google.com/workspace/drive/api/guides/configure-mcp-server [xt-granola-mcp]: https://docs.granola.ai/help-center/sharing/integrations/mcp [xt-incident-mcp]: https://docs.incident.io/ai/remote-mcp [xt-linear-mcp]: https://linear.app/docs/mcp [xt-notion-mcp]: https://www.notion.com/help/notion-mcp [xt-pylon-mcp]: https://docs.usepylon.com/pylon-docs/integrations/pylon-mcp [xt-salesforce-mcp]: https://developer.salesforce.com/docs/platform/hosted-mcp-servers/guide/create-external-client-app.html [xt-sifthub-mcp]: https://www.sifthub.io/mcp [xt-slack-mcp]: https://docs.slack.dev/ai/slack-mcp-server/developing/ [xt-spekit-mcp]: https://www.spekit.com/platform/mcp [xt-vercel-mcp]: https://vercel.com/docs/mcp/vercel-mcp [xt-zapier-mcp]: https://docs.zapier.com/mcp/onboarding