Connector library (remote MCP servers)

The Connectors catalog lets you add external/remote MCP servers — GitHub, Notion, Linear, Stripe, Sentry, and many more — to your workspace, then attach them to any embedded chat widget. The assistant can then use those servers' tools alongside your own app's tools, all in one conversation.

Open it from Connectors in the sidebar, under the Remote connectors tab.

Looking to create a hosted server for an API instead? See Ready-to-use connectors (the Ready-to-use APIs tab) — those create a first-party MCP server you own, rather than attaching an external one.

Browse the catalog

The catalog is a curated set of remote MCP servers. Use the left sidebar to search or filter by category (Software Development, Payments, CRM, Productivity, …), or show only the ones you've Enabled. Click any connector to see its overview — what it does, its authentication type, and a link to the provider's docs.

Enable a connector for your workspace

Only workspace owners can enable connectors. On a connector's detail page, click Enable for workspace. Once enabled, the connector becomes available to attach to your chat widgets. Use Disable for workspace to turn it off again.

How a connector authenticates depends on its type:

• OAuth (most connectors) — nothing to configure here. Each end-user signs in individually in the chat widget (a popup runs the provider's OAuth). Their token is used only for their own requests and is never stored by FlowCP.

• API key — you provide a shared workspace credential when enabling. It's stored encrypted and used for everyone using that connector in your workspace. Only the last four characters are ever shown.

• Open — no authentication; just enable.

Add a connector to a chat widget

In a chat widget's Connectors section (see Embed an AI chat widget), click Add connector. Enabled remote connectors appear alongside your platform servers (tagged Remote). Add one and its tools join the widget's chat, namespaced with the connector's prefix so names never collide.

For OAuth connectors, each end-user gets a Connect name button in the widget and signs in to that provider separately; if a connector's session expires mid-chat, only that connector asks to reconnect.

Security

• Every request to a remote server goes through FlowCP's SSRF-safe network layer (IP-pinned, https-only).

• OAuth discovery, dynamic client registration, and the token exchange are proxied server-side; PKCE secrets never sit in the browser in the clear.

• End-user OAuth tokens are never persisted — they live only in the visitor's browser session and on the wire per request. Shared API keys are encrypted at rest.