About 6 min read
Capabilities and external connectors
Tools, upstream auth profiles, host allowlists, and MCP-style connectors—how agents reach external systems under policy.
Capabilities vs connectors
Capabilities are the tools your runtime exposes to agents—filesystem, previews, optional browser automation, and similar building blocks—subject to policy and plan.
Connectors are how agents reach outward: authenticated APIs, MCP servers you configure, webhooks, and third-party services. They should live in governed secrets, not in prompts.
Upstream auth and allowlists
- Auth profiles capture how agents authenticate to external APIs; rotate credentials on the same schedule as your security team requires.
- Host allowlists reduce surprise outbound traffic—pair them with least-privilege API keys on the provider side.
MCP-style connectors (outbound)
- You can attach external MCP servers so agents call remote tools through a standard protocol. This is outbound from your workspace to another service.
- Do not confuse that with the Workspace MCP server (inbound API) documented under Workspace API and MCP—different direction, different keys.
Operational hygiene
Document which connectors each agent may use, who owns the credentials, and what to do during incidents (revoke, rotate, disable).
Health surfaces in the product help you catch misconfiguration before users do.
Related pages
- What is Smart AI Team? — Smart AI Team is the operational home for your AI workforce—workspaces, agents, tasks, and governed execution in one place.
- The AI operating layer for teams — Why a chat window is not enough, and how Smart AI Team maps intelligence onto real org structure and workflows.
- How it works — Control plane, tenant runtimes, sessions, skills, and channels—how the pieces fit without sacrificing isolation.
- Workspaces and tenants — Per-customer runtimes, branded domains, SSO handoff, and why isolation is a product feature—not an afterthought.
- Documentation overview