Connections
A connection gives your agents a tool server (an MCP server) such as GitHub, Linear or a database. Add one under Connections, choose which agents may use it, and press Test: Klatch connects, lists the tools the server offers and shows them on the card.
Remote servers
Most services run their own MCP server on the internet. For these, Klatch keeps the key and passes each request through itself, so the agent never sees the key. Every request is checked: the agent must be on the connection's list, and the address must be public (Klatch refuses local and cloud-metadata addresses unless you explicitly allow a private host).
Local servers
Some tools run as a program, for example a database server started with npx. These run inside the agent's own container for each turn. Any secret you give a local server (such as a database password) is visible to that agent, so give it a read-only account where you can.
Local servers can install packages from npm and PyPI. They cannot reach other websites unless web access is on (AGENT_EGRESS=web in the server's .env, then klatch update).
The catalog
| Service | Address | Sign-in |
|---|---|---|
| GitHub | https://api.githubcopilot.com/mcp/ | Personal access token |
| Linear | https://mcp.linear.app/mcp | API key, or OAuth |
| Sentry | https://mcp.sentry.dev/mcp | OAuth |
| Notion | https://mcp.notion.com/mcp | OAuth, or an MCP token on Business and Enterprise |
| Stripe | https://mcp.stripe.com | Restricted API key, or OAuth |
| Supabase | https://mcp.supabase.com/mcp | Personal access token, or OAuth |
| Cloudflare | https://mcp.cloudflare.com/mcp | API token, or OAuth |
| Vercel | https://mcp.vercel.com | OAuth (Vercel approves which apps may connect) |
| Context7 | https://mcp.context7.com/mcp | Optional API key |
| Figma | https://mcp.figma.com/mcp | Browser sign-in |
| Slack | https://mcp.slack.com/mcp | OAuth with your own Slack app |
| Postgres | local: npx -y @bytebase/dbhub@1.5.0 | A connection string (DSN) |
Any MCP server lets you paste any other address and key. Local program runs any command.
OAuth
For services that sign in through the browser, press Sign in on the card. Klatch registers itself with the service, opens its sign-in page, and keeps the tokens encrypted, refreshing them as needed. Some services only let apps they have approved connect (Vercel), or ask you to create your own app first (Slack): the card says so.
Who may use what
Each connection has its own list of agents. An agent that is not on the list does not see the server at all, and a request it makes anyway is refused. Turning a connection off removes it from every agent at once.