Connected apps

Connected apps put a few outside services in reach of every provider as ordinary tools: the ticket you are working from, the document you were sent, the mail you need to answer. They are a preview — the flows below work, and live sign-in against every tenant and account type is still being proven.

Connecting one

1. Open Settings › Integrations

   The Connected apps cards are at the top: Linear, Google Drive, Microsoft 365. Custom MCP servers live below them under Custom MCP tools — see MCP hub.

2. Sign in through your browser

   Connect opens the service's own page in your system browser. You sign in there and pick the workspace or account. There is no client ID to find, no developer app to register, no API key and no MCP JSON to assemble. Google opens its official desktop file picker so you choose exactly which files are in scope.

3. Choose what agents may do

   Each account gets its own capability switches. Reads start on; writes start off. Turn on only what you want reachable — a disabled action is absent from what agents can discover and refused by the engine even if a provider remembers it from an earlier session.

4. Start a new session

   Providers cache their tool list when a session opens, so a connection you just made — or a capability you just enabled — appears to agents in the next session, not the one you have open.

What each app can do

Deliberate limits

• Linear: Teams bounded to 100, title search to 20, projects 50 per page with a continuation cursor. No status changes, comments or issue edits.
• Google Drive: Only files you picked or the app created. 50 files per page, 256 KB read, 100 KB written, first sheet only. No PDFs, no binary content, no whole-Drive search.
• Microsoft 365: 20 messages per list, 50 events per list, calendar ranges up to 31 days. No attachments, attendees, mailbox edits, OneDrive or Teams. Sent means accepted, not delivered.

Every list says whether more results exist rather than pretending to be complete — an agent that asks for "all my issues" gets an honest page and a cursor, not a confident half-answer.

Writes always ask

A write goes through the same approvals cockpit as a shell command, and shows you the exact account, workspace, target and content before anything happens. Full auto does not cover connected-app writes: the only options are approve this one use, or cancel. Night Shift may not write to a connected app at all.

The target and content are frozen before you are asked, and the account, capability and session are re-checked after you approve. If a write is interrupted and its outcome is genuinely unknown, you are told it is unknown — it is never silently retried.

Where the data goes

• The content you asked for is a tool result. It may be saved in your local chat history and sent to the AI provider you selected, through that provider's official CLI. Settings says this on the card, and it is worth reading twice before you connect a mailbox.
• Tokens are encrypted in local app data with a wrapping key the operating system protects. There is no plaintext fallback: if that protection is unavailable, connectors fail closed rather than storing a secret in the open.
• Tokens go only to each service's own endpoints. They are never put in a prompt, a tool argument, a catalog description, a chat result or an agent's environment, and no Tracewyn server relays your content.
• Nothing syncs in the background. There is no indexing job and no scheduled read — data moves only when a tool call you allowed asks for it.

Capability switches are an app-level policy, not incremental OAuth consent: Microsoft still asks for its five delegated permissions at sign-in even when the write tools are off. See the Google Drive guide and the Privacy Policy.