# Agent Tools Connect the tools the Salfio agent can act with — from the Marketplace or your own MCP servers. **Agent Tools** are what the Salfio agent *acts with*: create a Linear issue, draft an email, update a HubSpot deal. The agent loads your connected tools at the start of each run and uses them alongside Salfio's built-in ones. > Agent Tools are different from **Integrations**: Integrations *sync your conversations into* Salfio (Gmail, Slack, meeting recorders); Agent Tools let the agent *do things* in your other products. Open **Settings → Agent Tools**. There are two ways to connect a tool: ## Marketplace The **Marketplace** tab lists ready-to-connect toolkits — project management (Linear, Jira, Asana, Trello, monday.com, ClickUp), CRM (HubSpot, Salesforce, Attio), docs (Notion), support (Intercom, Zendesk), email and calendar (Gmail, Outlook, Google Calendar), and more. Use the search box to find anything beyond the featured grid, and the category filter to narrow it. To connect a toolkit: 1. Click **Connect** on its card. 2. Review the confirmation and click **Authorize**. You're taken to the provider's consent screen — the authorization is handled by [Composio](https://composio.dev), Salfio's tool-connectivity partner, and returns you to Salfio when done. 3. Approve access. Back in Salfio the toolkit shows **Connected**, and its tools are available to **your own** agent runs from the next one. Credentials are held by the provider's own OAuth grant — Salfio never sees your password. **Disconnect** at any time from the card or the **Installed** tab: the agent loses the toolkit's tools on its next run, and your data in that product is untouched. A new tool is personal until you share it A freshly connected tool is **personal**: only your own agent runs can use it. Nobody else's runs — and no card or organization API request — can read it until you explicitly click **Make available to organization** on its row in the **Installed** tab. Only the person who authorized a tool can share it, because sharing extends *their* access to everyone. Once shared, every member's agent runs, card generation, and requests made with an organization API key (which have no user of their own) reach that product **through the authorizing person's access**, and see everything that person can see. Salfio does not re-check each member's own permissions on the connected product. The **Installed** tab shows this: shared tools sit under **Organization tools** with an **Organization** badge, personal ones under **Personal tools** with a **Personal** badge, and every row names the person as *Authorized by …*. Tools connected before this was recorded show a dash instead of a name. **Make personal** reverses the share: any member can withdraw a tool from the organization, its owner keeps using it, and any cards reading it are detached — sharing it again later does not re-attach them. Tools connected before scopes existed remain organization-wide until someone withdraws them. If a tool should only expose part of what you can see, connect it from an account whose access is already scoped that way. A few notes: - **Slack is built in.** The agent already reads and sends Slack messages through your [workspace connection](/docs/getting-started) — there's no Slack toolkit to connect. - Toolkits marked **"Also in Integrations (sync)"** (like Gmail) exist on both pages for different reasons: the Integration syncs the mailbox into Salfio, the Agent Tool lets the agent search, draft, and send. - Don't see a tool you need? The catalog grows regularly — tell us what's missing. ## Custom MCP servers For self-hosted or internal tools, the agent can connect to **your own** [MCP](https://modelcontextprotocol.io) servers — an internal knowledge base, ticketing system, or data warehouse. > This is the reverse of [connecting an MCP client to Salfio](/docs/mcp): here Salfio is the **client**, and your server provides the tools. Click **Add custom MCP server** and fill in just two fields: - **Name** — a short label. It also namespaces the server's tools (for example `internal-kb__search`) so they never clash with other tools. - **Server URL** — the server's HTTPS endpoint. You don't need to know the exact transport path: if the URL you enter doesn't answer MCP directly, Salfio also tries the standard `/mcp` and `/sse` paths and saves the address that works. **Transport and authentication are detected automatically** when Salfio first connects. Depending on what your server requires, the new entry (on the **Installed** tab) lands in one of these states: - **Connected** — the server was reachable without credentials; its tools were discovered and are ready. - **Needs API key** — the server wants a static credential. Click **Add key**, optionally change the header name (default `Authorization`), and paste the key. It's stored encrypted and never shown again; Salfio immediately re-checks the connection with it. - **Needs OAuth** — the server signs you in through the browser. Click **Connect**, approve on the provider's consent screen, and you return connected. Tokens are stored encrypted and refreshed automatically; if a token can't be refreshed the server shows **Expired** — click **Reconnect**. - **Unreachable** — Salfio couldn't reach the URL. Fix it (or the server) and click **Retry**. Like marketplace toolkits, a new custom server is **personal** to the person who added it until they click **Make available to organization** on its row. Changing a server's **URL** re-runs detection against the new address — credentials from the old server never carry over. Editing just the name touches nothing else. Only **HTTPS** servers reachable at public addresses are accepted; servers on private or internal addresses are rejected. ### Connecting Salfio's own MCP server Salfio's [MCP server](/docs/mcp) can itself be added as a custom server, so the agent can act with Salfio's own client/activity tools. Enter `https://mcp.salfio.com` as the Server URL — detection resolves it to the `https://mcp.salfio.com/mcp` endpoint — then click **Connect** and approve the OAuth consent for your organization. The grant is scoped to that organization only, exactly like [connecting from Claude.ai web](/docs/mcp/connect-claude-web). ## Test, enable, disable, remove - **Test** checks that Salfio can reach a custom server and lists its tools. (For SSE servers the test validates the URL — tool discovery happens when the agent connects.) - Toggle **Enabled** to control whether the agent loads a server's tools without removing it. - **Edit** changes a server's name or URL; the **trash** icon removes it — the agent stops using its tools immediately. ## How the agent uses them At the start of each run the agent loads your connected marketplace toolkits and enabled custom servers, connects to each, and exposes their tools alongside Salfio's own — namespaced so they never collide. If a server is slow or unreachable it is skipped for that run, without affecting the rest of the agent. ## Related pages - [Administrator Tools](./administrator-tools.md) - [Assign a Slack channel to a client over the API](./guides-assign-slack-channel.md) - [Authenticated health check](./api-reference-gethealth.md) - [Authentication](./api-authentication.md) - [Cards](./cards.md) - [Changelog](./changelog.md) - [Changelog](../changelog.md) - [Connect a workspace](./getting-started-connect-workspace.md) - [Connect an integration](./getting-started-connect-integration.md) - [Connect from Claude Desktop](./mcp-connect-claude-desktop.md) # Agent Instructions This portal answers questions programmatically. To receive a synthesized, source-cited answer instead of crawling page by page, append the `?ask=` query parameter to any page URL on this site: /guides/quickstart?ask=how+do+I+authenticate Optional parameters: - `&goal=` steers the answer toward your objective (e.g. `&goal=write+a+python+client`). - `&version=