Connect two apps
App A reads and writes app B in one of two ways.
| Through the platform | Through app B's public URL | |
|---|---|---|
| How | App A's backend calls POST /api/v1/mcp-connections/{connection_id}/call/ with its own key and the viewer's identity | App A's backend calls app B's routes directly |
| Runs as | The person viewing app A | Nobody; app B checks its own token |
| App B needs | An MCP endpoint, its token and public visibility, added as an MCP connection | public visibility and a token check on its routes |
| App A needs | To declare that MCP connection | App B's token as one of its app secrets |
Through the platform
-
Make app B reachable as in Let an agent use an app, steps 1–4.
-
In app A's chat, ask App Builder to use the connection, for example:
Show the open findings from the Risk Radar MCP connection on a dashboard: read them with the list_findings tool. Add a "Report incident" form that calls report_finding. -
App Builder declares the connection when it registers app A. It can declare connections that the person building the app can use, or that the build run or the builder agent has.
- Calls run as the person viewing app A, with their access to the connection.
- App A sees only the MCP connections it declares; a call to any other returns
404MCP connection not found. - A visitor who is not signed in has no identity; the call returns
401withcodeAPP_VIEWER_IDENTITY_REQUIRED.
Through app B's public URL
Ask App Builder in app A's chat to call app B's address with app B's token from an app secret. Store the token as a secret of app A, never in its code.
Let an agent use an app
Expose a hosted app's actions as MCP tools, add the app as an MCP connection and give it to an agent, within today's limits.
Send events to an app
Post signed events from CI, monitoring or any job into a hosted app with a Standard Webhooks signature, within today's gateway limits.