Connectors¶

A connector is an MCP server registered with the Gateway. Agents reach its tools through the Gateway, which applies the organisation's policies to each call. An organisation admin manages them in the admin dashboard under Protect > Connectors.

The page has two tabs and a search box that narrows the open one.

Tab	Shows
Mine	The connectors registered in the organisation: status, tool count, connected users and recent activity. A row opens the connector's page.
Discover	A catalog of servers the Gateway has connected, each added in one click.

Add custom connector (top right of both tabs) opens the registration dialog for any other server: a name, an upstream URL, the transport and, when the server needs one, a header. A server that turns out to need an account per person takes you to the provider's sign-in as soon as it is added, as on Discover.

Status: Live and Connect¶

The Status column says whether the connector works for the person looking.

Status	Meaning
Live	The connector is registered and active and, when it needs an account of its own per person, you have linked yours. A connector that needs no account (no authentication, or one header sent on every call) is Live once it is active.
Connect	The connector needs an account per person (OAuth) and you have not linked yours. The button starts the same consent as Connect account on the connector's page: it takes the browser to the provider, and returns to this list, where the row now says Live.
Paused, Error	The connector itself is paused or failing, for everyone. They replace Live and Connect.
Needs setup	The connector uses OAuth but has no OAuth app to sign in with, so nobody can link an account until an admin adds the credentials on the connector's page.
Can't tell	The page could not read whether you have linked your account. It is neither Live nor Connect, and Retry asks again.

The state is yours alone: a colleague having linked their account does not make the row Live for you, and the Connected users column counts people, not you. The page reads your links with one request for the whole list.

Discover¶

Discover draws a card per catalog entry: the mark, the name, one line about what the server does and "by publisher".

Add registers the connector with the entry's name, upstream URL and transport (Streamable HTTP) through the same route as the dialog, then takes you to the provider's sign-in to connect your own account. There is nothing to enter: the Gateway finds the server's authorization endpoints and registers itself as an OAuth client. You come back to the list, where the row says Live, and the connector's tools appear. A server that needs no account of its own opens the connector's page instead. Each colleague connects theirs from the Connect button of the row.
Added replaces the button on an entry the organisation already has. The match is by upstream URL, ignoring the case of the host, a default port and a trailing slash, never by name: a connector called "Notion" that points elsewhere does not count, and a connector with another name that points at Notion does.
A registration the server refuses leaves the card in place and says why (a connector of that name already exists, for instance). Add stays available to try again. When the registration worked but the sign-in could not start, you return to the list with the reason, and the row shows Connect.
When Coalex cannot read the organisation's connectors, the cards say they cannot tell whether the entry is added and Add is disabled. The page's own notice says why, with Retry where retrying can help. A card is never drawn as available or added from a read that failed.
A person who may not manage connectors sees the cards with no Add button, under the page's permission notice.

The catalog lists Notion and Linear. Each was connected by URL alone, per user, through the Gateway (MCP-native OAuth). It does not list the connectors Anthropic hosts inside claude.ai, which cannot sit behind the Gateway, nor providers without dynamic client registration (GitHub, Google, Microsoft), which need an OAuth app registered first. Those are added by hand.

Adding an entry to the catalog¶

The catalog is one typed file, apps/admin/src/lib/connector-catalog.ts. An entry is added only after the Gateway has connected the server by URL alone.

Connect the server through the Gateway by URL, with two users, and note the date.
Put the mark in packages/ui/assets/connectors/ as an SVG, with a line in that folder's NOTICE.md saying where it came from. Check the file holds no script, event handler, external reference or embedded image.
Link it from apps/admin/public/connectors/ with a relative symlink to the file in packages/ui/assets/connectors/, as the existing two are.
Append the entry to CONNECTOR_CATALOG:

Field	Meaning
`slug`	Lower-case id, unique in the catalog.
`name`	The name the connector is registered under.
`publisher`	Drawn as "by publisher".
`description`	One line.
`upstreamUrl`	The server's `https` URL, as the Gateway was given it. Unique in the catalog.
`transport`	`streamable_http`, the only transport the Gateway can sit in front of.
`auth`	`dcr`: OAuth with dynamic client registration.
`icon`	The path under `public/`, such as `/connectors/notion.svg`.
`verifiedAt`	`YYYY-MM-DD`, the day the Gateway last connected the server.

connector-catalog.test.ts fails on a duplicate slug, a duplicate URL, a URL that is not https, an entry without an icon, or an icon file that does not exist.