课程大纲
学院模块 7 · Controls and connections
Connections: bring your other apps in
你将学到
- you can explain what a connection is and what MCP does under the hood
- you can connect Notion, GitHub, or a Google app using the right sign-in method
- you can read an external-tool approval card and choose Allow once, Always allow, or Deny
- you can lock a connection down with per-tool permissions and the "Trust this app" toggle
You're deep in a chat about your project. The spec lives in Notion, the bug reports in GitHub, next week's deadline in Google Calendar. The agent knows your workspace inside out, but everything outside it is invisible.
Connections fixes that. Plug an external app into Consilience once, and the things it can do become things the agent can do mid-chat: search a Notion page, read a GitHub issue, send a Gmail. Every one goes through an approval card you control.
What a connection is
A connection is one external app hooked up to Consilience. Under the hood it's an MCP server reachable over HTTPS.
| App | Category | How it signs in |
|---|---|---|
| Notion | Productivity | Browser sign-in (OAuth) |
| GitHub | Development | Personal access token |
| Atlassian (Jira & Confluence) | Development | Browser sign-in (OAuth) |
| Gmail | Google Workspace | Aggregator link (e.g. Composio) |
| Google Drive | Google Workspace | Aggregator link (e.g. Composio) |
| Google Calendar | Google Workspace | Aggregator link (e.g. Composio) |
In the left sidebar's chat sessions panel, a "Connections" button with a link icon sits next to "New chat". It opens the catalog as a workspace tab, and only one ever opens: click again and it focuses the tab you already have. You can also reach it from the command palette (search "Connections") or the Go menu.
Three ways to connect
Every connector uses one of three sign-in methods, matched to what the service supports:
- Browser sign-in (OAuth), for Notion and Atlassian. Click "Sign in with browser" and your real system browser opens, not an in-app webview. Sign in there, and the token lands in the OS keychain.
- Access token, for GitHub. Its server has no browser flow, so you paste a personal access token instead. A "Create a token" link jumps straight to github.com/settings/tokens.
- Aggregator link, for the Google cards. Google has no first-party MCP server, so Gmail, Drive, and Calendar go through a connection service like Composio. You sign in to Google there, then paste back the link it gives you.
Connect Notion in under a minute
Open Connections
In the chat sidebar, click "Connections" next to "New chat".
Pick the app
Click the Notion row. The connect dialog opens with the app's description.
Sign in
Click "Sign in with browser". Your default browser opens Notion's consent page; approve it there.
Watch it land
The dialog shows a "Connecting…" message and closes itself the moment the connection succeeds. Notion appears in the "Connected" strip with a green check.
Not in the catalog? A server you run yourself, or Slack through an aggregator, goes in through "Advanced: add a self-hosted connection". Give it a name, an https:// URL, and a sign-in method. Plain http works only for localhost, and private or internal IPs are rejected.
How tools show up in chat
There's nothing to switch on. Once an app is connected and trusted, the server reports its tools, and they join the agent's normal tool list under a namespaced name like notion__notion-search. You can see the whole list in the connection's manage dialog, under "Advanced: per-tool permissions".
Safety: you stay in control
Every tool the app reports gets a three-state permission, and the default is the cautious middle one:
| Permission | What it means |
|---|---|
| "Always allow" | Runs without asking. You set it one tool at a time; there's no bulk allow-all switch. |
| "Needs approval" | The default. Every call routes through an approval card in chat. |
| "Blocked" | The tool is pulled from the agent completely. It never even sees it. |
- "Trust this app" is a per-connection switch in the manage dialog. Turn it off and the connection stays signed in, but the agent stops seeing its tools.
- Untrusted-content guard. Everything an external tool returns is wrapped for the model as untrusted content. For the rest of that turn, any further URL fetch needs your explicit go-ahead. That blocks prompt injection hiding inside an external page.
- Keychain-only secrets. Tokens live in the OS keychain, never in a database or local storage. Disconnect and they're erased.
- Bounded calls. External tools run one at a time, so even a slow server can't stall your chat.
- Plan mode never sees connections. While a plan is active, external tools are held back from the agent entirely.
快速自测
You set a tool's permission to "Blocked" in the manage dialog. What happens the next time the agent works?
快速自测
On an approval card, what does "Always allow" do beyond running the action right now?
- Connection
- One external app hooked up to Consilience. Under the hood, exactly one MCP server reachable over HTTPS.
- MCP
- Model Context Protocol: the open standard a service uses to describe callable tools to an AI. The UI never uses the term.
- Tool
- A concrete action a connected server offers; the agent sees it namespaced as connection__tool-name (e.g. notion__notion-search).
- Per-tool permission
- Three-state setting per tool: "Always allow" / "Needs approval" (default) / "Blocked".
- "Trust this app"
- Per-connection switch: off keeps the sign-in alive but hides all its tools from the agent.
- Aggregator
- A connection service (such as Composio) that handles sign-in for apps without a first-party MCP server and hands you a link to paste.
That's the whole structure: connect once, and the tools join the agent's toolbox behind approval cards, per-tool permissions, and "Trust this app". How the agent plans, cites, and asks for approval in general, you already saw in the agent lessons. Next comes the activity center: the bell that collects the jobs the app runs in the background, and the in-chat rows where these tool calls actually land.