A connector lets ONE reach a tool that lives outside Factorial IT. Add one when you want the assistant to look things up in, or take action on, another system your team already uses.

Feature/Functionality

Overview

Each connector is a Model Context Protocol (MCP) server that you register by its URL. When it is connected, ONE can call the tools that server offers while you chat with it. For example, it can find a page in Notion or carry out a task in another service.

Typical reasons to add one:

• Look up data elsewhere. Bring in information held by a tool your team relies on.
• Act somewhere else. Let the assistant complete tasks inside a connected service.
• Extend what the assistant can do. Plug in any tool that supports the Model Context Protocol.

You do not need a connector if the assistant only has to work with Factorial IT data or your company's own guidance. For that, use knowledge base items.

Before you start

• To add, edit, re-authenticate or delete connectors, or to change their tool permissions, you need the Manage AI agents permission. To see them, View AI agents is enough.
• You need the URL of an MCP server that supports OAuth authentication.

How to use

1. Go to AI Agents > Settings and select the Connectors tab.
2. Click Add connector. A window opens.
3. Fill in the details:
   • Name: how the connector is labelled, for example Notion.
   • Server URL: the MCP endpoint, for example https://example.com/mcp.
4. Open Advanced settings only if your MCP server does not support Dynamic Client Registration. In that case, register Factorial IT in the provider's OAuth console and enter the Client ID and Client secret. Public clients that rely on PKCE can leave the secret blank.
5. Click Connect. You are sent to the MCP server to sign in. Once you grant access, you return to Factorial IT and the connector shows Connected.

Connector statuses

View a connector

The Connectors tab shows the built-in connectors first (Factorial IT and the help centre connector), followed by any you have added. Built-in connectors are always Connected. Click any connector to open its page.

On the page of a connector you added you will find:

• Settings: the Name, the Server URL and, if you entered one, the Client ID. The client secret is never displayed. Use Edit connection to change these values. Changing the server URL or the OAuth credentials means you have to authenticate again.
• Chat permissions and Agent permissions: every tool the MCP server offers, each with its policy. See "Set tool permissions" below.

The tool list is fetched from the MCP server each time you open the page, so it always matches what the server currently offers. Tools only show while the connector is Connected. If the server does not respond, you see a warning instead of the tools, and Settings remains usable.

Built-in connectors have no Settings and no Actions menu. You cannot edit or delete them, but you can change their tool permissions.

Manage a connector

On the page of a connector you added, use the Actions menu in the top right corner:

• Re-authenticate: sign in to the MCP server again. This option only shows when the connector is not Connected.
• Delete: remove the connector along with its saved credentials, once you confirm. If an agent is using the connector, you cannot delete it until you switch it off in that agent.

Set tool permissions

The connector page controls how ONE may use each tool. When the connector is Connected, its tools are listed in two sections:

• Chat permissions cover your own conversations with ONE.
• Agent permissions cover ONE when it works unattended, for instance on a ticket where you have added it as agent. When you switch the connector on for a custom agent, that agent takes a copy of these settings and keeps it. Changes made here afterwards do not reach that agent.

Both sections group tools into Read-only tools and Read-write tools. A tool counts as read-only only if the MCP server flags it with the readOnlyHint annotation. Anything else is treated as read-write.

To set a policy for a whole group, use the menu on the right of that group. The choice also applies to tools the server adds in future, and it overrides any tool-by-tool settings in the group. To set one tool, expand the group and choose a policy with the icons beside the tool name. When tools in a group have mixed policies, the group shows Custom.

Default policies, until you change them:

This means agents can use read-write tools straight away. To keep agents limited to reading on a connector, set Read-write tools to Always refuse under Agent permissions. Any custom agent already using the connector has its own copy, so update it in that agent as well.

How ONE uses connectors

During a conversation, ONE has access to the tools of every connected connector and chooses the right one for each request. To steer it towards a particular connector, type @ in the message box and pick the connector. ONE checks the connector's Chat permissions before running any tool. By default, it asks you before using a tool that writes or changes data.

Troubleshooting and FAQ

Troubleshooting

• The connector shows Error. The connection failed. Open its page and use Actions > Re-authenticate.
• The connector stays on Pending authentication. Authentication was not finished. Re-authenticate and complete the sign-in on the MCP server.
• No tools appear on the connector page. Tools only show while the connector is Connected, and the server must respond. If you see a warning, the server did not answer.
• You cannot delete a connector. An agent is still using it. Switch it off in that agent first.
• Connect fails on a server without Dynamic Client Registration. Register Factorial IT in the provider's OAuth console and enter the Client ID and Client secret under Advanced settings.
• A permission change did not reach an agent. The agent keeps its own copy. Change the policy inside the agent.

FAQ

1. Which permission do I need to add a connector?
   Manage AI agents. View AI agents only lets you see connectors.
    
2. Can I edit or delete the built-in connectors?
   No. You can only change their tool permissions.
    
3. How does Factorial IT decide whether a tool is read-only?
   Only tools the MCP server marks with readOnlyHint are read-only. Every other tool is read-write.
    
4. Why is there no Require approval for agents?
   An agent runs on its own, so nobody is there to approve the tool.
    
5. Can I see the client secret after saving it?
   No. It is never shown again.