Skip to main content
A Connector is how the Hub reaches an external service’s tools — the callable actions a skill or agent can use (list a calendar, create an issue, search a workspace, and so on). Viorant connects to remote MCP servers (Model Context Protocol) using the standard OAuth authorization flow. You authorize in your browser, and the Hub stores the resulting token in your OS keychain — Keychain on macOS, Credential Manager on Windows.

​
Two levels: your list, and each Space

Connectors work at two levels, and the distinction is the thing worth understanding first. Nothing is authorized at the list level. Adding a connector to your list makes it available; it does not sign you in anywhere. All of that happens inside a Space, which means the same connector can be signed into a different account in two different Spaces, and a Space you share the shape of carries no credentials with it.

​
The states a connector can be in

Two independent things are true of a connector in a Space: whether it’s authorized, and whether it’s enabled.
  • Not authorized — it’s in the Space, but you haven’t signed in yet. Its tools aren’t loaded.
  • Authorized — you’ve signed in and the Hub has loaded its tool list.
  • Needs re-authorization — the connection expired or was revoked at the service. Reconnect from the Space’s connector pool.
  • Enabled / disabled — independent of sign-in. A disabled connector stays authorized and configured but is not offered to agent runs, which is how you keep a connector around without letting it be used.
Within an authorized connector you can also enable or disable individual tools, so an agent is only ever offered the actions you intend.

​
Removing a connector

Removing a connector from a Space deletes that Space’s credentials for it — its OAuth tokens, any client registration, and any client secret you supplied. Other Spaces are untouched. Removing it from your list removes it everywhere and takes each Space’s credentials with it.

​
Where Viorant sits

The Hub calls the MCP server directly from your machine. Your tokens, your prompts, and the tool results never pass through Viorant’s servers. The one exception is the OAuth redirect. Services hand authorization back to a registered HTTPS address, so the return leg routes through a fixed Viorant callback that immediately relays it to your Hub. Viorant sees the redirect go past; it never performs the token exchange and never holds a token. The exchange happens on your machine, protected by PKCE, and the token goes straight into your OS keychain.

Add a connector to a Space

Browse the directory, add it to a Space, and authorize.

Bring your own OAuth app

For services that require an app you register yourself.