> ## Documentation Index
> Fetch the complete documentation index at: https://docs-eos.fpt.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Connections

> Where the Digital Worker is allowed to reach into other systems

Instructions tell the Digital Worker what to do; connections give it the hands to do it. On the Digital Worker page, **Connections** sits in the **Configuration** column on the right of the **Digital Worker builder** screen.

## Attaching a connection to a Digital Worker

**1. Click the + in the Connections section**

Console asks which kind of account to use: **Shared** (one workspace account) or **Per user** (each person's own account).

**2. Pick the connectors**

The dialog lists connectors by group - Analytics, Documents, Email, Productivity and so on. Search by name, tick them one by one, or use **Select all**. A connector already attached shows an *Added* label along with the account type it is using.

**3. Click Done**

The connector appears in the list, ready for you to set permissions on each tool inside it.

If the system you need is not in the list, use **Add custom MCP** to wire up your own MCP server.

| Account type | When the Digital Worker runs |
| - | - |
| **Shared** | The Digital Worker uses one workspace-wide account. Users have nothing to set up |
| **Per user** | Each person connects their own account; the Digital Worker only sees data that person may see |

Mailboxes, calendars and personal documents belong on **per user**. Organisation-wide sources - CRM, ticketing - usually suit **shared** better.

## Every connector is a set of tools

Attaching a connector does not throw the whole system open. Inside each one is a list of **tools** - the specific actions the Digital Worker can call. Click a connector name in the list to expand it.

**SharePoint**, for example, has 12 tools across three kinds of work:

| Group | Tools |
| - | - |
| **Find and browse** | Search SharePoint · List SharePoint drives · List SharePoint files · Get SharePoint item |
| **Read content** | Read SharePoint text file · Read SharePoint Word file · Read SharePoint PDF file · List Excel worksheets · Read Excel range |
| **Write and share** | Edit SharePoint text file · Edit Excel cell · Create SharePoint share link |

The list tells you exactly how far the Digital Worker can reach: read Word files, PDFs and Excel sheets in SharePoint or OneDrive, and - where permitted - overwrite file contents or create a share link.

## Three permission levels per tool

Each tool carries its own permission level, set just below its name:

| Level | What the Digital Worker does | Best for |
| - | - | - |
| **Automatic** | Calls the tool straight away, asking nobody | Read-only work that changes nothing |
| **Ask** | Stops for the user's permission before running | Writing, editing, sharing outside |
| **Blocked** | Cannot call the tool at all, whatever the Instructions say | Actions this Digital Worker has no business performing |

The **exceptions** count next to a connector name shows how many tools sit away from the default level - a glance tells you where the Digital Worker has been tightened.

## Example: a sensible SharePoint setup

For an email and calendar assistant, permissions usually land like this:

* **Automatic** for the whole search and read group - the Digital Worker looks things up constantly, and reading breaks nothing.
* **Ask** for `Edit SharePoint text file`, `Edit Excel cell` and `Create SharePoint share link` - all three overwrite content or create links outsiders can open, so a person should nod first.

The result: the connector shows **3 exceptions**, exactly the three tools moved to *Ask*.

> [!WARNING]
>
> Permissions here limit *actions*, they do not widen *access*. The Digital Worker still only sees what the connected account is allowed to see - setting a tool to **Automatic** will not let it read a folder that account has no rights to.

![Agent connection permissions](https://mintcdn.com/fpt-15dbd015/ZZ_AlSQhekpFaExV/images/eos/en_agent_connections.jpg?fit=max\&auto=format\&n=ZZ_AlSQhekpFaExV\&q=85\&s=2ada3b6d28c342117196c9ef0d525cb8)

## Add a custom MCP server

When the system you need is not in the Marketplace, connect your own MCP server: Open **Connectors**, go to the **Custom Connectors** tab, then click **Add custom MCP**.

![Adding a custom MCP server with OAuth 2.1](https://mintcdn.com/fpt-15dbd015/gDW0AWl75k3m2kQW/images/eos/en_mcp_oauth_manual.jpg?fit=max\&auto=format\&n=gDW0AWl75k3m2kQW\&q=85\&s=673ff1b28440b35084deec728adede76)

| Field | Required | What it is | Example |
| - | - | - | - |
| Name | Yes | How the server appears in the Custom Connectors list | my-mcp-server |
| URL | Yes | The server MCP endpoint | \[\[\[\[[https://api.example.com/mcp
6
6\](https://api.example.com/mcp
6
6)\](https://api.example.com/mcp
6
6\](https://api.example.com/mcp
6
6))](<https://api.example.com/mcp
6
6](https://api.example.com/mcp
6
6)](https://api.example.com/mcp
6
6](https://api.example.com/mcp
6
6))>) |
| Authentication | Yes | How the server checks who is calling, see the table below | OAuth 2.1 (Auto) |

### Four authentication types

| Type | When to use it |
| - | - |
| **No authentication** | An open server that asks for no identity |
| **Static Headers** | The server takes a fixed API key or token in a header |
| **OAuth 2.1 (Auto)** | The server publishes OAuth metadata. Console reads it and registers a client for you, with nothing else to fill in |
| **OAuth 2.1 (Manual)** | The server publishes no OAuth metadata, or will not register a client. You paste the values from its documentation |

> [!NOTE]
>
> OAuth 2.1 is an open standard, tied to no single provider. Any server that speaks OAuth 2.1 can be connected.

### Fields for OAuth 2.1 (Manual)

| Field | Required | What it is |
| - | - | - |
| Authorize URL | Yes | Where the user is sent to grant access |
| Token URL | Yes | Where Console exchanges the authorisation code for an access token |
| Client ID | Yes | The client identifier the server issued |
| Client secret | No | Under **Advanced**. Most OAuth 2.1 servers issue no secret because PKCE already secures a public client. Leave it empty unless the server gave you one |
| Scopes | No | Under **Advanced**. Separated by spaces or commas. Leave empty to use what the server asks for |

**1. Open the dialog**

Go to **Connectors**, select the **Custom Connectors** tab, then click **Add custom MCP**.

**2. Fill in name and URL**

Give it a name you will recognise in the list, then paste the server MCP endpoint.

**3. Pick the authentication type**

Try **OAuth 2.1 (Auto)** first. Switch to **OAuth 2.1 (Manual)** only when the server cannot describe itself.

**4. Save the server**

Click **Save server**. It appears in the Custom Connectors list, ready to attach to a Digital Worker like any other Connector.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.