--- title: "Connectors" description: "Optional connectors link Overlane to the services your team already uses. How the encrypted tenant vault, typed actions, inbound webhooks and passthrough MCP servers work, with a page for each connector." --- > Documentation Index > Fetch the complete documentation index at: https://docs.overlane.app/llms.txt > Use this file to discover all available pages before exploring further. # Connectors Overlane has its own repositories, issues, deploys, docs and observability, and you can do everything with no third-party account. A **connector** is an optional link to a service your team already uses. Connectors are optional on every plan and are never part of what a plan includes or costs. Each connector declares how it authenticates, the scopes it asks for, its typed actions (each marked read, write or destructive, with the [autonomy class](/developers/approval-rule/) a write follows), and the events it can send. | Connector | For | Page | | --- | --- | --- | | MCP server | Any server your team allowlists | [MCP server](/developers/connectors/mcp/) | | Linear | Issues | [Linear](/developers/connectors/linear/) | | Sentry | Errors | [Sentry](/developers/connectors/sentry/) | | Slack | Chat and approvals | [Slack](/developers/connectors/slack/) | GitHub and GitLab are connected through the git and issue sync paths rather than here. ```sh overlane connector list overlane connector show slack overlane connector connect slack --secret-env SLACK_BOT_TOKEN overlane connector run slack list_channels overlane connector status overlane connector revoke cnx_0123456789abcdef --force ``` ### Microsoft Teams for approvals Teams carries approvals beside Slack. Create an Azure Bot with a single-tenant Microsoft app registration, give the app a client secret, turn on the Teams channel and set the messaging endpoint to `https://api.overlane.app/webhooks/connectors//teams`. Then store the secret with the app ID and your Microsoft tenant ID as settings: ```sh overlane connector connect teams --secret-env TEAMS_CLIENT_SECRET --config appId= --config tenantId= ``` The secret goes to the vault and is only ever sent to Microsoft's token endpoint, which returns the short-lived token each call carries. To disconnect, revoke the connection (`overlane connector revoke `). The same row is in the web app under Settings, Chat approvals. ## The tenant vault A credential goes straight into your team's vault. It is sealed with AES-GCM under a key derived for your team from a service key, with the entry and team bound in as additional data, so a sealed value copied to another team or entry does not open. The vault returns a label, a short fingerprint and a key version, never the secret. Revoking deletes the sealed value and keeps a tombstone. You give the credential through an environment variable or standard input, never an argument, so it stays out of shell history. It is never written to logs, audit entries, errors or responses; a test scans storage, logs and every response after a full run, and finds nothing, while a planted control secret is found. ## Settings are not URLs A connector never accepts a URL as a setting. A site or region is checked against a fixed form (`us` or `de`), so a setting cannot make a call go anywhere else. Every call stays on the provider's own origin, takes at most eight seconds and one megabyte, and never follows a redirect. ## Inbound events A provider sends events to `https://api.overlane.app/webhooks/connectors//`. There is no Overlane bearer token: the request is authenticated by the provider's own signature, checked against the webhook secret in your vault (`overlane connector connect --webhook`). Microsoft Teams is the exception: it signs every request with a Bot Framework token, which Overlane checks against Microsoft's published keys, the bot's app ID and your Microsoft tenant, so there is no webhook secret to store. A verified event is stored once by the provider's event ID, so a replay changes nothing and still answers `200` so the provider stops retrying. An unknown team, an unknown connector and a team with no webhook secret all answer the same `404`. ```sh overlane connector events slack ``` ## Limits Overlane makes at most the connector's calls-per-minute limit for one team and provider (it is on each connector's page), to protect the provider's quota. A call over it returns `429` with `Retry-After`. ## Passthrough MCP servers A team can let agents call tools on a third-party MCP server. Only an allowlisted server is ever called: ```sh overlane connector mcp add --name Docs --url https://mcp.example.com/mcp --secret-env DOCS_MCP_TOKEN overlane connector mcp list overlane connector run mcp list_tools --input '{"serverId":"mcp_0123456789abcdef"}' ``` The URL must be https on the default port (or 8443) and a public DNS name. An IP address, a local or internal name, a URL with credentials or a numeric host is refused, and the check runs again at every call, so a stored URL that turns out to be private is never contacted. A call takes at most eight seconds and one megabyte and never follows a redirect. A team may allow twenty servers. The transport is JSON-RPC over HTTP POST with JSON answers, MCP specification revision 2025-06-18. ```js run assert.equal(BUILT_IN_CONNECTORS.length, 11); assert.ok(BUILT_IN_CONNECTORS.includes("teams")); assert.ok(BUILT_IN_CONNECTORS.includes("mcp")); assert.ok(!BUILT_IN_CONNECTORS.includes("github")); assert.equal(MCP_PASSTHROUGH_LIMITS.timeoutMs, 8000); assert.equal(MCP_PASSTHROUGH_LIMITS.maxResponseBytes, 1000000); assert.equal(MCP_PASSTHROUGH_LIMITS.maxServersPerTeam, 20); assert.equal(connectorPaths.inbound("your-team", "slack"), "/webhooks/connectors/your-team/slack"); ``` Command reference: [connector list](/cli/connector-list/), [connector show](/cli/connector-show/), [connector connect](/cli/connector-connect/), [connector run](/cli/connector-run/), [connector status](/cli/connector-status/), [connector revoke](/cli/connector-revoke/), [connector events](/cli/connector-events/), [connector approval](/cli/connector-approval/), [connector chat-user](/cli/connector-chat-user/), [connector mcp add](/cli/connector-mcp-add/), [connector mcp list](/cli/connector-mcp-list/) and [connector mcp remove](/cli/connector-mcp-remove/). Source: https://docs.overlane.app/developers/connectors/index.mdx