---
title: "Integrations"
description: "One catalog of outside services. Connect each one once, then let projects, devboxes, agents and knowledge bases use it through grants, with credentials that never leave Frazer Secrets."
url: https://frazer.ai/docs/integrations
index: https://frazer.ai/docs/llms.txt
tokens: 4723
---

> For agents: this page is indexed at https://frazer.ai/docs/llms.txt, and every page at https://frazer.ai/llms.txt. Copy commands from this file exactly.

# Integrations

Integrations connect Frazer to the services you already use: source control, identity, chat and on-call, issue trackers, DNS, model providers, knowledge sources and agent tools. An admin connects each service once, with your organization’s app or bot identity, not a person’s account. Projects, devboxes, agents and knowledge bases then use it through grants that name capabilities, not tokens. Credentials stay in Frazer Secrets: workloads get a token of an hour or less, or nothing at all.

Product page: [Integrations](https://frazer.ai/integrations).

## How it works

-   **Integration**: a catalog entry, published by Frazer or a verified partner. It declares its capabilities, the provider scopes each one needs, its auth methods, and what leaves Frazer and what Frazer stores.
-   **Connection**: an installed integration (`projects/{project}/connections/{connection}`) with the outside account, the identity it acts as (`org` or `person`), the scopes granted, an owner and a health state. It holds a reference to the credential, never the value. A connection lives in one project and is shared with other projects of the organization.
-   **Grant**: who may use a connection (a project, a project’s environment, a devbox profile, an agent, a knowledge base or a service account), for which capabilities and resources (Slack channels, GitHub repositories, a DNS zone), in `use` or `read` mode, optionally until a date.
-   **Personal connection**: a person’s own account (`users/{user}/connections/{connection}`), such as a developer’s own Linear or GitHub login.

Each product that needs an outside credential binds to a connection by name: alert channels, LLM gateway providers, knowledge sources, DNS zones, registry upstreams and imports, secrets imports and export sinks. The product owns the behavior; Integrations owns the credential, its health and who may use it.

### Capabilities first

A grant names capabilities, such as `notify.send` or `issues.write`. The connection asks the provider only for the scopes its granted capabilities need. Adding a capability that needs new scopes runs consent again, and an approval if your organization’s policy asks for one. Removing a capability narrows the token on its next mint.

### How credentials flow

| Method | Used for | What reaches a workload, devbox or agent |
| --- | --- | --- |
| Federation, no stored key | Imports, DNS providers, model providers, exports, CI | A provider token of 1 hour at most, minted for each use |
| App installation | GitHub, Slack, Teams, Linear | An installation token of 1 hour narrowed to the granted resources, or nothing |
| OAuth with refresh | Knowledge sources, issue trackers | An access token of 1 hour at most, or nothing |
| Scoped API key | DNS tokens, paging keys, model providers | Never the key: the egress gateway or the LLM gateway injects it |
| Static secret | Webhook URLs, passwords | Never |

Frazer Secrets is the only store, write-only for every role; the console shows a fingerprint and the age, never the value. The credential broker is the only reader, and it writes an audit line for every token it mints. Mounting a connection’s secret into a workload is an explicit plan on that service. Rotation is on wherever the provider offers it; a key that cannot rotate shows its age, and after 90 days a **Rotate** action.

### Outside clouds

Your images, secrets, logs and metrics live on Frazer. An outside cloud connects in one of six roles:

| Role | What it means |
| --- | --- |
| Import source | Read once, or sync for a migration window (90 days by default), into a Frazer service |
| Upstream | A pull-through cache in Frazer Registry; Frazer keeps the copy |
| Your DNS | You keep your DNS provider; Frazer writes one zone |
| Identity provider | People sign in and groups sync |
| Export destination | A copy of Frazer data goes out; the original stays |
| Your servers | Machines you already have join Frazer |

Model providers are [LLM gateway](https://frazer.ai/docs/llm-gateway) upstreams: requests leave Frazer by design, and each step is labeled with its data policy.

## The catalog

The catalog has 215 integrations in 21 categories. Every integration page has the same parts: what Frazer does with it, the capabilities and the scopes they need, the data flow, the auth method, and whether it works with agents.

| Category | Entries | Work with agents | For example |
| --- | --- | --- | --- |
| Source control and CI/CD | 16 | 1 | GitHub, GitHub Enterprise Server, GitLab (SaaS and self-managed) |
| Identity and SSO | 11 | 0 | Google (sign-in), GitHub (identity link), Google Workspace |
| Communication and on-call | 15 | 1 | Email, Slack, Microsoft Teams |
| Issue tracking | 9 | 3 | Linear, Jira, GitHub Issues |
| Observability | 14 | 1 | OpenTelemetry (OTLP), Prometheus remote write, Grafana Cloud |
| Security | 16 | 0 | Splunk (SIEM), Microsoft Sentinel, Google Security Operations |
| Registries and upstreams | 12 | 0 | Docker Hub, GitHub Container Registry, Quay.io |
| Secrets import | 10 | 0 | Google Secret Manager, AWS Secrets Manager, AWS Systems Manager Parameter Store |
| DNS providers | 11 | 0 | Frazer DNS, Cloudflare DNS, Amazon Route 53 |
| CDN and edge | 4 | 0 | Cloudflare, Fastly, Bunny.net |
| Servers and clouds | 11 | 0 | OVHcloud, Hetzner, Latitude.sh |
| Kubernetes, IaC, portals | 6 | 0 | Attached Kubernetes clusters, Terraform, OpenTofu |
| Data | 8 | 0 | S3-compatible storage (S3, R2, B2, Wasabi, MinIO), Google Cloud Storage, Azure Blob Storage |
| AI providers | 16 | 0 | Anthropic, OpenAI, Google Gemini API |
| AI tools | 9 | 0 | Hugging Face, Weights & Biases, MLflow (external) |
| Knowledge sources | 13 | 1 | Google Drive, Website, Upload and push API |
| Agent tools (MCP) | 14 | 14 | Frazer MCP server, Frazer Knowledge MCP, GitHub MCP server |
| Dev tools and gateways | 9 | 0 | Frazer app, Frazer extension for VS Code, Other VS Code-based editors |
| Billing | 3 | 0 | Stripe, Billing export (FOCUS), Partner resources on the Frazer bill |
| Status pages | 4 | 0 | Frazer status pages, Atlassian Statuspage, Instatus |
| Automation | 4 | 0 | Webhooks, Zapier, Make |

Every tile names who built it:

-   **By Frazer**: built and operated by Frazer, with Frazer support.
-   **Verified**: the publisher’s domain, 2FA, privacy policy, support and security contacts and least-privilege scopes are reviewed every year. Frazer does not audit their code.
-   **Community**: automated checks only. Community integrations are off by default for new organizations, and installing one shows a warning.

Other vendors’ MCP servers are listed only after Frazer checks the vendor’s server. Browse and filter the catalog at [frazer.ai/integrations](https://frazer.ai/integrations#catalog), or in the console in your organization’s **Settings › Integrations › Catalog**.

## Connect an integration

1.  Find the integration and read what it needs.
    
    ```sh
    frazer integrations list --category dns
    frazer integrations get slack
    ```
    
2.  Install it. Owners and Admins install; a Developer’s **Install** sends an install request to **IAM › Approvals**.
    
    ### CLI
    
    ```sh
    frazer integrations install linear --capability issues.write,knowledge.read \
      --grant project=acme-production:issues.write --grant kb=acme-company:knowledge.read
    ```
    
    ### Console
    
    In your organization’s **Settings › Integrations › Catalog**, choose the integration and select **Install**. Pick the account, consent to the capabilities and the scopes they need, add grants and test the connection. The plan on the right lists everything the install changes.
    
3.  Test it. A new connection is verified at install; run a check at any time:
    
    ```sh
    frazer integrations connections test cloudflare-dns-acme
    ```
    
4.  Grant it to another project:
    
    ```sh
    frazer integrations connections grant slack-acme --project acme-staging \
      --capability notify.send --resource "#acme-staging"
    ```
    

## Grant and share a connection

A connection carries its grants and the projects it is shared with. This one posts alerts and approvals in production, indexes two channels into a knowledge base, and is shared with staging for one channel:

```yaml title="slack-acme (connection)"
integration: integrations/slack
account: T01EXAMPLE # the Acme workspace
authKind: oauth
actor: org # installed as the Frazer bot, not as a person
capabilities: [notify.send, approvals.respond, knowledge.read]
owner: users/lena
grants:
  - principal: projects/acme-production
    capabilities: [notify.send, approvals.respond]
    resources: ["#acme-alerts", "#acme-deploys"]
  - principal: projects/acme-production/knowledgeBases/acme-company
    capabilities: [knowledge.read]
    resources: ["#eng", "#product"]
shareSettings:
  shareType: SPECIFIC_PROJECTS
  projectMap:
    acme-staging: { capabilities: [notify.send], resources: ["#acme-staging"] }
```

A project’s **Settings › Integrations** page shows the connections it may use, with their capabilities, and a **Request access** action for the others. A grant to a project labeled `production` needs an approval when the capability writes outside Frazer.

## Use connections from agents

Every MCP server that an agent, a devbox or the Frazer app uses through Frazer goes through the Frazer MCP gateway.

-   The agent sees `mcp.frazer.ai/c/{connection}` with a Frazer token of 1 hour at most. The gateway calls the vendor’s server with a token minted from the connection; your token never passes through.
-   A grant to an agent lists the tools it may call. Tools are read-only by default; write tools are opted in per grant, and writes to Frazer resources become plans that wait for approval.
-   The gateway pins each tool’s name, description and schema when you grant it. If the vendor changes them, the tool is held until an admin approves it again.
-   A session that has read untrusted content cannot call an outbound tool (a Slack post, a webhook, an email) without approval.
-   Your organization’s allowed MCP servers are published as a registry at `mcp.frazer.ai/registry/v0.1/servers`, so editors that support registry allowlists can lock to it.

Aggregators such as Composio, Zapier MCP and Pipedream Connect are ordinary connections on your own account; the per-grant tool list still applies.

## Keep connections healthy

| State | Meaning | What Frazer does |
| --- | --- | --- |
| **Healthy** | The last check and the last use succeeded | — |
| **Expiring** | A token, key or certificate expires within 30 days, or an import window ends within 7 | Emails the owner and Admins at 30, 7 and 1 days; a banner on the connection |
| **Needs re-auth** | Revoked, password changed, refresh failed, or the installer’s account was removed at the provider | Stops using it, keeps the grants, offers one **Reconnect** action and shows the affected projects |
| **Degraded** | Rate-limited, partial permissions, a provider incident, or no data for 1 hour from an export or source | Backs off; the banner names the provider’s status |
| **Error** | Repeated failures for another reason | Shows the request ID and the provider’s response |
| **Paused** | An admin paused it, or auth failed for 3 days | Mints nothing; **Resume** takes effect at once |

Frazer checks every connection at install, every hour with a cheap identity call, and on every use.

```sh
frazer integrations connections list --health needs-reauth
frazer integrations connections rotate r2-acme-ml
```

Every connection has an owner, a person or a service account. When the owner leaves, a connection that uses the organization’s identity keeps working and a **Transfer owner** task appears. A connection bound to the person’s own account at the provider moves to **Needs re-auth** with the reason.

## Import, export and remove

**Imports** are jobs on a connection, run once or synced for a window of 90 days by default. When the window ends the connection stops, so a migration never leaves a permanent link to the old cloud. Each import writes a report of what was copied, skipped or failed, with digests or secret names, never values.

**Exports** feed product sinks: logs, metrics, traces, security findings (OCSF), audit and billing (FOCUS). An export never replaces Frazer’s copy, ships a dashboard of its own delivery health, and meters its egress, with an estimate when you create it.

**Removing** a connection is a plan. It lists every grant and product binding that stops working, and it never deletes your content: dashboards, alert policies and knowledge documents stay, labeled **source disconnected**. Where the provider’s API allows, Frazer also uninstalls its app or revokes its token there, and shows that as a step.

## Access and audit

| Control | Default |
| --- | --- |
| Who may install | Owners and Admins; Developers send an install request to Approvals |
| Who may grant | Organization Admins, and Project Admins for connections already allowed in their project |
| Production projects | A grant that writes outside Frazer needs an approval |
| Allowed publishers | By Frazer and Verified; Community off |
| Category rules | A deny rule can block a category, such as every model provider but one |
| Agents | MCP tools only through grants, read-only by default |
| Kill switch | **Pause all connections** stops every mint and delivery in one audited action |

A category rule is a CEL condition, for example `integration.category == "aiprov" && integration.id != "anthropic"`.

Audit events cover connections (`integrations.connection.create`, `delete`, `pause`, `resume`, `reconnect`, `rotate`, `transfer_owner`, `scopes_updated`, `health_changed`), grants (`integrations.grant.create`, `update`, `delete`), install requests (`integrations.installRequests.create`, `approve`, `deny`) and one `integrations.connections.mintToken` per token the broker mints, with the connection, capability, principal and lifetime. They appear in the organization’s audit log, the connection’s **Activity** tab and the audit export.

## Limits and quotas

| Limit | Default |
| --- | --- |
| Tokens from the broker | 1 hour at most |
| Health checks | At install, hourly and on every use |
| Expiry emails | 30, 7 and 1 days before |
| Import window | 90 days |
| Auth failures before a connection pauses | 3 days |
| Key age before **Rotate** is offered | 90 days |
| No data before an export or source is Degraded | 1 hour |

## Pricing

Integrations and connections are included in every organization. Exports meter their egress.

| Integrations | On your servers | On the Frazer fleet |
| --- | --- | --- |
| Price | **Included** | **Included** |

Every line, with the estimator: [pricing](https://frazer.ai/pricing#lines).

## Troubleshooting

-   **A connection shows Needs re-auth.** The token was revoked, a password changed, a refresh failed, or the installer’s account was removed at the provider. Choose **Reconnect**: the grants stay as they are.
-   **A connection is Paused.** An admin paused it, or auth failed for 3 days. Fix the cause, then **Resume** it.
-   **A connection is Degraded.** The provider is rate-limiting, permissions are partial, the provider has an incident, or an export or source sent no data for an hour. The banner names the provider’s status.
-   **A Developer cannot install an integration.** Installs need an Owner or Admin. **Install** sends an install request to Approvals instead.
-   **A grant to a production project is waiting.** The capability writes outside Frazer, so the grant needs an approval.
-   **An agent cannot call a vendor’s tool.** The tool is not in the agent’s grant, it is a write tool the grant does not allow, or the vendor changed its description and it is held until an admin approves it again.
-   **Removing a Slack capability did not remove its scopes.** Slack scopes only grow. The connection says so and offers to reinstall the app with fewer scopes.

> **Tip:** Prefer the organization’s identity when you install: a connection made with a bot or an app keeps working when the person who installed it leaves.

## Reference

### CLI

| Command | What it does |
| --- | --- |
| `frazer integrations list` | List the catalog, filtered by category, installed state or agent support. |
| `frazer integrations get` | Show an integration's capabilities, provider scopes and data flow. |
| `frazer integrations install` | Install an integration as a connection, with its capabilities and grants. |
| `frazer integrations connections list` | List connections, filtered by health. |
| `frazer integrations connections grant` | Grant a connection's capabilities to a project, on chosen resources. |
| `frazer integrations connections test` | Verify a connection against the provider now. |
| `frazer integrations connections rotate` | Rotate a connection's credential. Takes effect at once and is audited. |

All of them: [CLI reference](https://frazer.ai/docs/cli).

### Terraform and OpenTofu

| Resource | What it manages |
| --- | --- |
| `frazer_integrations_connection` | A connection to an outside service; credentials are write-only attributes. |
| `frazer_integrations_connection_grant` | Who may use a connection, for which capabilities and resources. |

All of them: [Terraform and OpenTofu reference](https://frazer.ai/docs/terraform).

### Events

| Event type | When it is sent |
| --- | --- |
| `frazer.connection.health_changed.v1` | A connection moved to another health state. |
| `frazer.connection.expiring.v1` | A connection's token, key or certificate expires within 30 days, or its import window ends within 7. |

All of them: [Events reference](https://frazer.ai/docs/webhooks).

On `mcp.frazer.ai` the toolset `integrations` reads the catalog and connections; installs need approval. The API is `IntegrationsService`, `ConnectionsService` and `GrantsService`. To build an app on Frazer, register an OAuth app on the **Developer** tab of your organization’s **Settings › Integrations**.

## Related

-   [Webhooks and events](https://frazer.ai/docs/webhooks): events out, signed with Standard Webhooks.
-   [Frazer Agents](https://frazer.ai/docs/agents): agents use connections through grants.
-   [Secrets](https://frazer.ai/docs/secrets): where connection credentials are stored.
-   [LLM gateway](https://frazer.ai/docs/llm-gateway): model providers as connections.
-   [Knowledge](https://frazer.ai/docs/knowledge): knowledge sources read through connections.
-   [Integrations](https://frazer.ai/integrations): the product page and the full catalog.

## Pages in Connect

- [Integrations](https://frazer.ai/docs/integrations.md) (this page)
- [Webhooks and events](https://frazer.ai/docs/webhooks.md)
- [Terraform and OpenTofu](https://frazer.ai/docs/terraform.md)
- [API, CLI and MCP](https://frazer.ai/docs/api.md)