Connect and configure your tools
Connect the account a connection needs and restrict the resources it may touch. Team switches control where the connection appears.
Pick a provider, create one or more concrete connection instances, and grant only the right instances to each team. Generated MCP tools become available automatically with the grant.
Video placeholder
Record the full admin flow at a readable zoom. Open Connections, add a second instance of one provider, name it, select allowed resources, and grant that exact instance to one team.
Connect a tool in five steps
Only a workspace owner or admin can finish these steps.
- 1
Choose a provider
The Connections page lists every supported external service and database provider.
- 2
Create an instance
Sign in to an external account, or enter the details for a supported database.
- 3
Name duplicates
Add multiple instances of the same provider and give each one a clear name.
- 4
Select resources
Limit each instance to the repositories or provider resources its teams need.
- 5
Enable it for a team
Open team settings and switch on the exact connection instance the team may use, then turn it off for any agent that does not need it.
Start with the provider
Search Connections by provider, then connect the account that should perform the work. Existing instances do not prevent you from adding another.
Name additional instances so team settings clearly distinguish production, staging, client, or regional accounts.
Image placeholder
Show the Connections page with one provider that already has two named instances and its Add another action visible.
Authorize the external service
Select Connect beside a missing requirement. Most services open an OAuth sign-in; API key and basic-auth services ask for their credentials inside Hivy instead.
Use the company account that agents should work through. A successful sign-in creates the connection, but no agent can call it until its team has a grant for that exact connection instance.
Connect databases with a read boundary
Database connections work with PostgreSQL, MySQL, MongoDB, and Redis. Hivy checks the connection URL, reads the database structure, then displays the objects you can permit.
Use a read-only database user or replica. For SQL, permit only the needed schemas and tables, then mask fields agents shouldn't receive. MongoDB offers collection and field controls; Redis uses allowed key patterns.
Image placeholder
Use the database policy screen after inspection. Show the permitted schemas, tables or collections, and masked fields; the demo database must contain no real credentials or customer data.
Generated MCP tools follow the grant
Granting a connection makes its generated MCP tools available to that team's agents automatically.
Team-owned skills and workspace skills granted to the team remain separate and editable through Settings → Skills.
Enable the connection for the owning team
Open Settings, choose Teams, and select the team that owns the work. Switching the connection on there gives it to every agent on that team.
Installation alone never gives an agent access. Each team needs its own grant, even when several teams use the same workspace connection.
To narrow access further, open an agent's settings and switch off an optional connection for that agent. Required catalog connections remain on until you uninstall the catalog agent.
Open team settingsImage placeholder
Use a team settings page with the Connections section visible. Show the switch in its on state for one installed connection, with the selected team's name still in view.
Reconnect, remove, or disconnect
Select Reconnect when a provider token expires or the account settings change. Team grants stay in place while the account signs in again.
Need to stop one team? Switch off its grant. If nobody in the workspace needs the instance, revoke every team grant and then disconnect it. Hivy blocks revocation when an installed catalog agent requires that provider.
Select Disconnect only after removing its team grants. Hivy then revokes that saved workspace connection.
Understand connections and team accessTest the access with one real task
Start one session with an agent on the enabled team and ask it to read from the connected service. Check the result against the permitted resources; if the agent sees too much or too little, fix the connection scope or connection access before adding an automation.