hivy
Documentation
DocumentationConnections and skills

Connections and team access

A workspace connection opens access for selected teams. Each agent can narrow optional access without changing the team grant.

Create as many connection instances as the workspace needs, then grant each concrete instance to the teams that may use it. You don't need a separate sign-in for every agent.

Follow the four layers of access

A connection alone doesn't open an external service to an agent. Hivy checks the connection instance, team grant, and agent setting whenever an agent calls its generated MCP server.

  1. 01

    Connection

    One workspace account signs in to an external service; owners and admins look after the connection.

  2. 02

    Team grant

    An admin grants one concrete connection instance to a team. Every agent on that team can use its MCP server.

  3. 03

    Agent switch

    An optional connection can be switched off for one agent without changing the team grant. Required catalog connections stay on.

  4. 04

    Generated MCP tools

    The connection exposes its capabilities directly as generated MCP tools; no bundled skill is installed.

Video placeholder

Trace an agent's tool access

Record an admin creating a second provider connection, granting that exact instance to a team, and showing its generated MCP tools becoming available.

Connections are workspace-level instances

Hivy calls the approved link to an external account a connection. Slack, GitHub, Notion, and Google Drive connections can use OAuth or provider-specific sign-in; other services may ask for an API key or basic authentication.

A connection does not give agents access on its own. An admin must grant that exact instance to the agent's team. The same provider can have multiple independently named instances.

Connections expose generated MCP tools

Once a connection is granted to a team, its generated MCP server is available to that team's agents. Provider operations appear as tools directly.

Revoke the connection grant to remove its generated MCP access. Team-owned and workspace-owned skills remain independent resources.

Connect and configure a tool

Image placeholder

Connection grant and generated tools

Use team settings with one concrete connection instance enabled and its generated MCP tools visible at a readable size.

Team grants open access; agent switches narrow it

Creating a connection adds an instance to the workspace, not every team. An owner or admin opens team settings and switches that instance on; every agent on that team can receive the grant.

Open an agent's settings to switch off an optional connection for that agent only. A catalog agent's required connections are locked on. Switch off the team grant when every agent on the team should lose access; other teams keep their own grants.

Learn how teams control access

Skills are first-class resources

Team members can create, edit, and archive skills owned by any team they belong to. Those skills are available to agents on that team without a connection.

Workspace admins can also create workspace skills and grant them to one or more teams.

Configure an agent

Know who can change access

Workspace owners and admins
They create external account connections, control resources, grant connection instances to teams, and manage workspace skills.
Team members
They can inspect their teams' connections and create, edit, or archive team-owned skills.
Agents
Agents receive team-owned skills, workspace skills granted to their team, and generated MCP tools from their team's connections.

Change the smallest boundary that solves the problem

Switch off one agent's optional connection when only that agent should lose it. Revoke a team grant when the whole team should lose access. Disconnect an account only after every team has finished with that concrete instance. Manage independent team and workspace skills from Settings → Skills.