Google Analytics, Vercel Web Analytics, Leadsy and the TikTok Pixel stay off until you accept. The help chat starts once you have chosen. The scheduling button starts once you have chosen. Read our Privacy Policy.
Connect a tool that is not in the list through its MCP server or its REST API. Reads and plain changes run on their own; sends, deletes, and money wait for you.
Many tools now offer an MCP server, the standard way AI assistants connect to a service, and many more publish a REST API with an OpenAPI description. When a tool you use is not in the list, you can connect it yourself, and your assistants use it like any other integration.
Its address, and its key (in the Authorization header or a header of its own), a username and password, or a sign-in to the tool
A REST API
Its base address, its OpenAPI description (pasted, or the address it is published at), and its key or a username and password
Use the address from the tool's own documentation. Never put a key in an address: it goes in the key field, where it is stored encrypted and never shown back.
Anything that creates or changes something you asked for
Runs on its own
Anything that sends, publishes, deletes, closes, or spends money
Waits for your Approve
StellarFirm decides what a tool may do by itself, not by what the tool says about itself:
On an MCP server, a tool counts as reading only when the server marks it as read-only, and its name has a reading word (search, get, list, read) and no word for a change anywhere in it (create, update, delete, send, insert, and the like). Query and check are not reading words here, since a query or a check-in can change things. Anything else counts as a change: it runs on its own unless its name says it sends, publishes, deletes, closes, or spends money, and then it waits for your Approve.
On a REST API, the method decides: GET reads, POST, PUT, and PATCH are changes that run on their own, and DELETE waits for your Approve. A GET whose name has a word for a change, such as getOrCreatePet, counts as a change too.
Give it a name and one sentence on what it holds. Your assistants read that sentence to know when to use it.
Paste the address and the key, or choose Username and application password and enter both (a WordPress site gives you an application password under Users, Profile), or choose that you sign in to it.
Choose who uses it: only you, every assistant, or the assistants you pick.
Press Connect and save. StellarFirm checks it first and keeps it only once it answers. For a sign-in, press Sign in and finish in the tool's own page.
Some tools take a sign-in instead of a key. StellarFirm signs in the standard way for MCP servers, with your browser and the tool's own page, and renews the sign-in on its own. If the tool signs in only apps registered with it, register one with the address the page shows, then paste its client id (and its secret, if it has one).
Use a key with only the access your assistants need. A read-only key is the safest. For a username and password, use an account with only the access your assistants need; the password is stored encrypted and never shown back, but the username is shown so you can change it.
Only add tools you trust. A tool you add reads what your assistants send it, and what it answers reaches their work.
StellarFirm reaches only public addresses. It does not connect to a server on your own network.
Switch it off or remove it at any time. Removing it deletes its key at once.
Changing its address signs it out, and moving it to another host also deletes its saved key, so a key never reaches a host it was not given for. Paste the key again, or sign in again.