> This page is for Workforce.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.merge.dev/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.merge.dev/_mcp/server.

# Overview

> What a Connector is in Merge, how to authorize one for your organization, whose credentials a tool call runs under, and how Tool Packs and Groups decide who can use it.

A Connector is a maintained integration to one company system: Slack, Jira, Salesforce, Google Drive. Merge builds and tests it, keeps its tools working across the vendor's API versions, and tunes each tool's description so a model picks the right one instead of guessing.

Authorizing a Connector does not give anyone access to it. It makes the Connector available to your organization. [Tool Packs](/merge-workforce/tool-packs/overview) decide which of its tools exist as a bundle, and [Groups](/merge-workforce/provisioning/groups) decide which employees get that bundle.

Hundreds of Connectors ship ready to use. The full catalog, tool by tool, is at [Browse Connectors](/merge-workforce/connectors/browse). For a system the catalog doesn't cover, register your own MCP server as a [custom MCP server](/merge-workforce/connectors/custom-mcp-servers).

## Browse the catalog

**Connectors** in the [Workforce console](https://wf-develop.merge.dev/connectors) is your organization's catalog. Search by name, or filter by configuration status to find the Connectors that still need you.

| Status              | What it means                                                                             |
| ------------------- | ----------------------------------------------------------------------------------------- |
| **Action required** | The provider requires your own OAuth app, and employee connections fail until you add one |
| **Not configured**  | No organization credentials are set, and employees authenticate with their own secrets    |
| **Configured**      | A credential is registered, either the OAuth app you registered or Merge's default app    |
| **No setup needed** | The Connector needs no organization-level credentials                                     |

The **Ready to use** filter is the one to reach for when you want everything an employee could connect today, which is every status except Action required.

## Authorize a Connector

Open a Connector from the catalog and it has up to three tabs.

| Tab                         | What you do there                                                                                            |
| --------------------------- | ------------------------------------------------------------------------------------------------------------ |
| **Overview**                | Read every tool the Connector exposes, and rewrite a tool's description or pin its inputs                    |
| **Tool Packs**              | See which Tool Packs already grant this Connector, so you know who is reaching it before you change anything |
| **Application Credentials** | Register your own OAuth app and set the scopes it requests                                                   |

Most Connectors work without touching Application Credentials: employees authenticate against Merge's OAuth app, and their consent screen names Merge. Register your own when you want the consent screen to name your company, rate limits scoped to your own traffic, or a smaller scope set than the default. A Connector marked **Action required** ships with no shared OAuth app at all and authenticates nobody until you add one. See [Application credentials](/merge-workforce/connectors/application-credentials).

## Whose credentials the call runs under

Nothing runs as a service account. The first time an employee's AI reaches a Connector, the employee authenticates it themselves, and the token Workforce stores is theirs. A Jira call from their agent lands as that person, with the permissions Jira already gives them, and appears in Jira's own audit log under their name. Revoke them in Jira and the calls stop, whatever Workforce says.

That is the property most of your access model rests on: your existing per-system permissions keep holding without being restated here, and an employee's AI can never reach further into a system than the employee can.

## Grant access to it

Authorizing a Connector and granting access to it are separate steps, in this order:

1. Authorize the Connector, adding Application Credentials if it needs them
2. Add it to a [Tool Pack](/merge-workforce/tool-packs/overview) and pick the specific tools you want exposed. Most Connectors expose dozens.
3. Assign that Tool Pack to a [Group](/merge-workforce/provisioning/groups) from your identity provider

An employee whose Group grants the Tool Pack sees those tools on their consent screen the next time their client lists tools. Ask for a tool outside that set and the call fails, then surfaces in your dashboard as an [access request](/merge-workforce/requests) you can approve.

## Next steps

#### [Application credentials](/merge-workforce/connectors/application-credentials)

Bring your own OAuth app so employee consent screens name your company, not Merge

#### [Tool Packs](/merge-workforce/tool-packs/overview)

Bundle the Connectors and the specific tools you want employees to reach

#### [Groups and access](/merge-workforce/provisioning/groups)

Assign Tool Packs to the Groups your identity provider already maintains

#### [Browse Connectors](/merge-workforce/connectors/browse)

The full catalog, with the tools each Connector exposes