Connector access control

A connector is a gateway into an external system, so Harriet controls it at four layers: which tools it exposes, how devices reach it, whose credentials each call uses, and what gets recorded.

Which tools a connector exposes

After you run Sync tools on a connector, Harriet lists every tool the server offers, and Integration settings let you govern each one: turn tools on or off, restrict them by role or group, require confirmation before risky operations, and decide which tools are allowed in sub-agents. Skills only ever see the tools you leave enabled. See Tool permissions.

Proxied or direct transport

By default, devices reach a connector through Harriet's MCP proxy: the device holds only an opaque proxy token, and Harriet forwards each call to the upstream server with the right credentials. A profile can override this per connector in its Desktop MCP transport section, choosing Proxied (via Harriet) or Direct for each eligible integration.

Direct is the exception, not the rule: only integrations Harriet marks as safe for direct access — unauthenticated native HTTP MCP servers — offer the option. OAuth and other authenticated connectors always use the proxy, because that is where the credentials live. Direct calls also bypass the proxy's audit trail, so keep sensitive connectors proxied. See Profile transport settings.

Per-user OAuth connections

Connectors that require per-user OAuth act as each person, not as the organization. Every user connects their own account — from Profile → Integrations in the Harriet web app, or through the native connect flow in Harriet Desktop — and the proxy then forwards that person's calls with their own access token. Someone using a Google Drive connector can only touch files their Google account can touch.

The upstream OAuth tokens stay on Harriet's servers and are refreshed there. The desktop app sees only the opaque proxy token, so a lost or wiped laptop does not leak upstream credentials. Until a person connects, the connector's tools are pending for them; the person and device pages in the console show these pending connections. See OAuth connections.

SSRF guard on upstream URLs

Before each proxied call, Harriet revalidates the connector's upstream URL and only allows public HTTPS hosts. A connector cannot be pointed at an internal address to use the proxy as a hop into your private network, and a URL edited after approval is caught at call time, not just at configuration time.

What the audit log records

Every proxied tool call lands in the append-only audit log with per-call status: the user, the device, the skill, the connector and MCP server it resolved to, the tool name, and whether the call succeeded — upstream failures are recorded with their HTTP status code so you can tell a vendor outage from a proxy problem. Routine noise is trimmed: successful tool listings are not logged, and the audit list hides handshake rows by default with a Show hidden option to include them.