Hosted and sandboxed connectors
Every catalog template carries one of three install modes: Hosted remote MCP, Harriet sandboxed, or Guided external setup. The mode tells you where the MCP server actually runs and what to expect at runtime.
Hosted remote MCP
The vendor operates the MCP server, and Harriet's gateway forwards tool calls to its public HTTPS endpoint. Slack, Atlassian, and Asana in the catalog work this way, pointing at the vendors' official remote servers.
This is the lowest-maintenance mode: no package to run, and the vendor keeps the tools current. These templates typically use per-user OAuth, so each call runs with the permissions of the person who made it.
Harriet sandboxed
Harriet runs the MCP server itself, inside an isolated sandbox. The connector specifies a package command (npx or uvx plus arguments), and Harriet executes it in that environment — the catalog's Google Drive and Google Docs templates run community MCP packages this way.
Sandboxes are started on demand, and a cold start can take longer than a normal web request. Rather than time out, Harriet answers some sandboxed calls with a background job that the desktop app polls until the result is ready. In practice this means an async job may return its result a little later than a hosted call would; the bridge on the device handles the waiting transparently, so people just see the tool take a moment longer.
Harriet softens this in two ways: it warms sandboxes in the background when a session starts, and it caches each server's tool list so the tools appear immediately while the live server spins up.
Sandboxed mode is also the escape hatch for anything not in the catalog: the Create custom MCP (npx / uvx) link in the Add connector dialog registers your own package the same way. See Custom MCP servers.
Guided external setup
Some apps need work outside Harriet before a connector can function, typically registering an app in the vendor's own admin console and granting it permissions there. Guided templates, like Microsoft 365 in the catalog, walk an admin through that setup and collect the resulting details. After the guided steps, the connector behaves like a hosted remote MCP.
Choosing between them
| Mode | Server runs | Fits when |
|---|---|---|
| Hosted remote MCP | On the vendor's infrastructure | The vendor publishes an official remote MCP server (Slack, Atlassian, Asana) |
| Harriet sandboxed | In Harriet's sandbox | The integration exists as a runnable MCP package rather than a hosted endpoint |
| Guided external setup | On the vendor's infrastructure, after admin-side setup | The vendor requires app registration or tenant configuration first (Microsoft 365) |
Whatever the mode, calls flow through Harriet's gateway with the same tool permissions and the same audit log. Only public HTTPS hosts are allowed upstream, and hosted server URLs are revalidated before each call.