Manage your connections with MCP

What Arc0 does

Arc0 connects your apps to your AI agents through one MCP endpoint. Your agent can discover tools, request a hosted connection link, and act using the accounts you authorize. Connection self-service shows only accounts you own in the selected project. Group-owned accounts and accounts shared with you stay hidden from these management tools.

Connect an app

Ask your agent to call manage_connections with operation: "list_apps" to find enabled apps and your connected state. Use operation: "connect" with the app identifier to request a hosted link. Open the link yourself and enter credentials only on the hosted form or the provider's consent page. Never paste passwords, API keys, or OAuth tokens into chat. Hosted links work once and expire after 10 minutes.

Check status and reconnect

Use operation: "list" to list your connections, then operation: "status" with a connectionId to check one account. active means the connection is admitted for use; healthStatus: "degraded" indicates renewal failures. reconnect_required means fresh authorization is needed. revoking means Arc0 has blocked further use and queued cleanup; revoked means that cleanup has finished. Use operation: "reconnect" with the same connection ID to get a hosted link for that account. The existing account identity, authentication method and settings are preserved. Reconnect is available for active connections and connections requiring reconnection; a revoked account needs a new connection.

Revoke access

First identify the account with list or status. Ask the user to confirm disconnecting that specific account before calling operation: "revoke" with its connectionId and confirm: true. Without confirmation the tool returns confirmation_required. Revocation immediately blocks new use of the connection in Arc0 and queues provider cleanup. Some providers cannot revoke a grant through their API, so remove the grant or rotate the credential in the provider's settings to fully revoke access there. Revoking a connection does not delete the provider account or its data. A user-bound runtime key needs the connect permission for connect, reconnect and revoke; an execute-only key can read its own connection state.

Identity and access

Sign in to your MCP client and select your Arc0 account. For an app that embeds Arc0, use the app's identity-linking flow for your own MCP client, or let the app's backend issue a short-lived user-bound runtime key for its agent. Your identity and project come from that authorization. These tools cannot select another user or project, manage group/shared credentials, change business settings, or issue keys. If authorization is removed, later tool calls fail.

Data handling

Connection tools return account labels, connection IDs and status, never stored credentials. Arc0 stores provider credentials encrypted and refreshes supported tokens on your behalf. Tool execution sends the requested operation and arguments to the connected provider, and returned provider content must be treated as untrusted data. Disconnecting queues credential cleanup; it does not erase existing audit records or provider data. Do not send secrets to arc0_help: it only searches this end-user guide and returns excerpts with source links.