Integrations

Integrations connect Frazer to the services you already use: source control, identity, chat and on-call, issue trackers, DNS, model providers, knowledge sources and agent tools. An admin connects each service once, with your organization’s app or bot identity, not a person’s account. Projects, devboxes, agents and knowledge bases then use it through grants that name capabilities, not tokens. Credentials stay in Frazer Secrets: workloads get a token of an hour or less, or nothing at all.

Product page: Integrations.

How it works

• Integration: a catalog entry, published by Frazer or a verified partner. It declares its capabilities, the provider scopes each one needs, its auth methods, and what leaves Frazer and what Frazer stores.
• Connection: an installed integration (projects/{project}/connections/{connection}) with the outside account, the identity it acts as (org or person), the scopes granted, an owner and a health state. It holds a reference to the credential, never the value. A connection lives in one project and is shared with other projects of the organization.
• Grant: who may use a connection (a project, a project’s environment, a devbox profile, an agent, a knowledge base or a service account), for which capabilities and resources (Slack channels, GitHub repositories, a DNS zone), in use or read mode, optionally until a date.
• Personal connection: a person’s own account (users/{user}/connections/{connection}), such as a developer’s own Linear or GitHub login.

Each product that needs an outside credential binds to a connection by name: alert channels, LLM gateway providers, knowledge sources, DNS zones, registry upstreams and imports, secrets imports and export sinks. The product owns the behavior; Integrations owns the credential, its health and who may use it.

Capabilities first

A grant names capabilities, such as notify.send or issues.write. The connection asks the provider only for the scopes its granted capabilities need. Adding a capability that needs new scopes runs consent again, and an approval if your organization’s policy asks for one. Removing a capability narrows the token on its next mint.

How credentials flow

Method	Used for	What reaches a workload, devbox or agent
Federation, no stored key	Imports, DNS providers, model providers, exports, CI	A provider token of 1 hour at most, minted for each use
App installation	GitHub, Slack, Teams, Linear	An installation token of 1 hour narrowed to the granted resources, or nothing
OAuth with refresh	Knowledge sources, issue trackers	An access token of 1 hour at most, or nothing
Scoped API key	DNS tokens, paging keys, model providers	Never the key: the egress gateway or the LLM gateway injects it
Static secret	Webhook URLs, passwords	Never

Frazer Secrets is the only store, write-only for every role; the console shows a fingerprint and the age, never the value. The credential broker is the only reader, and it writes an audit line for every token it mints. Mounting a connection’s secret into a workload is an explicit plan on that service. Rotation is on wherever the provider offers it; a key that cannot rotate shows its age, and after 90 days a Rotate action.

Outside clouds

Your images, secrets, logs and metrics live on Frazer. An outside cloud connects in one of six roles:

Role	What it means
Import source	Read once, or sync for a migration window (90 days by default), into a Frazer service
Upstream	A pull-through cache in Frazer Registry; Frazer keeps the copy
Your DNS	You keep your DNS provider; Frazer writes one zone
Identity provider	People sign in and groups sync
Export destination	A copy of Frazer data goes out; the original stays
Your servers	Machines you already have join Frazer

Model providers are LLM gateway upstreams: requests leave Frazer by design, and each step is labeled with its data policy.

The catalog

The catalog has 215 integrations in 21 categories. Every integration page has the same parts: what Frazer does with it, the capabilities and the scopes they need, the data flow, the auth method, and whether it works with agents.

Category	Entries	Work with agents	For example
Source control and CI/CD	16	1	GitHub, GitHub Enterprise Server, GitLab (SaaS and self-managed)
Identity and SSO	11	0	Google (sign-in), GitHub (identity link), Google Workspace
Communication and on-call	15	1	Email, Slack, Microsoft Teams
Issue tracking	9	3	Linear, Jira, GitHub Issues
Observability	14	1	OpenTelemetry (OTLP), Prometheus remote write, Grafana Cloud
Security	16	0	Splunk (SIEM), Microsoft Sentinel, Google Security Operations
Registries and upstreams	12	0	Docker Hub, GitHub Container Registry, Quay.io
Secrets import	10	0	Google Secret Manager, AWS Secrets Manager, AWS Systems Manager Parameter Store
DNS providers	11	0	Frazer DNS, Cloudflare DNS, Amazon Route 53
CDN and edge	4	0	Cloudflare, Fastly, Bunny.net
Servers and clouds	11	0	OVHcloud, Hetzner, Latitude.sh
Kubernetes, IaC, portals	6	0	Attached Kubernetes clusters, Terraform, OpenTofu
Data	8	0	S3-compatible storage (S3, R2, B2, Wasabi, MinIO), Google Cloud Storage, Azure Blob Storage
AI providers	16	0	Anthropic, OpenAI, Google Gemini API
AI tools	9	0	Hugging Face, Weights & Biases, MLflow (external)
Knowledge sources	13	1	Google Drive, Website, Upload and push API
Agent tools (MCP)	14	14	Frazer MCP server, Frazer Knowledge MCP, GitHub MCP server
Dev tools and gateways	9	0	Frazer app, Frazer extension for VS Code, Other VS Code-based editors
Billing	3	0	Stripe, Billing export (FOCUS), Partner resources on the Frazer bill
Status pages	4	0	Frazer status pages, Atlassian Statuspage, Instatus
Automation	4	0	Webhooks, Zapier, Make

Every tile names who built it:

• By Frazer: built and operated by Frazer, with Frazer support.
• Verified: the publisher’s domain, 2FA, privacy policy, support and security contacts and least-privilege scopes are reviewed every year. Frazer does not audit their code.
• Community: automated checks only. Community integrations are off by default for new organizations, and installing one shows a warning.

Other vendors’ MCP servers are listed only after Frazer checks the vendor’s server. Browse and filter the catalog at frazer.ai/integrations, or in the console in your organization’s Settings › Integrations › Catalog.

Connect an integration

1. Find the integration and read what it needs.

   frazer integrations list --category dns
   frazer integrations get slack

2. Install it. Owners and Admins install; a Developer’s Install sends an install request to IAM › Approvals.

   CLI

   frazer integrations install linear --capability issues.write,knowledge.read \
     --grant project=acme-production:issues.write --grant kb=acme-company:knowledge.read

   Console

   In your organization’s Settings › Integrations › Catalog, choose the integration and select Install. Pick the account, consent to the capabilities and the scopes they need, add grants and test the connection. The plan on the right lists everything the install changes.

3. Test it. A new connection is verified at install; run a check at any time:

   frazer integrations connections test cloudflare-dns-acme

4. Grant it to another project:

   frazer integrations connections grant slack-acme --project acme-staging \
     --capability notify.send --resource "#acme-staging"

Grant and share a connection

A connection carries its grants and the projects it is shared with. This one posts alerts and approvals in production, indexes two channels into a knowledge base, and is shared with staging for one channel:

slack-acme (connection)

integration: integrations/slack
account: T01EXAMPLE # the Acme workspace
authKind: oauth
actor: org # installed as the Frazer bot, not as a person
capabilities: [notify.send, approvals.respond, knowledge.read]
owner: users/lena
grants:
  - principal: projects/acme-production
    capabilities: [notify.send, approvals.respond]
    resources: ["#acme-alerts", "#acme-deploys"]
  - principal: projects/acme-production/knowledgeBases/acme-company
    capabilities: [knowledge.read]
    resources: ["#eng", "#product"]
shareSettings:
  shareType: SPECIFIC_PROJECTS
  projectMap:
    acme-staging: { capabilities: [notify.send], resources: ["#acme-staging"] }

A project’s Settings › Integrations page shows the connections it may use, with their capabilities, and a Request access action for the others. A grant to a project labeled production needs an approval when the capability writes outside Frazer.

Use connections from agents

Every MCP server that an agent, a devbox or the Frazer app uses through Frazer goes through the Frazer MCP gateway.

• The agent sees mcp.frazer.ai/c/{connection} with a Frazer token of 1 hour at most. The gateway calls the vendor’s server with a token minted from the connection; your token never passes through.
• A grant to an agent lists the tools it may call. Tools are read-only by default; write tools are opted in per grant, and writes to Frazer resources become plans that wait for approval.
• The gateway pins each tool’s name, description and schema when you grant it. If the vendor changes them, the tool is held until an admin approves it again.
• A session that has read untrusted content cannot call an outbound tool (a Slack post, a webhook, an email) without approval.
• Your organization’s allowed MCP servers are published as a registry at mcp.frazer.ai/registry/v0.1/servers, so editors that support registry allowlists can lock to it.

Aggregators such as Composio, Zapier MCP and Pipedream Connect are ordinary connections on your own account; the per-grant tool list still applies.

Keep connections healthy

State	Meaning	What Frazer does
Healthy	The last check and the last use succeeded	—
Expiring	A token, key or certificate expires within 30 days, or an import window ends within 7	Emails the owner and Admins at 30, 7 and 1 days; a banner on the connection
Needs re-auth	Revoked, password changed, refresh failed, or the installer’s account was removed at the provider	Stops using it, keeps the grants, offers one Reconnect action and shows the affected projects
Degraded	Rate-limited, partial permissions, a provider incident, or no data for 1 hour from an export or source	Backs off; the banner names the provider’s status
Error	Repeated failures for another reason	Shows the request ID and the provider’s response
Paused	An admin paused it, or auth failed for 3 days	Mints nothing; Resume takes effect at once

Frazer checks every connection at install, every hour with a cheap identity call, and on every use.

frazer integrations connections list --health needs-reauth
frazer integrations connections rotate r2-acme-ml

Every connection has an owner, a person or a service account. When the owner leaves, a connection that uses the organization’s identity keeps working and a Transfer owner task appears. A connection bound to the person’s own account at the provider moves to Needs re-auth with the reason.

Import, export and remove

Imports are jobs on a connection, run once or synced for a window of 90 days by default. When the window ends the connection stops, so a migration never leaves a permanent link to the old cloud. Each import writes a report of what was copied, skipped or failed, with digests or secret names, never values.

Exports feed product sinks: logs, metrics, traces, security findings (OCSF), audit and billing (FOCUS). An export never replaces Frazer’s copy, ships a dashboard of its own delivery health, and meters its egress, with an estimate when you create it.

Removing a connection is a plan. It lists every grant and product binding that stops working, and it never deletes your content: dashboards, alert policies and knowledge documents stay, labeled source disconnected. Where the provider’s API allows, Frazer also uninstalls its app or revokes its token there, and shows that as a step.

Access and audit

Control	Default
Who may install	Owners and Admins; Developers send an install request to Approvals
Who may grant	Organization Admins, and Project Admins for connections already allowed in their project
Production projects	A grant that writes outside Frazer needs an approval
Allowed publishers	By Frazer and Verified; Community off
Category rules	A deny rule can block a category, such as every model provider but one
Agents	MCP tools only through grants, read-only by default
Kill switch	Pause all connections stops every mint and delivery in one audited action

A category rule is a CEL condition, for example integration.category == "aiprov" && integration.id != "anthropic".

Audit events cover connections (integrations.connection.create, delete, pause, resume, reconnect, rotate, transfer_owner, scopes_updated, health_changed), grants (integrations.grant.create, update, delete), install requests (integrations.installRequests.create, approve, deny) and one integrations.connections.mintToken per token the broker mints, with the connection, capability, principal and lifetime. They appear in the organization’s audit log, the connection’s Activity tab and the audit export.

Limits and quotas

Limit	Default
Tokens from the broker	1 hour at most
Health checks	At install, hourly and on every use
Expiry emails	30, 7 and 1 days before
Import window	90 days
Auth failures before a connection pauses	3 days
Key age before Rotate is offered	90 days
No data before an export or source is Degraded	1 hour

Pricing

Integrations and connections are included in every organization. Exports meter their egress.

Integrations	On your servers	On the Frazer fleet
Price	Included	Included

Every line, with the estimator: pricing.

Troubleshooting

• A connection shows Needs re-auth. The token was revoked, a password changed, a refresh failed, or the installer’s account was removed at the provider. Choose Reconnect: the grants stay as they are.
• A connection is Paused. An admin paused it, or auth failed for 3 days. Fix the cause, then Resume it.
• A connection is Degraded. The provider is rate-limiting, permissions are partial, the provider has an incident, or an export or source sent no data for an hour. The banner names the provider’s status.
• A Developer cannot install an integration. Installs need an Owner or Admin. Install sends an install request to Approvals instead.
• A grant to a production project is waiting. The capability writes outside Frazer, so the grant needs an approval.
• An agent cannot call a vendor’s tool. The tool is not in the agent’s grant, it is a write tool the grant does not allow, or the vendor changed its description and it is held until an admin approves it again.
• Removing a Slack capability did not remove its scopes. Slack scopes only grow. The connection says so and offers to reinstall the app with fewer scopes.

Tip

Prefer the organization’s identity when you install: a connection made with a bot or an app keeps working when the person who installed it leaves.

Reference

CLI

Command	What it does
frazer integrations list	List the catalog, filtered by category, installed state or agent support.
frazer integrations get	Show an integration's capabilities, provider scopes and data flow.
frazer integrations install	Install an integration as a connection, with its capabilities and grants.
frazer integrations connections list	List connections, filtered by health.
frazer integrations connections grant	Grant a connection's capabilities to a project, on chosen resources.
frazer integrations connections test	Verify a connection against the provider now.
frazer integrations connections rotate	Rotate a connection's credential. Takes effect at once and is audited.

All of them: CLI reference.

Terraform and OpenTofu

Resource	What it manages
frazer_integrations_connection	A connection to an outside service; credentials are write-only attributes.
frazer_integrations_connection_grant	Who may use a connection, for which capabilities and resources.

All of them: Terraform and OpenTofu reference.

Events

Event type	When it is sent
frazer.connection.health_changed.v1	A connection moved to another health state.
frazer.connection.expiring.v1	A connection's token, key or certificate expires within 30 days, or its import window ends within 7.

All of them: Events reference.

On mcp.frazer.ai the toolset integrations reads the catalog and connections; installs need approval. The API is IntegrationsService, ConnectionsService and GrantsService. To build an app on Frazer, register an OAuth app on the Developer tab of your organization’s Settings › Integrations.

Related

• Webhooks and events: events out, signed with Standard Webhooks.
• Frazer Agents: agents use connections through grants.
• Secrets: where connection credentials are stored.
• LLM gateway: model providers as connections.
• Knowledge: knowledge sources read through connections.
• Integrations: the product page and the full catalog.