Connections - Deco CMS

What are connections?

Connections are the tools and services you’ve plugged into Studio — GitHub, Slack, a database, your own API, or any other MCP-compatible service.

You set up a connection once. From then on, anyone in your org can attach it to an agent without ever touching credentials.

Where they live

Connections are managed at the organization level under Settings → Connections. That’s where you:

Browse the catalog of available MCPs and install a new one
Add a Custom Connection for an MCP server that isn’t in the catalog
Configure credentials for an existing connection
Update or revoke credentials in one place

The catalog is fed by the registries you have enabled — see Store to add or toggle registries (Deco Store, community, private).

To put a connection to work, attach it to an agent: inside the agent, open the right-panel Settings tab and pick the connection (and the specific tools from it) you want this agent to use.

Why connections exist

Without a central place for tools, every person and every AI client manages their own credentials. Rotate a password? Update it in ten places. Revoke someone’s access? Hope they’re not using a hardcoded key somewhere.

Connections solve this by being the single source of truth:

Credentials stored once — encrypted at rest, decrypted only when a tool is called
Shared across your team — anyone with access can use the tool without seeing the credentials
Easy to update — change credentials in one place; every agent picks it up automatically
Easy to revoke — remove a connection and nobody can use it, immediately
Fully logged — every tool call is recorded under Settings → Monitor

Types of connections

SaaS apps — GitHub, Slack, Notion, Google Drive, and similar services. Most connect with one-click OAuth, so you never copy a token.

Infrastructure — Databases, cloud APIs, internal services. You configure the endpoint and credentials, Studio handles the rest.

Custom tools — Your own MCP server exposing domain-specific operations. Plug it in and share it like any other connection.

All connection types work the same way: configure once at the org level, attach to whichever agents need them.

Transports

Under the hood, every connection uses one of these transports. You don’t usually need to think about it — Studio picks the right form based on the catalog entry or what you paste into Custom Connection — but it matters when you’re wiring up an MCP server yourself:

Transport	When to use
HTTP	The default for hosted MCP servers. JSON-RPC over HTTP.
SSE	Server-Sent Events — for HTTP servers that stream long-running tool results.
WebSocket	Bidirectional streaming for MCP servers that need a persistent socket.
STDIO	Spawn a local process and speak MCP over its stdin/stdout. Used by CLI-style MCPs in local self-host.
Virtual	The agent endpoint itself — a composed MCP made of other connections, served by Studio.

How a tool call works

When an agent calls a tool through a connection:

The agent authenticates to Studio
Studio checks that it has permission to use that tool
Studio retrieves the stored credentials for the connection
Studio sends the request to the external service
Studio logs the call (tool, timing, inputs, outputs, status)
Studio returns the result to the agent

The external service never sees your agent directly — only Studio. Credentials never leave Studio’s secure boundary.

 GitHub Connection  ──┐
Slack Connection   ──┼──▶ Agent ──▶ Your team or other clients
Database Connection──┘

Connecting AI clients to Studio

Once your agents are wired up, point external AI clients (Claude Desktop, Cursor, custom MCP apps) at an agent’s MCP endpoint to use its tools.

For interactive clients — use OAuth, which handles sign-in and per-user identity
For automation and server-to-server — use API keys, faster to set up and ideal for scripts or unattended runs

Use an Agent when you want a single endpoint exposing a curated set of tools. Use the connection proxy URL only if you need raw access to a single connection.