AI Integrations

AI Integrations lets you connect external AI tools to your Stardeck organization. Once connected, those tools can read your knowledge store, query your data stores, list your apps, and call cross-app endpoints. These are the same capabilities Starcat uses.

flowchart LR
    CC["💻 Your AI tool\n(Claude, Codex, ChatGPT, etc.)"] -- "OAuth (MCP)" --> GW["☁️ Stardeck gateway"]
    GW --> K["Knowledge store"]
    GW --> D["Data stores"]
    GW --> A["Apps & cross-app calls"]
    GW --> DP["Deploys & app settings"]
    GW --> N["Domains & DNS"]
    GW --> C["Customer directory"]
    GW --> O["Errors, logs & uptime"]
    GW --> M["Modules & platform updates"]
    GW --> R["Roles"]

The connection is a standard MCP server over HTTP. Any client that supports OAuth-based MCP can connect.

Building an app locally with Claude Code, Codex, Cursor, or another coding agent? Run npm run setup in your checkout. See Connect Your Agent.

What you can doCopy Anchor Link

Once connected, your AI tool can:

• Read and search the knowledge store: ask questions about policies, SOPs, brand guidelines, or any reference material your org has stored
• Query data stores: list stores, inspect schema, run queries against your live data, and with write access change data or schema
• Discover and call apps: list apps in the org, see which endpoints allow agent calls, and call them, useful for triggering workflows or reading app state
• Deploy apps and read deploy history: deploy an app to production or a branch preview, then check its deploy status and build logs
• Read and change app settings: sign-in, environment variables, domains, cross-app, payments, and more. Every change asks you to confirm first.
• Manage DNS records: on domains registered through Stardeck
• Search and update customers: the customer directory, including contacts and group memberships
• Debug errors and uptime: list and resolve an app's errors, read its worker logs, and manage its uptime monitors
• Manage Google Sheets syncs: connect an app's spreadsheet tab to a data store table
• Manage Modules and updates: turn Modules on or off, and take Stardeck updates in a local checkout
• Work on app code across your org: with a role that holds Repository access, clone any app and pull the environment to run it locally, so one Claude Code session builds across several apps at once. See Work Across Every App.
• Run tests: run an app's test suite in its cloud sandbox and read the results
• Manage the team: list members and invitations, and with an org admin's connection invite, re-role and remove them
• Look up roles and permissions: understand who has access to what, and what the connected session itself can do

Each capability is gated by the role you pick and the access level you choose. Tools & Permissions lists the permission for each tool group.

For a script that syncs knowledge items without an AI tool, use the REST API with an org API key.

Role bindingCopy Anchor Link

When you authorize a connection, you pick which organization role the session acts as. The role controls which tools appear: a viewer role gets read-only knowledge and data access, while an admin role gets the full surface. You can change the role (or revoke access) any time from the Agents page in your organization dashboard, without needing to re-authorize.

The role is enforced per request, not just at authorization time. If you remove the role or leave the org, access stops immediately.

Access levelsCopy Anchor Link

At authorization you also choose an access level:

Both levels are further controlled by the role's permissions. Read & write won't grant write tools if the role doesn't hold the matching write permission.

Security modelCopy Anchor Link

Every connection has two independent gates:

• Who can connect: you must be a member of the org and sign in during authorization. A token issued for one org can't reach another.
• What the connection can do: the role you pick. The token proves identity; the role decides capability.

Additional controls:

• Off by default: no external tool can connect until a member in your org explicitly authorizes one.
• Revocable at any time: org admins (or members with the Manage AI Connectors permission) can revoke any connector from the Agents page; members can always revoke their own. Access stops on the next request after revocation.
• No stored secret in client config: authorization happens in your browser. The server URL you add to your client is public and safe to commit.
• Audited: every tool call is logged and tagged so it's distinguishable from Starcat's own agent activity.
• Browser sign-in is opt-in and narrow: a connection can sign a browser in to one app only when Allow agents to access is on and its role has the browser permissions (Admin only by default). The browser reaches that one app for up to 30 minutes, never your dashboard, and its clicks are real. See Opening an app in your browser.

Let your agent read these docsCopy Anchor Link

These docs have their own MCP server and plain-text index, so your agent can look up how Stardeck works while it builds. This is separate from the Stardeck MCP server above: it serves only these public docs and has no access to your organization.

Add the docs server to Claude Code:

claude mcp add --transport http stardeck-docs https://docs.stardeck.ai/mcp

Your organization's tools still come from https://www.stardeck.ai/api/mcp. See Connect Your Agent.

Next stepsCopy Anchor Link