544 connectors, zero Python
Every service is a declarative YAML spec — the runtime, vault, and adapters are shared. New service = download a spec file.
Every SaaS account,
one YAML file.
ConnectKit turns user SaaS accounts into agent tools — 544 connectors defined as declarative YAML specs, a local OAuth router, an encrypted per-user vault, and CLI or MCP adapters. No hosted platform, no DevOps pipeline per service.
v0.1.5 What's new
What it gives you
Account-connected tools without renting the runtime.
Universal OAuth router
One login/callback flow for OAuth2, API key, basic, and none — with encrypted, self-contained state (10-minute TTL) and automatic token refresh.
Encrypted local vault
Per-user SQLite vaults with Fernet encryption; WAL mode, expiry tracking, and a 30-second race buffer on refresh checks.
CLI adapters
Wrap tools your users already have — gws, gh, aws, docker — and inject per-user credentials into the subprocess environment.
MCP adapters
Spawn real MCP servers per connected service with token injection; tools are namespaced and discovered at runtime.
Agent-managed tooling
Five meta-tools let the agent list, connect, disconnect, health-check, and install connectors by itself — no human in the loop.
Architecture
Specs, vault, runtime, adapters, and OAuth in one local package.
ConnectKit loads connector specs, checks each user's encrypted vault, discovers tools for connected services, and returns framework-agnostic ToolSpec definitions any SDK — OpenAI, Anthropic, LangChain, or Assistant — can adapt with minimal glue.
ConnectorRuntime
Loads YAML specs, checks connection state, selects adapters, and discovers tools. Refreshes OAuth tokens and spawns MCP servers per connected service.
CredentialVault
Encrypted SQLite storage for per-user OAuth tokens, API keys, and connection metadata. Tracks expiry; refresh_all() on connect.
OAuth router
FastAPI routes for login, callback, status, and state validation — supports oauth2, api_key, basic, and none. State is Fernet-encrypted and self-contained.
ToolSpec adapters
Tool descriptions ship as JSON Schema — type-aware parameters the LLM can reason over — via CLI and MCP adapters; model_dump_tool() ports to any SDK.
Why it matters
Own the bridge between users and tools.
No hosted connector platform required — the OAuth router and vault run locally.
Tool descriptions are JSON Schema, not prose — optimized for LLM tool-calling, not human docs.
Token refresh is automatic — agents never see expired credentials.
Self-hosted services work out of the box via base_url on any connector spec (Firecrawl, Sentry, GitLab, ...).
ToolSpec is the adapter boundary — Assistant, OpenAI, LangChain, and Anthropic adapt with a few lines of glue.
Best fit for developer-controlled agents where users can install CLIs or run MCP servers.
Compared to alternatives
Nango-style auth meets agent-native local tools.
Hosted platforms like Composio, Pipedream, Zapier, and Arcade offer huge catalogs. ConnectKit is for teams that want the connector runtime, vault, and specs under their own control.
Versus Nango
Nango is strong product integration infrastructure. ConnectKit borrows the provider-catalog idea but focuses on local agent tools, encrypted local vaults, and CLI/MCP execution.
Versus Composio and Arcade
Those are polished agent-tool platforms with managed auth, per-action pricing, and their cloud in the path. ConnectKit trades hosted convenience for local control: your vault, your specs, no per-call fees.
Versus Zapier and Pipedream
Zapier and Pipedream win on breadth and no-code automation. ConnectKit is code-first infrastructure for embedding account-connected tools into your own agent runtime.
Versus WorkOS or Clerk
WorkOS and Clerk authenticate your app's users. ConnectKit handles downstream SaaS authorization: the user's Gmail, GitHub, Slack, Drive, and tool credentials.
Use it when
Use ConnectKit when you want owned infrastructure, not a hosted marketplace.
Use it for local or private agents that need per-user SaaS credentials and agent-readable tools.
Treat the 544+ specs as a catalog baseline, not a promise that every connector is production-tested today.
OAuth2 token refresh ships end-to-end; custom HTTP tool sources are still on the roadmap.
The clearest CTA is not 'connect to every app instantly'; it is 'own the connector runtime your agent depends on.'
FAQ
Questions, answered.
What is ConnectKit?
ConnectKit is an open-source connector framework that turns 544+ SaaS integrations into one YAML file each. It handles OAuth, encrypted credential storage, and automatic token refresh, and exposes every connector as agent-ready tools via CLI and MCP adapters.
How many connectors does ConnectKit support?
544+ YAML connector specs covering major SaaS — email, calendars, CRMs, messaging, storage, and more. Adding a new one is a single YAML file, not new code.
How do I add a new connector in ConnectKit?
Write one YAML spec describing the API, auth flow, and tools. ConnectKit's OAuth router and credential vault handle the rest — no per-connector code required.
How does ConnectKit handle OAuth and token refresh?
ConnectKit runs a local OAuth router and stores tokens in an encrypted credential vault (Fernet). Token refresh is automatic, so agents never see expired credentials.
Is ConnectKit free and open source?
Yes — MIT-licensed under the Open Assistants Lab, with zero cloud dependencies. Everything runs locally on your machine.
How is ConnectKit different from Zapier or Make?
Zapier and Make are hosted automation platforms with per-task pricing. ConnectKit is a local, code-first framework: connectors become typed tools your agents call directly, with no per-run fees and no data leaving your machine.
Does ConnectKit work with MCP and agent tool schemas?
Yes. ConnectKit adapts connector tools to ToolSpec and emits JSON Schema tool descriptions, so they plug into MCP servers and OpenAI/Anthropic-style function calling.
Where do ConnectKit credentials live?
In an encrypted local vault (Fernet) on your machine — tokens never touch a hosted service, and refresh happens locally so agents never see expired credentials.
Bring user accounts into your agent without renting the runtime.
Start with a local OAuth vault and a YAML connector catalog, then expose reliable CLI and MCP tools to your assistant.
Add local connectors