Integrations

Connect a tool so the agents in your workspace can use it, for example Sentry, PostHog, Google Search Console, E2B, Sensei admin data or an ad platform such as Meta Ads. Owners and admins connect tools in Settings > Workspace > Integrations, and a connection covers every project in the workspace. Members see the list read-only.

Tools that belong to one member, such as their Gmail, Google Drive, Dropbox, Linear, Jira, Figma, Notion, Cloudflare, Higgsfield, 1Password, Xero, QuickBooks, Zoho CRM, Zoho Books, Zoho Invoice, Mercury, Typefully, FreshBooks, Telegram, WhatsApp or Excalidraw, are connected in Settings > You > Integrations and are private to them. See Your own integrations.

Agents in tasks, Cron Runs, Deploy Chat and Sensei can use an Integration. So can a helper agent a chat turn starts with full access, called a Delegated Run: it reaches what its turn reaches. A read-only one has no network, so it has nothing to call with.

Agents find the connected tools with kosuke integrations list and run one with kosuke integrations call. They look the tools up each time, so a new Integration is usable at once, in tasks already running too.

Who an agent acts as

Work	Connections it uses
Sensei with no workspace named; Personal Crons, sandbox and Sensei Thread runs	Your personal integrations and the Personal space’s workspace integrations
Your own Turn in a Personal project	Your personal integrations and the Personal space’s workspace integrations
Turns Sensei sends and Deploy Chat in a Personal project	The Personal space’s workspace integrations only
A Turn or Deploy Chat message another person sends in a Personal project	None of your connections
Sensei naming a workspace; your own Turn in a workspace session you are the Assignee of	Your personal integrations and that workspace’s integrations, never the Personal space’s
Workspace Crons, Deploy Chat, a Turn another member sent and unassigned work in a workspace	That workspace’s integrations only

A run never uses another member’s personal integration.

Personal

Choose Personal in the Settings Workspace picker to connect workspace integrations for your own work. Personal is a workspace of one, and only you can manage its integrations. The picker offers Integrations only there, even before you have a Personal project.

These connections serve Sensei when you name no workspace, your Personal projects and your Personal Crons, both sandbox runs and Sensei Thread runs. Your own Turns in Personal projects reach your personal connections too. Turns Sensei sends and Deploy Chat use the Personal space's workspace integrations only. A Turn or Deploy Chat message another person sends reaches none of your connections. When you name a workspace to Sensei, it uses that workspace's integrations and your personal ones, never the Personal space's.

A restricted integration needs a grant for the workspace the call runs in, Personal included. A Superadmin can grant your Personal space access in the admin panel.

Connect a tool

The Integrations section lists the tools this Sensei deployment offers, one row each. A tool that cannot be connected the way Sensei connects tools is not listed.

With many tools, type in Search integrations to find one by name or description, or press a filter: All, Needs attention, Connected or Not connected. Each filter shows how many tools it holds. Tools that need attention, such as Reconnect required, come first, then connected ones. Press a row to open its details and controls.

The page and Connect dialog warn that agents, Crons and Deploy Chat act as the account you connect. Connect an account the organization owns. In Personal, that account acts for your Personal projects, Personal Crons and Sensei. Every member sees Agents act as followed by the account on a connected card.

1. Open Settings > Workspace > Integrations and choose your workspace or Personal.
2. Click the tool's row to open it, then press Connect. The button names the tool, such as Connect Sentry. Your browser leaves Sensei to authorize.
3. Sign in to the tool if asked, and approve the access. The tool asks for its default permissions. You cannot narrow them here, so to limit what agents can reach, authorize with an account or a key that can reach only that.
4. You come back to the row. If the tool has nothing to choose, the card reads Agents act as followed by the account.
5. PostHog asks for a personal API key and your region, US or EU, on its own page instead of an approval. Create the key in PostHog with the narrowest scope you can: agents reach every project the key can see, and a call names the project it wants.
6. Meta Ads asks for an access token on its own page. Create the token in Meta with read access to ads only.
7. Some tools reach several organizations, workspaces or sites. If yours does, the row opens and lists them by name. Pick the one agents may use and press Connect. Nothing is preselected.

You never paste a password or token into Sensei. You sign in, or enter a key, on the tool's own page, and Sensei never sees it. Press Cancel in the open row to drop an authorization you started and have not finished. An authorization you leave unfinished lapses after 10 minutes. While you are away, the row reads Connecting and updates on its own.

Only the admin who started an authorization can choose from its list or cancel it. Other admins see Connecting until it finishes. Starting a second tool ends your first unfinished one.

An authorization belongs to the workspace whose Integrations you started it from. If you come back to another workspace's Settings, Sensei names the workspace the authorization belongs to. Open Integrations in that workspace's group to see the connection or finish the choice there.

Add more than one connection

Google Search Console can be connected more than once, for example two Google accounts. Once one is connected, press Add another connection on its row. Each connection is its own labelled card, and you disconnect or reconnect each on its own. The ad platforms take one connection per ad account, and Sensei admin data one per deployment. Sentry, PostHog and E2B keep one connection each.

A label is read from the tool where it names the account, else typed at Connect. Labels are unique among a tool's connections in a workspace. Press the pencil icon to rename one; its tooltip reads Rename. Agents tell connections apart with an alias, short id or scope:label, such as workspace:Engineering. Each card shows how agents call it.

What agents can do

Agents can reach what you authorize in the tool, and they can use every action Sensei offers for it. An action is one thing a tool can do, such as search pages or send a message. Actions that read, create or update are offered. Connect a tool and its actions are available to agents. Only tools defined by Sensei are available. Their definitions are not shown in Settings.

Actions that delete, and actions the vendor does not describe as read, create or update, are never offered. Agents cannot read tokens or keys. Because creating and updating are offered, connect a tool with an account whose access you are comfortable sharing with every project in the workspace.

When a tool has you choose one organization, workspace or site at Connect, agents reach only the one you chose. For these tools Sensei offers a reviewed list of tools. Before a tool reads or changes an item by its ID, Sensei checks that it belongs to the one you chose. If Sensei cannot show that, the call is refused.

Tool descriptions come from the vendor or Sensei. Agents are told to read them as data, not as instructions.

Sentry

With Sentry connected, agents can read projects, issues, events, tags and issue comments in the organization you chose. Events include stack traces, requests, breadcrumbs and trace details. Agents can also read organization and project event counts over time.

Agents can list releases, open release details, inspect deployments and read release threshold statuses. They can compare an issue's first release with its events and release details to identify when the error first appeared. A deployment date alone does not prove which release introduced an error.

Agents can resolve, reopen or ignore issues, assign them to users or teams, and clear an assignment. Each write names between 1 and 10 issue IDs. Sensei checks every issue and assignee before sending the change. An issue or assignee outside the chosen organization refuses the whole call.

An issue ID can belong to any organization the connected Sentry account reaches. Sensei checks the issue's own identifiers and organization before a call that uses it. A missing issue and an issue in another organization receive the same refusal. Issue and comment replies that exceed the size limit return an error.

A write is sent once. If Sentry does not confirm its result, the agent must read the issue's current state before trying again. The connected Sentry account needs permission to change issues.

Sensei provides five tools for reading platform trace spans, logs and CPU profiles. Sandbox agent spans are no longer collected. Read agent Turns with kosuke_get_chat_session (transcript blocks, job status, model and token totals), kosuke_get_cron_run (run token totals), kosuke_get_skill_usage (timing) and the operational Log turn.outcome (final status, models and git state). They appear in kosuke integrations list --toolkit sentry beside the other Sentry tools, and an agent runs them like any other:

• sentry_trace_view reads the spans of one trace by its trace ID, in pages of up to 100 spans (limit) in time order: span ID, parent span ID, operation, description, duration and timestamp, so the tree can be rebuilt from the parent IDs. Pass attributes to add span attributes to each span, such as http.request.method. When a page says next_cursor, pass it as cursor to read the next one; following it to the end reads every span.
• sentry_search_spans finds spans with Sentry's span search syntax, for example project:kosuke-core span.op:queue.process. Each row carries the fields you ask for in fields, or a default set that includes the trace ID. Rows are newest first unless you pass sort; when you choose fields, a sort must name one of them, and without one Sensei sends none. Use the trace ID of a row with sentry_trace_view.
• sentry_search_logs searches Sentry Logs, for example chatJobId:<uuid> or projectId:<uuid> sandboxKey:<uuid>. Each row carries the fields you ask for in fields, or a default set of time, severity, message and trace. Bound the window with stats_period; the query takes no time filter. The same sort and next_cursor rules as sentry_search_spans apply.
• sentry_profile_flamegraph aggregates the CPU profiles of the spans a span search matches, such as trace:<trace id> is_transaction:true. It returns the frames with the most self time, each with its total time, how many sampled stacks it appears in, its p75 and p95, whether it is your application's code and its file and line. It also returns the costliest functions, each with its worst example, and how many profiles it aggregated. The window is stats_period (24 hours unless you pass one) or start and end, never both. A trace:<trace id> search alone matches every span of the trace. Nested spans overlap, so one request's samples are counted once for each matching span and the times add up past its duration. Add is_transaction:true to read one request, and the reply carries a note when a trace search aggregated several profiles.
• sentry_profile_chunk reads the samples of one profiler in one project over at most 120 seconds and summarizes one thread. It returns the frames with the most self and inclusive time, the hottest stacks, the number of samples and the time they cover, the release and environment, and how many frames carry a source file and line or are still in .next/server build output. Pass project_id, profiler_id, and start and end as epoch seconds (numbers or text) or ISO 8601 times, or a stats_period of at most 120 seconds. A reversed window, a longer one, or stats_period beside start and end is refused before Sentry is asked.

Profiles are sampled. Their times are an estimate built from samples, not measured durations. Each sample of sentry_profile_chunk counts for the gap until the next sample on its thread, up to three times the usual gap. To find a span's profile, ask sentry_search_spans for the fields profiler.id, thread.id, precise.start_ts and precise.finish_ts, or sentry_trace_view for those attributes. Pass them to sentry_profile_chunk as profiler_id, thread_id, start and end. A continuous profile leaves profile.id empty, so searching for it finds nothing. Thread 0 is the main JavaScript thread, so its samples include every request the process served in that window, not only that span.

All five tools only read. They go through the Sentry connection of the workspace and always address the organization you chose. They cannot name another organization. A project ID from another organization does not change which organization is read. A trace of another organization, a trace older than the period searched (14 days unless stats_period says otherwise) and a trace that does not exist are refused with the same message. A result is kept under the size limit: a page that is too big comes back with fewer spans and no next_cursor, with a note to lower limit or ask for fewer attributes. A profile that Sentry answers with more than Sensei can read returns an error that asks for a narrower window or query. All five tools disappear when Sentry is disconnected.

kosuke integrations call sentry_search_spans --args '{"query":"project:kosuke-core span.op:queue.process","fields":["trace","span.op","span.duration"]}'
kosuke integrations call sentry_trace_view --args '{"trace_id":"<trace id from the search>","attributes":["http.request.method"]}'
kosuke integrations call sentry_profile_flamegraph --args '{"query":"trace:<trace id> is_transaction:true","stats_period":"7d"}'
kosuke integrations call sentry_profile_chunk --args '{"project_id":"<project.id>","profiler_id":"<profiler.id>","thread_id":"0","start":"<precise.start_ts>","end":"<precise.finish_ts>"}'

PostHog

With PostHog connected, agents can read insights, events, persons, feature flags, experiments and other project data. You authorize with a personal API key and a region. Agents reach every organization and project the key can see, and a call names the project it wants. The key's own scope is the limit, so use a key scoped to the projects you want agents to reach. PostHog takes one connection. They can also create and update, such as annotations and flags.

Google Search Console

With Google Search Console connected, agents can query search performance, such as clicks, impressions, click-through rate and position. They can also inspect a URL's indexing status and read your properties and their sitemaps. They can add a site and submit a sitemap. Removing a site is never offered.

There is no property to choose when you connect. Agents reach every Search Console property the Google account you authorize can see, and a call names the property it wants. To limit what agents reach, authorize with a Google account that has access only to those properties.

You can connect more than one Google account. Sensei cannot read a Search Console account's name, so it asks you to type a label for each connection.

Cloudflare

Cloudflare is a personal integration: each member connects their own in Settings > You > Integrations. See Cloudflare for the key, the account you pick and what agents reach.

A workspace Cloudflare connection made before it moved keeps working. Agents still use it, held to the account chosen at Connect, and admins can rename or disconnect it. Nothing removes it on its own. A workspace with no Cloudflare connection is no longer offered one, and a workspace that has one gets no Add another connection: its card says a new one is connected by each member.

Ad accounts

Meta Ads, Google Ads, Pinterest Ads, TikTok Ads and Reddit Ads let agents read the campaigns and results of your company's ad accounts, and run campaigns in them. One login often reaches several ad accounts, so each ad account is its own connection. Connect the platform, then pick the ad account in the list. To reach another ad account, press Add another connection and pick another one. An ad account that is already connected is left out of the list, and a login whose ad accounts are all connected is refused.

Each card is labelled with the ad account, such as Brand A (act_123), and agents tell the cards apart by that label, for example workspace:Brand A (act_123). Agents reach only the ad account of the connection they name. They cannot name another one, and a call that tries is refused. These connections are the workspace's, so Cron Runs and other automated work can use them.

Agents can create, update, pause and resume campaigns, ad sets (ad groups on Google Ads, Pinterest, Reddit and TikTok) and ads, and change budgets. Agents are told to create a campaign, ad set or ad paused unless you ask them to launch it, because a running one spends money. Agents cannot delete, remove or archive anything. Sensei offers no tool that does, and a call that carries such a value is refused.

Every write goes to the ad account of the connection. When a write names a campaign, an ad set or an ad by its ID alone, Sensei first reads that item inside the connected ad account and refuses the write if the item belongs to another one. This covers Meta Ads, Pinterest Ads, TikTok Ads and Reddit Ads. On Reddit Ads, a read that names an item by its ID alone is checked the same way. A Reddit profile counts as the ad account's when the ad account may advertise with it, and a post counts when its profile does. On Google Ads, Sensei refuses any resource name that is not the connected customer's own. A refused write sends nothing to the platform, and the message does not say whether the item exists elsewhere.

A write is sent once and never cut short or retried. If the platform does not confirm it, the agent is told the outcome is unknown and must read the current state before it tries again. A login with read access only can read and cannot write: the platform refuses each write, so disconnect the native connection and connect with a login that may change the ad account.

• Meta Ads reads campaigns, ad sets, ads, creatives and custom conversions, and insights such as spend, impressions and clicks. Pass level (campaign, adset or ad) to the insights tool to get one row for each. It creates and updates campaigns, ad sets and ads, pauses and resumes them, and sets ad set budgets in the smallest unit of the account currency, such as cents. Meta Ads connects with an access token, which you paste on Meta Ads' own page. The token needs the ads_management permission to write. The token's own scope is the limit, and agents still reach only the ad account you pick.
• Google Ads reads campaigns by ID or name and runs reporting queries in Google's query language, which return metrics. It also reads customer lists and conversion actions. It creates and updates campaigns, campaign budgets, ad groups and responsive search ads, and pauses and resumes them. An ad cannot change after it is created, so an agent creates a new one. Google Ads asks for a customer ID on its own page, and then you pick the ad account from the manager account's sub-accounts.
• Pinterest Ads reads campaigns, ad groups, ads and their analytics. It creates campaigns, ad groups and ads, renames, pauses and resumes them, and changes spend caps, budgets and bids in micro-currency, where 1,000,000 is one unit. An ad needs a Pin that already exists.
• Reddit Ads reads campaigns, ad groups, ads, performance reports, saved and custom audiences, pixels, lead gen forms and the account's change history. It also reads the profiles the ad account may advertise with, their posts, the funding instruments, and Reddit's targeting lists of communities, interests and locations. It creates campaigns, ad groups, ads, text posts and saved audiences, updates, pauses and resumes them, and changes budgets and bids. Money is in microcurrency, where 1,000,000 is one unit of the account currency, and report spend uses the same unit. An ad needs a post on a profile the ad account may advertise with. When Reddit refuses a call, the agent sees Reddit's reason, such as the field it refused. Reddit has no single list of ad accounts, so Sensei lists the businesses you can reach and then their ad accounts. Pick the ad account from that list. A business you cannot read is left out.
• TikTok Ads reads campaigns, ad groups, ads (including Smart+ and GMV Max), creatives, audiences, pixels and reports such as spend and results by day, campaign or ad. It creates campaigns, ad groups and ads, updates campaigns and ads, renames ad groups and moves their end time, pauses and resumes them, and changes ad group budgets in the account currency. An ad uses images and videos that are already in the advertiser's library. Smart+ and GMV Max campaigns can be read, paused and resumed, and not created. Sensei offers a reviewed set of its tools for one advertiser account. Business Center tools are not offered, because they reach other advertisers, and neither are lead and customer data downloads.

The tools Sensei adds for these platforms appear in kosuke integrations list beside the platform's own, with their access class.

Telegram

Telegram is connected by each member for themselves, in Settings > You > Integrations, and never appears on this page. A member logs in to their own Telegram account in Sensei, with a code Telegram sends or a QR code. Their agents then read their chats and send as them. Sensei keeps the session encrypted on its own server, and it never reaches a sandbox. See Your own integrations for how to connect it and what agents can do.

WhatsApp

WhatsApp is connected by each member for themselves, in Settings > You > Integrations, and never appears on this page. A member links WhatsApp as a device with a QR code or pairing code after accepting the risk of restriction or a ban. Sensei keeps the session encrypted on its own server, and agents read stored 1:1 messages and send text as that member. See Your own integrations for linking, Paused, reconnecting and the limits.

Excalidraw

Excalidraw is a Personal integration, connected in Settings > You > Integrations with no Excalidraw sign-in. Agents create diagrams, share excalidraw.com links and add to a drawing you already shared. See Your own integrations for connecting, sharing limits and what happens after Disconnect.

Integration status

The status sits on the right of the row. Inside an opened row, each connected card reads Agents act as followed by the account.

Status	What it means	What to do
Not connected	Nothing is connected.	Open the row and press Connect.
Connecting	An admin has started an authorization and not finished it.	Finish it, or press Cancel if it is yours.
Connected	The connection is ready. With several connections the row reads how many are connected.	Nothing.
Temporarily unavailable	The tool could not be reached just now. The Integration is kept.	Nothing. Try again shortly.
Reconnect required	The authorization stopped working, Sensei can no longer use the tool version it connected with, or the workspace was connected the old way. With several connections, only that card says so and the others keep working.	Press Reconnect on the card, or disconnect it.

A tool your deployment no longer offers shows on its row as no longer offered. You can only disconnect it.

Use the tools from the command line

Agents run these in a Chat Session's sandbox, a Cron Run or Sensei. You can run them there too, and from your laptop with the Sensei CLI.

Command	What it does
kosuke integrations list	Overview: one block per tool that has connections, with each connection's scope, label, account, short id and alias, and how many read and write tools the tool has.
kosuke integrations list --toolkit <slug>	List one tool's tools, such as sentry, with their access and a short description.
kosuke integrations list --search <text>	List the tools whose name or description mention the text.
kosuke integrations list --account <account>	List only what one connection offers.
kosuke integrations tools get <name>	Print one tool's input schema, fetched by name.
kosuke integrations call <name> --args '<json>'	Run one tool.

kosuke agent summary get lists the same connections, one line each, so an agent starts a turn knowing what is connected.

describe and call take --account <account> too, and so does list. An account is a connection's alias, short id or scope:label:

• The alias is <tool>-<scope>, such as notion-personal or sentry-workspace. When one member or workspace has several connections of a tool and scope, the alias ends in -1, -2 and so on, in the order they were made. Disconnecting an earlier one renumbers the later ones, so every call prints the connection it ran on.
• The short id is the eight characters list prints.
• scope:label is the scope and the label, such as workspace:Engineering or personal:nsosio's Notion.
• A bare personal or workspace works when exactly one connection of that scope can run the tool.

Case, curly quotes and extra spaces do not matter, so personal:nsosio’s Notion and personal:nsosio's notion name the same connection. The account is optional when only one connection can run the tool. With several, a call without it is refused and the message lists the choices. An account that matches none, or more than one, is refused the same way. Agents pick up this rule from their instructions: "my" and "mine" mean their personal connection, "the team's" and "the workspace's" the workspace one, and they ask when it is unclear.

A connection is named by the account it signs in as where the tool can say it, such as a mailbox address, so two Notion workspaces are told apart in the list.

A list that is cut short says how many of how many it shows. Narrow it with --toolkit, --search or --account.

From a laptop, an API key can list and describe with --workspace <workspaceId>, and call your own personal connections only. A call on a workspace connection is refused outside an agent's turn.

Workspaces connected before

Linear, Jira, Figma, Notion and Higgsfield are now personal only. When this change is deployed, every older workspace connection of these tools is disconnected automatically, the same way an admin Disconnect works: its authorization is revoked at the broker and the connection is removed in Sensei. Pending workspace Connect attempts for these tools are cancelled too. Personal Notion and Higgsfield connections are untouched. Connect your own in Settings > You > Integrations. A call on one is refused: " is now a personal integration: this workspace connection is no longer used. Connect your own in Settings → You → Integrations." Workspace Crons and Deploy Chat that used them lose that access.

Sensei used to connect Sentry by installing its own Sentry App into your Sentry organization. That way is retired. A workspace connected that way reads Reconnect required, and agents cannot use it until an admin presses Reconnect. Sensei does not carry the old access over. An old install link now opens Settings > your workspace > Integrations with a message that the link is no longer used and an admin has to reconnect Sentry.

The old Kosuke installation stays listed in your Sentry organization's settings until someone removes it there. Sensei no longer uses it.

A workspace connected to Sentry through Integrations keeps its Integration and its organization. Agents gain the reads and guarded issue changes described above through the existing connection.

Disconnect

1. Open the tool's row, then press the trash icon on the connection's card. Its tooltip reads Disconnect.
2. In the dialog, press Disconnect.

Agents lose access as soon as you confirm, in tasks already running too: their next kosuke integrations call is refused. A request an agent had already sent to the tool may still finish.

Sensei then deletes its stored authorization. If that cannot finish right away, Sensei says so and keeps retrying in the background. Access stays off either way. Revoking the authorization inside the tool is a separate step in the tool's own settings. To connect again, you authorize again.

To check the Integrations from a script, run kosuke integrations connections list <workspaceId>, or kosuke integrations connections get <workspaceId> <toolkit> for one.

Limits

• Sentry changes require explicit issue IDs, with at most 10 issues per call. Search results cannot target a bulk change.
• Sentry tools cannot delete or merge issues, create releases, or change projects, teams, members or settings.
• Google Search Console, Cloudflare, the ad platforms and Sensei admin data take several connections: one per Google account, Cloudflare account, ad account or Sensei deployment. Sentry, PostHog and E2B take one.
• Labels must be unique among a tool's connections in a workspace.
• The choice lists at most 100 entries.
• You can have one unfinished authorization at a time.

Next steps

• Members and roles to see who can manage integrations.
• Your own integrations for the tools a member connects for themselves, including Slack, Telegram, WhatsApp and Excalidraw.

Changing native credentials

For PostHog, Meta Ads, E2B and Sensei, explicitly Disconnect, then Connect with the new credentials. There is no Replace action. Sensei validates its Admin Token with a bounded authenticated admin read before saving it. E2B needs only its API key; validation reads at most one sandbox and creates nothing. Existing workspace Cloudflare connections stay usable, but after Disconnect a new connection must be personal. Apple Ads OAuth and other OAuth connections still support Reconnect.