Your own integrations

Connect your own tools in Settings > You > Integrations. A connection there belongs to you, not to a workspace. It is private: your teammates and workspace admins cannot see it, use it or disconnect it, and connecting one shares nothing with a workspace.

The list offers Gmail, Google Drive, Google Docs, Google Sheets, Google Slides, Google Calendar, YouTube, Dropbox, Slack, Telegram, WhatsApp, Excalidraw, Linear, Jira, Figma, Notion, Cloudflare, Higgsfield, 1Password, Xero, QuickBooks, Zoho CRM, Zoho Books, Zoho Invoice, Mercury, Typefully, FreshBooks, LinkedIn and X. They are personal only and never appear on the workspace's Integrations page. Your GitHub Connection is personal too and has its own GitHub row in the same list. Open it for Connect, Reconnect or Disconnect; once connected it shows your GitHub username and a link to install the Kosuke GitHub App. With a connection, the commits from your messages and the pull requests the agent opens for you carry your GitHub handle. Import a repository explains the connection and the Kosuke GitHub App.

Your connections follow you into every workspace you belong to, like your Subscription. Your own Turns in sessions you are the Assignee of, Sensei Turns you start and Personal Crons can use them. Workspace Crons, Deploy Chat, a Turn another member sent and unassigned work use workspace integrations only. A run never uses another member's personal integration.

For an organization tool such as Sentry or PostHog for your own work, choose Personal in Settings > Workspace > Integrations. Those workspace connections serve Sensei with no workspace named, your Personal projects and Personal Crons. Sensei naming a workspace uses that workspace's integrations plus your personal ones, never the Personal space's. Restricted integrations need a grant for the workspace the call runs in, Personal included.

Connect a tool

1. Open Settings > You > Integrations.
2. Click the tool's row to open it, then press Connect. The button names the tool, such as Connect Gmail. Your browser leaves Sensei to authorize.
3. Sign in to the tool if asked, and approve the access. The tool asks for its default permissions, and you cannot narrow them here.
4. You come back to Settings > You > Integrations, where the card reads Connected as followed by the account when the tool names the account. Xero shows the names of the organisations you allowed. Higgsfield, 1Password and Excalidraw keep Connected because they name no account.

Telegram, WhatsApp and Excalidraw connect in a dialog in Sensei. See Telegram, WhatsApp and Excalidraw. Excalidraw needs no sign-in.

For every other tool, you sign in, or enter a token, on the tool's own page, and never paste a password or token into Sensei. Search and the filters work as they do on the workspace's page: type in Search integrations, or press All, Needs attention, Connected or Not connected.

An authorization you leave unfinished lapses after 10 minutes. While you are away the row reads Connecting. Press Cancel to drop an attempt you started.

Sensei offers inline Connect buttons for Linear, Jira, Figma, Notion, Dropbox, 1Password, Xero, QuickBooks, Zoho CRM, Zoho Books, Zoho Invoice, Mercury and FreshBooks, as for the Google tools, YouTube and Slack. Higgsfield, Typefully and Cloudflare connect in Settings > You > Integrations, where their cards say what their keys can do: a Connect button Sensei shows for any of them opens that page. Enter Higgsfield's API key ID and secret, or a Typefully API key, on the tool's own page.

Connect more than one account

Every tool here except WhatsApp, Excalidraw, Higgsfield, 1Password and Typefully can be connected more than once, for example two Google accounts or several Xero logins. WhatsApp keeps one linked device per member, Excalidraw one connection, and Higgsfield, 1Password and Typefully one account each. For tools that allow several connections, press Add another connection on a connected row. Each connection is its own card with a label, and you disconnect or reconnect each on its own.

Sensei reads the label from the tool where it names the account: the mailbox address for Gmail and Google Drive, the channel name for YouTube, the account email for Dropbox and Typefully, your Zoho email for Zoho CRM, the email of your first Zoho Books or Zoho Invoice organization for those two, the workspace name for Notion, the company name for QuickBooks, the business's legal name for Mercury, the name of the first business your login reaches for FreshBooks, your user and team for Slack, such as nicola @ Kosuke, your username for Telegram, such as @nsosio, your WhatsApp name and number, email @ Linear workspace for Linear, email for Figma, and the organisations' names for Xero, and the chosen account's name and id for Cloudflare. Jira asks you to type a label at Connect, while its status names your Jira display name. A Jira connection made inline in Sensei starts with the label Jira, numbered for another connection, and you can rename it. Google Docs, Google Sheets, Google Slides and Google Calendar do not name it, so you type one when you connect. A label is unique among your connections of that tool. Connecting the same Linear account in the same Linear workspace, the same Jira account on the same site, the same Figma account, a Slack or Telegram account, or a WhatsApp number you already connected is refused; use the connection you have. To rename one, press the pencil icon on its card. Its tooltip reads Rename. Telegram and WhatsApp cards take their labels from the tool and have no Rename. Excalidraw is labelled Excalidraw and has no Rename.

Authorizing a Notion workspace that is already connected can sign out the earlier connection. If it does, that card reads Reconnect required. Press Reconnect on it.

Agents choose between your connections with an account, which is a connection's short id or scope:label, such as personal:[email protected]. Each card shows how agents call it.

Linear

With Linear connected, agents can read issues, projects, cycles, labels, workflow states, comments and teams, and search issues. They reach the Linear workspace you authorized, as your Linear user, and no other. They can also create and update issues, comments and projects. Tools that delete, and Linear's raw GraphQL tool, are never offered.

Figma

With Figma connected, agents can read files, nodes, comments, versions, components, styles and variables, and render nodes as images. Figma has no list of teams to choose from, so there is nothing to pick when you connect. Agents reach every file your Figma account can open, across all your teams, and they can address a team or file by its ID. They can also create and update, such as posting comments and reactions and changing dev resources and webhooks. Connect your own account; agents act as you and reach what that account can open.

Jira

With Jira connected, agents can search and read issues, projects, boards, sprints, comments, worklogs and fields. They reach the one Jira Cloud site whose subdomain you entered, as your Jira user, and no tool takes another site as an argument. They can also create and update issues and comments.

Notion

With Notion connected, agents can search and read pages, databases and comments. They reach the pages and databases you share when you authorize. They can also create and update pages and comments. You can connect more than one Notion workspace.

Dropbox

With Dropbox connected, agents can list folders, search files and folders by name or content, read a file's metadata and download its content. They can also upload a file, create a folder, and move or rename a file or folder. They reach every file and folder of the Dropbox account you authorized. Tools that delete, share a folder or a file, create or change a shared link, or touch file requests and team admin are never offered. A search cannot pick another member of a Dropbox team, and a move cannot transfer a file's ownership. An upload that overwrites a file keeps the earlier version in the file's Dropbox history. You can connect more than one Dropbox account.

Xero

With Xero connected, agents can read invoices and bills, quotes, purchase orders, credit notes, payments, bank transactions, manual journals, items, accounts, tax rates, tracking categories, files and attachments. Projects and assets are read-only. Agents can read profit and loss, balance sheet, trial balance, bank summary and aged reports.

They can create invoices and bills, quotes, purchase orders, credit notes, contacts, payments, bank transactions, manual journals, items and accounts, and update invoices and bills, quotes, purchase orders, credit notes, contacts, bank transactions, manual journals and accounts. They can upload attachments and associate files with records. No delete tools are offered. There is no tool to list contacts: agents find a contact through an invoice or another record it belongs to.

To connect, sign in to Xero and allow the organisations agents may use, on Xero's own page. Each call runs as you, with your Xero permissions, so Xero's history names you. You can connect several Xero logins.

One login can reach several organisations. Agents list them with Get Connections (xero_get_connections), then name the organisation each call acts on with its tenantId, using tenant_id (tenantId for xero_list_invoices). Get Connections and Validate Credential need no organisation. The card reads Connected as followed by the organisations' names, such as Demo Company (Global), Acme Ltd.

QuickBooks

With QuickBooks connected, agents can read customers, vendors, employees, products and services, the chart of accounts, invoices, estimates, bills, payments, purchases, deposits and journal entries, and run reports such as Profit and Loss, Balance Sheet, Cash Flow, aged receivables and payables, and the general ledger. They can also create and update records, such as customers, invoices, bills, payments and journal entries, and email a credit memo. Tools that delete, and the batch tool that can delete, are never offered. Agents act as your QuickBooks user, with the permissions that user has in the company.

Each connection reaches one QuickBooks company, the one you choose when you sign in, and is labelled with the company's name. To give agents another company your login reaches, press Add another connection and choose that company. With several companies connected, every call says which company it ran on, and a call that does not name one is refused with the companies to choose from.

The page that opens before the sign-in asks for a Base URL, an Authorization URL and a Token URL. Keep the defaults. For an Intuit developer sandbox company, enter https://sandbox-quickbooks.api.intuit.com as Base URL.

Zoho CRM, Zoho Books and Zoho Invoice

Zoho CRM, Zoho Books and Zoho Invoice are three tools, each connected on its own with your Zoho login. Zoho keeps each account in one data center, such as zoho.com, zoho.eu or zoho.in, so the page that opens first asks how your Zoho web address ends: com, eu, in, com.au, jp, ca, sa or com.cn. Enter yours, then sign in to Zoho and approve. The consent screen names Composio, the service Sensei connects through. You can connect more than one Zoho login, for example one per data center.

With Zoho CRM connected, agents can read and search leads, contacts, accounts, deals, notes, tasks, calls, events and other records, as your Zoho user with your permissions. They can also create and update records, notes and tags, convert a lead, and draft emails. Merging leads, which deletes the merged ones, and changing custom field definitions are never offered.

With Zoho Books or Zoho Invoice connected, agents can read and search contacts, items, invoices, estimates, payments and the rest of the books, and create and update them, including sending an invoice or estimate by email. Zoho Books offers no action that creates a one-off invoice: agents create one from a sales order, or set up a recurring invoice. Updating a contact leaves its contact persons as they are, because Zoho removes every contact person an update leaves out: agents add and change them one at a time. Voiding an invoice, bill, sales order or vendor credit, stopping a recurring invoice and cancelling a write-off are never offered. One Zoho login can reach several organizations, so every Zoho Books and Zoho Invoice action names the organization it acts on: agents list your organizations first and pass the one they mean, and never fall back on Zoho's default organization. Zoho Invoice's expense and payment lists that take no organization are not offered for that reason.

FreshBooks

With FreshBooks connected, agents can list the businesses your FreshBooks login reaches, with your role in each, and read a business's clients, projects, team members, journal entries and webhook callbacks. They act as your FreshBooks user, so they reach every business that login reaches and see only what your role in it can see. FreshBooks only reads: agents cannot create, change or delete anything in it, such as a client, an invoice or a webhook. Every read names one business, and when your login reaches more than one, agents use the business you named, ask when you named none, and say which business each answer is about. Authorizing opens FreshBooks' sign-in through Composio, so the consent screen names Composio. You can connect more than one FreshBooks login.

Higgsfield

With Higgsfield connected, agents can generate images and videos, create Soul ID characters, list Soul V2 styles and estimate a Soul V2 image's cost. Each generation spends credits of the Higgsfield account whose key you entered. A generation does not return the image or video. It returns a request, and agents read the result with Get Request Status, which gives the image, video or audio URLs when the request is done. Agents cannot cancel a request, so a request runs to the end once it starts. Higgsfield takes one connection. To connect it, enter an API key ID and its secret on Higgsfield's own page; create the key on Higgsfield's API Keys page.

Mercury

With Mercury connected, agents can read your Mercury business banking: accounts and their balances, transactions, statements, cards, treasury accounts, invoices and customers, recipients, expense categories, credit accounts, SAFE requests, send-money approval requests, users and webhooks. Mercury's official MCP server (beta) offers reads only, so agents cannot move money, approve a request or change anything. They reach what your Mercury login can see, as you. To connect it, sign in on Mercury's own page and approve read access. The card reads Connected as followed by your business's legal name. Account reads return full account and routing numbers, so the Mercury card warns that what agents read can show in task chats. You can connect more than one Mercury login, for example one per business.

Typefully

With Typefully connected, agents can read your social sets, the accounts a post goes to, with their drafts, tags, queue and posting schedule, and look up a LinkedIn organization to mention in a post. They can also create and update drafts, create tags, change a social set's posting schedule and upload media for a draft. A draft can be published now, scheduled for a time or the next free slot, or kept as a draft, so a post an agent writes can go out on your social accounts as you. Deleting a draft is never offered. They reach every social set your Typefully account can. Typefully takes one connection, and its card reads Connected as your Typefully email. To connect it, paste an API key on the page that opens; create the key in Typefully's Settings > API.

Cloudflare

With Cloudflare connected, agents can read and change DNS records, Workers, Pages deployments and KV, and read traffic and Worker analytics, in the one Cloudflare account you chose. Add one connection for each Cloudflare account. Each card is labelled with the account's name and its id, such as Production (023e105f4ecef8ad9ca31a8372d0c353), and agents pick one with --account, such as personal:Production (023e105f4ecef8ad9ca31a8372d0c353). To connect, open Cloudflare's row in Settings > You > Integrations and press Connect Cloudflare.

The key. Cloudflare asks for the Global API Key and the email of the Cloudflare login it belongs to. A scoped API token does not work: the key is sent as Cloudflare's X-Auth-Key header, and Cloudflare refuses a token there. The Global API Key reaches every Cloudflare account the login is a member of, and it has no scope to narrow. Sensei keeps agents to the account you choose, and that account is the limit, not the key. For the best protection, connect with a Cloudflare user that is a member of only that account, with the roles agents need. Then Cloudflare itself limits what the key can do. After you enter the key, you pick the account from the first 50 accounts of the login.

What agents reach. All of it is in the chosen account.

• DNS and zones. They list the account's zones with cloudflare_list_zones, read DNS records, create and update a record, and update a zone. A zone tool is checked first: Sensei reads the zone and sends the call only if the zone belongs to the chosen account. A zone of another account, a zone that does not exist and a zone Sensei cannot read are all refused before anything is sent. Updating a zone takes one field per call, because pausing a zone takes it off Cloudflare's proxy and name servers change what resolves. A zone cannot be moved off Cloudflare as its primary DNS.
• Workers. They list Workers and read a Worker's content, versions, subdomain, build triggers, preview deployment and telemetry, query telemetry, and create a Worker, a version and a deployment. A new version does not copy the bindings of the one before it. Agents read the current version first and pass each binding they want to keep as inherit, or deploying the new version removes it from the live Worker.
• Pages. They list the project's deployments and domains, read a project or a deployment, create a deployment from a manifest of uploaded assets or as a new build of a Git-connected project, roll back, and upload assets.
• Storage. They list KV namespaces, keys and values, write a KV value (which overwrites the key's current value), list D1 databases, take an inventory of the account's developer resources, and list R2 buckets with cloudflare_list_r2_buckets and Pages projects with cloudflare_list_pages_projects.
• Analytics. cloudflare_zone_traffic returns a zone's daily requests, cached requests, bytes, threats, page views and uniques for up to 100 days. cloudflare_worker_invocations returns the account's Worker invocations by Worker and status, with errors, subrequests and CPU time. Cloudflare limits how far back and how wide a window each plan may query.

What is left out, and why.

• Nothing that deletes, and nothing the vendor does not describe as read, create or update.
• Anything that manages credentials: creating or reading API tokens, listing a Worker's secrets, creating a Turnstile widget (its answer holds the widget's secret), and starting a Worker asset upload (its answer is a token that works outside Sensei). A Worker version cannot carry a secret binding or a private key, and a Pages deployment cannot upload its file inputs. A call that carries one is refused before it is sent.
• Anything that could remove something later or without a trace: Durable Object class deletion, a KV expiry on a write, and the preview update, whose environment takes any binding including secrets and removes one when null. Pages project updates are left out too, because they set secret environment variables and remove variables by sending null.
• Tools outside DNS, analytics, Workers, Pages and storage: account members and email routing addresses (they name people), health-check monitors (their headers can hold keys), firewall rules, bot management, tunnels, load balancer pools, MCP portals, registrar checks, WAF lists, Workers AI (it bills compute) and browser snapshots.
• Creating a zone, listing zones across accounts, and Cloudflare's free-form GraphQL tool, because none of them can be held to one account. Sensei's two analytics tools run fixed queries instead.

Gaps. Agents cannot create a zone, change DNSSEC or zone settings, or purge the cache. They cannot manage Worker routes, custom domains or cron schedules, upload static assets (so they cannot make a new version of a Worker that serves them), or update a preview. They cannot change Pages project settings, read deployment logs, or send _routes, _headers, _redirects or Functions files. They cannot read R2 objects, run D1 queries, or reach Durable Objects and Queues. One call carries at most 64 KB, which caps Worker module and Pages asset uploads and KV values.

When Cloudflare refuses the key. If you type a key and email that do not match, Connect stops and says that Cloudflare did not accept this Global API Key and email pair. Press Connect again and check both.

If the Global API Key is changed or revoked in Cloudflare later, the card reads Reconnect required the first time an agent's call is refused because of it. Before it says so, Sensei checks the key once more with Cloudflare, so a call refused only because the login has no role for that product leaves the card Connected. Press Disconnect, then Connect, enter the new key and the email of its login, and pick the account again. Until then, agents are told the connection needs to be reconnected.

Cloudflare's reasons. When Cloudflare refuses a call, for example a DNS record whose content is invalid, agents read Cloudflare's own reason, with addresses, emails and long tokens taken out.

Slack

Connect your own Slack accounts here, as many as you have. Agents act in Slack as you, with the account you authorize. They reach every channel, conversation and file that account can read, including direct messages, and they can address one by its ID. They can also post messages and reactions, and those show as posted by you. Connect only accounts whose access you are comfortable with an agent using.

Two teammates on the same Slack each connect their own account.

Telegram

Connect your own Telegram account here, as many accounts as you have. Agents act as you in Telegram. They read your chats, and what they send shows as sent by you. Connect only accounts whose chats you are comfortable with an agent reading and writing in.

Connect with a phone number

1. Open the Telegram row and press Connect Telegram. A dialog opens in Sensei.
2. Enter your account's phone number in international format, such as +44 7700 900123, and press Send code.
3. Telegram sends a code to the Telegram app on your other devices, or by SMS. The dialog says which. Type the code.
4. If your account has two-step verification, enter the password you set in Telegram and press Log in. The dialog shows your password hint, if you set one.

The dialog closes and the new card shows. It is named after your username, such as @nsosio. An account with no username shows your name and phone, such as Ada Lovelace (+447700900123). The card also shows the phone number.

Log in with a QR code

Use a QR code when the code does not arrive.

1. In the dialog, press Log in with QR code instead, or Log in with QR code under the code.
2. On your phone, open Telegram, then Settings > Devices > Link Desktop Device, and scan the code.
3. If your account has two-step verification, enter its password and press Log in.

The code refreshes on its own. A login with no step for 5 minutes expires, and the dialog reads "This login expired. Start again." Closing the dialog ends the login.

Sensei refuses an account that is already connected, by you or by a member of a workspace you belong to. The dialog reads "This Telegram account is already connected." Sensei ends the refused session in Telegram, so it does not stay in your devices.

If Telegram is not set up on your deployment, the row reads Not available and has no Connect button.

What agents can do in Telegram

Agents read your chats, contacts and stories, and send, forward, edit and delete messages as you.

Tool	What it does
telegram_list_chats	Lists your chats, with their unread counts and last message. Filters by folder, archived, muted, unread and type, and pages through your 1,000 most recent chats.
telegram_list_folders	Lists your chat folders.
telegram_read_chat	Reads the messages of one chat or one forum topic, oldest first. Reads back from a date or a message. Shows what each message replies to, its reactions, its poll, and who first sent a forward.
telegram_list_unread	Lists the chats with unread messages, with the newest unread messages of each.
telegram_search_messages	Searches messages by keyword, in one chat or in all your chats, between two dates and by sender.
telegram_list_contacts	Lists your saved contacts, with their username, and their phone number when they share it.
telegram_search_contacts	Finds people and chats by name among your contacts and chats. When the agent asks, it also searches public Telegram.
telegram_get_chat_info	Shows a chat's title, description, member count and pinned messages.
telegram_list_members	Lists the members of a group or channel, where Telegram shows them to you.
telegram_list_topics	Lists the topics of a forum group.
telegram_list_scheduled	Lists your scheduled messages in one chat.
telegram_list_stories	Lists the active stories of your contacts, or of one contact.
telegram_download_media	Downloads the photo, video or file of one message, or of one story. In a Chat Session it is saved into the sandbox, under /tmp/telegram/. Your Sensei and the CLI get a private link to a message's file, which works for 5 minutes.
telegram_transcribe_media	Transcribes the speech of one voice note, audio, video note or video, word for word in the language spoken. Answers the transcript with its sender, date, duration, chat and message.
telegram_send_message	Sends text, a file, or a file with the text as its caption. It can reply to a message, send into a forum topic, or schedule the message for later.
telegram_forward_messages	Forwards up to 10 messages to another chat. They keep the name of the person who first sent them.
telegram_edit_message	Changes the text of a message you sent.
telegram_delete_messages	Deletes up to 100 messages you sent, for everyone where Telegram allows it.
telegram_mark_read	Marks a chat as read.
telegram_set_reaction	Sets or removes your reaction on a message.
telegram_send_poll	Sends a poll with 2 to 10 options.
telegram_vote_poll	Votes in a poll.
telegram_cancel_scheduled	Cancels messages you scheduled.

An agent names a chat by @username, by phone number, by an id from telegram_list_chats or telegram_list_contacts, or as me for your Saved Messages. Photos and videos are sent as media. Any other file, such as a PDF, is sent as a document.

Agents edit and delete only messages you sent. Sensei reads each message first, and refuses the whole call when one of them is not yours. This holds in groups and channels you admin too. In your Saved Messages, agents can also delete what you forwarded there. Agents cancel only messages you scheduled.

Agents cannot join or leave chats, create groups, add or remove members, or change your profile.

Reading, searching, downloading and transcribing change nothing in Telegram. No message is sent, no chat is marked as read, and no story is marked as viewed. Sensei keeps no copy of your chats, contacts or stories: every call reads Telegram as you make it. A download link opens only the one file it was made for, and stops working 5 minutes after it was made. Someone who opened it in time keeps what they downloaded. The file stays private in Sensei's storage after the link expires. A story's file is saved only into a Chat Session's sandbox, never into Sensei's storage. Sensei transcribes with its own Gemini key, and your workspace is not charged for it.

Reconnect and disconnect Telegram

You can end Sensei's session from Telegram, in Settings > Devices. The card then reads Reconnect required after the next agent call. Press Disconnect, then Connect and log in again. Logging in to another account adds a new card instead.

Disconnecting a Telegram card also ends its session in Telegram, so it leaves Settings > Devices there. If Telegram cannot end it, Sensei still removes the card and says so. End the session yourself in Telegram, in Settings > Devices.

Sensei keeps the session encrypted on its own server. It never reaches a sandbox, your browser or an agent. What an agent reads from your chats can show in the session's messages, as for every connection below.

WhatsApp

Connect your own personal WhatsApp here as a linked device. Agents act as you in WhatsApp: they read the messages Sensei keeps and send directly when you ask, as they do in Telegram. Connect only a number whose chats you are comfortable with an agent reading and writing in.

Automating a personal WhatsApp is against WhatsApp's Terms of Service and can get your number restricted or banned. Connect WhatsApp opens a Link WhatsApp dialog with a checkbox acknowledging that risk. Continue stays disabled until you tick it. You must accept the risk every time you link, including after you disconnect and connect again. WhatsApp Business is not offered.

Link with a QR code

1. Open the WhatsApp row and press Connect WhatsApp.
2. Accept the risk and press Continue. The dialog shows a QR code.
3. On your phone, open WhatsApp > Settings > Linked devices > Link a device, and scan the code.

The code refreshes on its own. The dialog closes once linked, and the card shows your WhatsApp name and number. An unscanned code expires after about two minutes; the dialog reads "This link expired" with Start again. Closing the dialog cancels the attempt.

Link with a phone number

1. In the dialog, press Link with phone number instead.
2. Enter your phone number in international format, such as +447700900123, and press Get code.
3. On your phone, open WhatsApp > Settings > Linked devices > Link a device > Link with phone number instead, and enter the eight-character pairing code shown in Sensei.

Sensei refuses a number already connected by you or by a member of a workspace you belong to. The dialog reads "This WhatsApp number is already connected." Sensei logs the refused device out, so it leaves Linked devices on the phone. An unavailable link shows Start again too.

What agents can do in WhatsApp

Tool	What it does
whatsapp_list_chats	Lists stored chats, newest first, with their kind (1:1 or group), last message and whether they wait on a reply. It can list only 1:1 chats or only groups, and pages on to older chats.
whatsapp_find_contact	Finds your contacts by part of their name or by phone number, and groups by part of their name. It answers each one's name, phone number and chat id when a chat exists.
whatsapp_list_new	Lists incoming messages since a time, by default the last 24 hours, grouped by chat.
whatsapp_read_chat	Reads stored messages of one chat, oldest first, with their text and media kind. In a group, each incoming message shows who sent it.
whatsapp_send_message	Sends text, a file or a reply as you to a 1:1 chat or existing group. It can start a chat with a verified WhatsApp number.
whatsapp_download_media	Downloads a newly stored attachment up to 20 MB, returning a sandbox path or a private link.
whatsapp_transcribe_media	Transcribes speech in a voice note, audio, video note or supported video up to 10 MB.

Agents read stored 1:1 and group chats and send to groups you are in. They never reach status updates, broadcast lists or channels, create groups or change their members. An agent names an existing chat by an id from the tools. It can also give whatsapp_send_message a phone number in international format to start a 1:1 chat. Sensei checks that the number is on WhatsApp before creating the chat or counting the send. Writing first to new numbers from an unofficial client is a common reason WhatsApp restricts an account.

file_path names a file in the calling Chat Session's sandbox, up to 20 MB (20 MiB). Images and videos go as media; other files go as documents. Text with a file is its caption. Text and captions are limited to 4,096 characters. A file can be sent without text. Sensei reads the file before queueing and removes its temporary stored copy after the send settles. The sent message keeps its media kind and filename, and its attachment can be downloaded while WhatsApp holds it.

reply_to takes a Sensei message UUID from the same chat. It quotes that message and works with text, a file or both. A message from another chat is refused before the send is counted. Older text summaries can be quoted; an older non-text message without a stored quote body is unavailable. Sensei and callers without a Chat Session sandbox can send text and replies, but cannot upload a file.

When you link, WhatsApp sends Sensei the recent history of your chats. Sensei stores the messages up to 14 days old, then every new message, in 1:1 chats and groups. It also stores your contacts' names and phone numbers. Agents do not see imported history as new, and a chat whose last message is imported history does not wait on a reply. Text, names, phone numbers and attachment download details are encrypted, and messages are kept for 14 days. Contacts are kept for as long as WhatsApp is connected.

Agents use the Sensei message UUID returned by whatsapp_read_chat or whatsapp_list_new to download or transcribe an attachment. Older stored messages may contain only text, a caption and a media summary; their files cannot be recovered from that summary. An attachment in imported history can be downloaded while WhatsApp still holds the file. View-once attachments are omitted from downloads and transcription, including those you sent.

Downloads are limited to 20 MB (20 MiB); speech transcription is limited to 10 MB (10 MiB), as for Telegram. Oversized media is refused, and unsupported formats, photos, stickers and silent animations cannot be transcribed. Transcripts include the message date, whether you sent it, duration when available, MIME type and chat and message ids. Reading, downloading and transcribing send nothing and mark nothing read.

In a Chat Session, downloads go to generated paths under /tmp/whatsapp, separated by connection, chat and message. The sender's filename is returned as metadata and never used as a destination path. Sensei and API-key callers receive a private link to one file, valid for exactly five minutes. After the link expires, the stored file remains private; expiry does not delete it. WhatsApp may expire a file before Sensei's 14-day message retention ends. An unavailable attachment returns the reason; Sensei does not ask the sender to upload it again.

Paused

At the first restriction or ban signal from WhatsApp, Sensei pauses the connection and stops reading and sending. The row reads Paused with a Resume button, and agents get paused. WhatsApp can signal a restriction by closing the connection as forbidden, imposing a limit on contacting other people, or refusing a send because the account is restricted.

Press Resume in Settings > You > Integrations to connect again from the stored session, without a QR code. Paused and Reconnect required appear on the Settings row only; they open no Sensei need and send no notification.

Reconnect and disconnect WhatsApp

If you remove Sensei from Linked devices on the phone, or the phone stays offline for about 14 days, WhatsApp can log the device out. The row then reads Reconnect required, and agents get reconnect_required. Press Disconnect, then Connect, accept the risk again and link with a new QR code or pairing code. An existing bound device cannot be overwritten by another link.

Disconnecting removes the stored session, chats, messages and contacts, and Sensei logs the device out of WhatsApp. If Sensei cannot log it out within 10 seconds, it still removes the connection and the dialog says to remove Sensei yourself from WhatsApp > Settings > Linked devices on the phone.

Disconnecting or deleting your account removes stored messages and their attachment download details. It does not remove files already delivered to private storage or a Chat Session's /tmp/whatsapp directory.

Sensei keeps the session encrypted on its own server. It never reaches a sandbox, your browser or an agent. The connection survives worker restarts and deploys without linking again. If WhatsApp is temporarily unreachable, Sensei keeps the session and tries again; the row can read Temporarily unavailable. What an agent reads can show in the session's messages, as for every connection below.

WhatsApp limits

Sensei allows 10 link starts per member per hour and 3 pairing codes per phone number per hour. A request over a limit is refused with the time you can try again.

Agents send at most 5 messages a minute and 50 a UTC day per number, with one send at a time. Every call sends to one chat. Files, replies, first-contact sends and sends to groups each count as one against the same limits. Before it sends to a group, Sensei checks that you are still in it. A call over the limit is refused with the time it can send again; a second send while one is waiting or going out is refused as busy.

A send while WhatsApp is disconnected is refused. If the worker stops before taking a waiting send, the call fails within 15 seconds and nothing is sent later. If a message may have left but WhatsApp has not acknowledged it, the agent gets outcome_unknown and must read the chat before trying again. Sensei never retries a send itself. A slow file upload can outlast the tool's 25-second wait and return outcome_unknown; a later acknowledgement can still confirm it. A refused message never appears as sent in the read tools.

If Sensei restarts while it imports the history from linking, the import stops where it was and is not resumed. Chats it had not reached stay empty until new messages arrive.

A message received in the instant the worker crashes can be missing from what agents read, even though it is still on the phone. A hard crash just after sending can also lose the latest session change and cause a later message to that person to be refused; a crash just after a session update can lose that update. These windows last milliseconds.

Excalidraw

Connect Excalidraw to let your agents create and share diagrams. No Excalidraw sign-in is needed.

1. Open Settings > You > Integrations.
2. Open the Excalidraw row and press Connect.
3. Read the dialog and press Connect. The row reads Connected.

Agents read Excalidraw's element format reference and share diagrams as excalidraw.com links. Sensei encrypts each diagram before it uploads it to excalidraw.com's storage, and the key travels only in the link. Anyone holding a link can open the diagram, and Sensei cannot delete it. Share only what you want people with the link to see.

Agents can also add to a drawing you already shared. Give your agent a link made in excalidraw.com with Share > Export to link. It reads the drawing, adds or deletes elements, and returns a new link with the result. Your original link stays as it was. Sensei uses the key in the link only to open the drawing, and never stores it.

Excalidraw reaches the same callers as every Personal integration. Your own Chat Session Turns, Sensei Turns you started and your API key can use it. Workspace Cron Runs and Deploy Chat never use it.

Excalidraw limits

• It does not reach drawings saved in your Excalidraw account.
• You have one connection, labelled Excalidraw. It cannot be renamed.
• You can share 10 diagrams a minute and 200 a UTC day per member. A new link made from an existing drawing counts as a share. A call over the limit is refused with the time it can share again.
• A live collaboration link (#room=) cannot be read or extended. Each extended drawing is a new snapshot, not a change to the board.
• A drawing with images cannot be extended, and the result must fit 64 KiB.
• Links stay open after Disconnect. Sensei cannot delete them.

LinkedIn and X

Connect a LinkedIn or X account so your Sensei can work in it, in Sensei's browser on one of your Macs. A connection is one account on one Mac and one Chrome profile. Only your Sensei uses it, in a turn you started or for Watching. Chat Sessions and Cron Runs never do.

1. Open Settings > You > Integrations on a computer, and press Connect on the LinkedIn or X row.
2. Choose the Mac and the Chrome profile. Only online Macs and profiles you allowed under Settings > Devices > Chrome sign-ins are offered.
3. Press Connect. Sensei opens the site on that profile, signs in from your Chrome there if you are signed in, reads the account's name and handle, and replies in a new thread.

If you are signed out, Sensei asks you to sign in on that Mac. The card then shows the account, the profile and Mac, and when Sensei last checked.

Before account work, Sensei uses the connection you name, or the only one, and asks which when several match. It checks that the page shows the same account. If it shows another, Sensei does nothing as it and signs it out of its browser. The card reads Different account, with the name found, and Reconnect starts the check again. To use the other account, disconnect and connect it. Signed out also offers Reconnect.

Disconnect removes the connection and its Watching, not the sign-in in Sensei's browser, which stays until you turn the profile off in Chrome sign-ins. Sensei stops using the account at its next check.

Watching LinkedIn and X

Watching is always on: once your Sensei has read the account a LinkedIn or X card connects, it reads new direct messages there from then on. Gmail, Slack, Telegram and WhatsApp connections are watched the same way, from the moment they connect; Disconnect is the only way to stop it. About every 15 minutes, your Sensei reads the conversation list in Watching’s own browser on that Mac and profile. It reads while the Mac is online. Each read uses your Sensei model. The messages stay unread on the site. Each new preview reaches your Sensei, which asks on a card before it replies or marks anything read.

After you approve a card, your Sensei does what it says in its own browser on that Mac, as it does any browser task. It opens the conversation and sends the reply, or opens it to mark it read. Opening a conversation marks the whole conversation read on the site.

If your Sensei runs on Sensei Free, Watching cannot read LinkedIn or X. The card’s Watching line shows Needs a model subscription.

A read runs only its two kosuke commands, so a message cannot lead it anywhere else. The app can hold Claude, Kimi, GLM, DeepSeek and Grok models to that. On a GPT, Muse or Gemini model, Watching does not read, and the card’s Watching line shows Needs another model. With Auto, a read uses one of the models it can run on when you have one.

When reading stops, the card’s Watching line says why. It can show Signed out, Different account, Mac removed, Profile off, Update the Sensei app, Needs a model subscription, Needs another model or Trying again. For Signed out or Different account, explicitly Disconnect, then Connect again.

Who can use a connection

Your Sensei can use your connections when you started the turn. So can the tasks you are the Assignee of, in a turn you sent. A helper agent that turn starts with full access, called a Delegated Run, can use them too. Agents find your tools with kosuke integrations list, next to the workspace's tools. Tell an agent "my Linear" for your own connection and "the workspace’s Sentry" for a workspace integration; it asks when it is unclear. Its name for your connection is the alias, such as notion-personal. From your laptop, an API key can list your tools with --workspace <workspaceId> and call them; see Run integration tools.

Nobody else gets them:

• A turn in your session that a teammate sent acts as the workspace, so it is offered none of your tools.
• Workspace Cron Runs and Deploy Chat never use them. A Personal Cron uses yours and the Personal space’s workspace integrations, in both sandbox and Sensei Thread runs, and no other workspace’s connections.

A teammate's agents never reach your connection, even in a project you share.

What an agent reads through your connection can show in the session's messages, which your teammates can read. The line atop Your integrations says so, and the 1Password and Mercury cards repeat it because their reads return secrets and account numbers. Agents are told to use what a connection of yours returns only for what you asked, but connect only accounts whose content you are comfortable seeing there.

What agents can do

Agents can use every action Sensei offers for a connected tool: the ones that read, create or update. There is no list to choose from. Sending mail, such as Gmail's send action, sending an existing draft or emailing a Zoho Books invoice to its customer, is an action like any other, so connect only accounts you are comfortable with an agent writing to. Actions that delete, and actions the vendor does not describe, are never offered. Some tools offer only a reviewed set of actions, as described in their sections, such as Dropbox. FreshBooks only reads.

Gmail also offers an unsubscribe action. Ask Sensei or a Chat Session to unsubscribe you from a newsletter, and the agent uses one of its emails. When the sender supports one-click unsubscribe, Sensei sends that request to the sender. Otherwise Sensei sends the sender's unsubscribe email from your Gmail account, and it shows in your Sent folder. The agent tells you which way it used and whether it worked. When the email offers only a web page to unsubscribe, the agent gives you the link to open yourself.

A request an agent has already sent cannot be recalled: a mail that went out stays sent. To stop your agents, disconnect the connection.

Connection status

Status	What it means	What to do
Not connected	Nothing is connected.	Open the row and press Connect.
Connecting	An authorization is waiting to be finished.	Finish it, or press Cancel.
Connected as <account>	Your agents act as the account shown. Xero shows the organisations' names. Higgsfield, 1Password and Excalidraw read Connected because they name no account.	Nothing.
Temporarily unavailable	The tool could not be reached just now. The connection is kept.	Nothing. Try again shortly.
Reconnect required	The authorization stopped working. With several connections, only that card says so.	Press Reconnect on the card, or disconnect it.
Paused	WhatsApp signalled a restriction or ban. Sensei stopped reading and sending.	Press Resume on the WhatsApp row to use the stored session again.
Not available	The tool is not set up on your deployment, so it cannot be connected.	Nothing here. Whoever runs your deployment sets it up.

A tool your deployment no longer offers shows as no longer offered, and you can only disconnect it.

Disconnect

1. Open the tool's row, then press the trash icon on the connection's card. Its tooltip reads Disconnect.
2. In the dialog, press Disconnect.

Your Sensei and your tasks lose access as soon as you confirm, in tasks already running too. A request an agent had already sent may still finish. For Excalidraw, Sensei removes your connection. Links already shared stay open, and Sensei cannot delete them. For other tools, Sensei deletes its stored authorization, and keeps retrying in the background if that cannot finish at once. Revoking the authorization inside the tool is a separate step in the tool's own settings. For Telegram and WhatsApp, Sensei also ends its session in the tool, as described under Reconnect and disconnect Telegram and Reconnect and disconnect WhatsApp.

You do not need to disconnect when you leave a workspace. Your connections stay yours and keep working in the workspaces you still belong to. Deleting your account disconnects all of them.

To list or disconnect your connections from a script, run kosuke integrations connections list personal, or kosuke integrations connections delete personal <toolkit> --connection-id <connectionId>.

Limits

• LinkedIn and X Watching reads only each conversation’s newest message preview. Several messages in a row arrive as the newest one, and a long one is cut.
• A Watching read only reads. Sensei lets it open only pages of the connection's own site, and never click or type. It reads the conversation list in a phone-sized window, where no conversation opens by itself, so nothing is marked read.
• Sensei never enters X’s encrypted-chat passcode or reads a key. If the conversation list is behind a passcode, Watching cannot read it. The card shows Trying again after 30 minutes.
• Only you can connect or change your connections. An API key can list and disconnect them and nothing more, because connecting needs your browser. Resuming a paused WhatsApp connection also needs your browser.
• You can have one unfinished authorization at a time. Starting another, here or in a workspace's Integrations, ends the first.
• You can have one open Telegram login at a time. Starting another ends the first.
• WhatsApp keeps one linked device per member. Link starts and pairing codes are limited, as described under WhatsApp limits.
• Sensei asks Telegram for at most 3 codes an hour for one phone number. After that, log in with a QR code.
• Agents send at most 10 Telegram messages a minute and 200 a day from each account. A message, a reply, a poll and a scheduled message count one each, and a forward counts every message it forwards. A scheduled message counts when it is scheduled. Edits, deletes, reactions and votes do not count. The day is counted in UTC. A call over the limit sends nothing, and is refused with the time it can send again.
• WhatsApp sends are limited to 5 a minute and 50 a UTC day per number, with one send at a time. Files, replies, new chats and groups share those limits. Messages are kept for 14 days, from the recent history WhatsApp sends when you link and then every new one; see WhatsApp limits for crash and send outcomes.
• A search of all your Telegram chats for one sender covers private chats and basic groups only, not supergroups or channels. To find a sender there, search that one chat.
• When Telegram asks to wait before a call, the agent is told for how many seconds. Sensei never retries the call.
• Telegram files go to and from a Chat Session's sandbox, up to 20 MB each. A Sensei turn, or a call with an API key, sends text only, and downloads a message's file through a private link that works for 5 minutes. A story's file downloads only into a Chat Session's sandbox.
• Agents transcribe voice notes, audio, video notes and videos up to 10 MB. A message with no speech, or a photo or other file, is refused with the reason.
• One call runs at a time on each Telegram account. A call that waits more than 15 seconds is refused, and the agent can try again.

Next steps

• Integrations for the tools a workspace's admins connect for everyone.
• Your account and preferences for the rest of Settings > You.

Changing native credentials

Cloudflare, Higgsfield, 1Password, Typefully, Telegram, WhatsApp, LinkedIn and X require explicit Disconnect, then Connect. Existing labels, sharing and configuration remain editable. WhatsApp Resume uses the stored session without new credentials. OAuth integrations, including Mercury, retain Reconnect.