Every external service your Charm can use is accessed through an 

 — a standardized endpoint that exposes the service's capabilities as discrete tools. Your Charm calls those tools. The service executes the action and returns the result. You never see any of this directly; it happens as part of a normal completion.

Before a Charm can use an MCP server, two things need to be in place:

Once both are true, your Charm can use it.

When you try to use a Charm that has access to an OAuth-protected MCP server for the first time, CharmIQ prompts you to authorize. A browser window opens, you sign in to the external service (Google, GitHub, Slack, etc.), and you grant the requested permissions. That's it.

CharmIQ stores your encrypted access token. From that point forward, your Charm uses it automatically — you don't need to authorize again unless you revoke access or the token expires (in which case CharmIQ refreshes it silently).

 Your colleague's authorization doesn't give your Charms access and yours doesn't give theirs. Connections are per-user and per-service.

When you run a Charm and it needs to call an external service:

This is transparent. You don't prompt differently. You don't manage tokens. You just work.

The specific services available depend on what your organization administrator has configured. Common patterns:

: A single Zapier connection exposes tools for thousands of services: Slack, Google Sheets, Salesforce, HubSpot, Monday.com, Trello, and on. If Zapier can do it, a Charm with Zapier access can do it.

: Your Charm can run SQL queries against your data warehouse. Ask it a business question; it figures out what to query, executes it, and interprets the results.

: Browse repositories, read pull requests, search code, list issues. Useful for engineering managers who want to understand what shipped without opening GitHub, and for developers who want a Charm that understands the actual codebase.

: Google exposes their technical documentation through MCP. A Charm with this connection can answer Google Cloud and API questions from the source, not from training data.

You can view and revoke your connections through CharmIQ's authorization settings. If you have multiple accounts with the same service — a personal and work Google account, for example — you can have separate connections for each. CharmIQ uses whichever one you've marked as default, or prompts you to choose if no default is set.

Revoking a connection removes CharmIQ's access to that service immediately. The Charm can still run; it just can't call that MCP server's tools until you reauthorize.

 — The overview: how inbound, outbound, and Application connections all fit together.

 — Organization admins: how to set up the services your team can connect to.

 — Putting connected Charms to work in sequence on a real problem.

 — How to structure research workflows that use live data sources effectively.

How to give your Charms access to Zapier, Google BigQuery, GitHub and thousands of other services — and what happens when you do.

Connecting Your Charms to External Tools

How This Works

Authorizing a Connection

What Happens at Runtime

What You Can Connect To

Managing Your Connections

Patterns

Next Steps