Every tool. Every worker. One roof — with a provable record

Two ways in. First, own-token integrations that ship live today: paste your org's Slack, Gmail, GitHub and coding tokens once and every Pie can use them, each use recorded on the chain. Second, any MCP tool server — the open Model Context Protocol standard — which lets you point the pod at your databases, your SaaS, community tools, or a server you wrote yourself. That connector path ships inside the stack and switches on during setup.

The difference is the gate. In most agent products, once a tool is connected the agent can call it freely. In PAI every connected tool becomes a governed action: it's classified by risk, its first use asks you, risky classes park for your approval, and every single call is signed into a tamper-evident audit chain with its parameters hashed. The tool doesn't escape governance by being connected — the gate travels with it.

In the pod's own encrypted vault, on your infrastructure — never in our control plane, not in our cloud and not in yours. Integration tokens are stored write-only: the people whose Pies use them never hold them, and our systems only ever see booleans (configured / not), never the secret. A connector's endpoint credentials are AES-256-GCM encrypted at rest.

Yes, safely — that's Desktop Reach. You run any MCP tool server on your own machine (files, shell, an app), and the pod reaches OUT to it as a connector. Nothing reaches into your machine; the pod calls out over a connection you allow. Because host tools are higher-risk, non-read actions default to a per-call approval, and an org policy can forbid desktop connectors across a whole fleet with one switch.

Several things. Tool descriptions are treated as untrusted and an admin sees them at add-time, before anything runs. First use of every tool asks you. If a server silently changes a tool's shape (a rug-pull), the input-schema hash changes, the tool loses its approval and has to earn it again. Endpoints are checked against an SSRF denylist so a connector can't be pointed at internal infrastructure. And the kill switch still stops everything, instantly.

We label it honestly. Own-token integrations (Slack/Gmail/GitHub/coding) are live and tested today. The any-MCP-tool connector registry and Desktop Reach are enableable — they ship inside the stack and are switched on during setup, backed by tests. We don't call something live until it runs in our stack with machine-checked proof, and the whole capability list on the Possibilities page carries its honest status.