Personal connectors

Personal connectors let an individual workspace member authorise access to their own sources (Google Drive, GitHub, GitLab, Slack, Linear) without sharing credentials with the workspace admin.

Knowledge sources created from a personal connector are tagged with a fixed user:<your-id> audience, which is immutable: even your workspace owner can't widen the visibility, and other members will never see your content in their MCP responses.

Plan availability

• Free: up to 3 personal connectors per user.
• Team: up to 5 per user.
• Business / Enterprise: unlimited.

Connecting your Google account

1. Open My connectors from the sidebar.
2. Click Connect Google. You'll be redirected to Google's OAuth consent screen.
3. Approve the drive.file scope (Google Picker). OrgMCP does not request full Drive read access. Folder picks do not grant children — for company knowledge corpora, use company Drive (invite email).
4. Once redirected back, your account shows up under My connectors. Use live MCP tools on Picker-granted files, or share folders to the company Drive reader for recursive indexing.

Connecting your GitHub account

1. Click Connect GitHub on the same page.
2. Approve the repo scope (or public_repo if you only want to index public repos).
3. Pick the repos you want indexed. The list mirrors what your GitHub account can see — OrgMCP does not pull private repos you haven't explicitly added.

Connecting your Slack workspace

A personal Slack install issues a user token (xoxp-…) with search:read. That is the only way to run live slack_search_messages. The workspace bot (tenant connector) can index invited channels for RAG but cannot request this scope.

1. Click Connect Slack on the same page. You will be bounced to your workspace's Slack OAuth consent screen.
2. Approve the read-only user scopes: channels:read, groups:read, channels:history, groups:history, users:read, search:read. You will only ever see channels you can already see in Slack.
3. Add a channel id to start indexing it. Personal sources stay scoped to user:<you>.

Connecting your Linear workspace

Personal Linear OAuth is generally available. The install inherits the teams you can already see in Linear; Test fails if that set is empty.

1. Click Connect Linear on the same page. You will be bounced to Linear's OAuth consent screen.
2. Approve the read-only read scope. You will only ever see teams / projects / issues you can already see in Linear.
3. Add a team key (e.g. ENG) to start indexing it.

Token handling

• Refresh tokens are KMS-encrypted in the per-tenant connector_credentials table (scoped to your user). If you are a member of two workspaces and connect the same provider in each, the two credentials are independent.
• Access tokens are short-lived. After a silent refresh they may be stored encrypted so MCP tools keep working without a re-consent; they are never shown in the UI.
• You can revoke a connection at any time via My connectors → Disconnect. Within 5 minutes, all indexed content from that source disappears from MCP responses; the underlying chunks are purged within 24 h.

What the workspace admin can see

Audit log entries (e.g. "vahur connected GitHub", "vahur ran 12 personal-search calls today"). The content of your searches and the files in your personal sources are not visible to anyone but you.

What happens when you leave the workspace

If your membership is revoked, all your personal connectors in that workspace are auto-revoked. The associated knowledge sources are tombstoned for 7 days (so you can request a copy via the GDPR export endpoint) and then hard-purged.