The integration code, as shipped
one.ie/web/src/pages/api/composio/
connect.ts — Starts a connection. Checks the caller may manage this workspace, then asks the provider for an auth URL. redirect.ts — Sends the client to the provider to sign in. callback.ts — Receives the provider’s answer and stores the connected account against the workspace. verify.ts — Confirms the account came back active. connections.ts — Lists the workspace’s active connected accounts. toolkits.ts — Reads the provider’s catalogue. Cached in KV for six hours. tools.ts — Lists the callable tools behind a connected account. disconnect.ts — Removes one connected account. $ npm i -g @oneie/cli$ oneie auth login$ npx -y @oneie/mcpThree real commands. No output is printed here because the output would have to be invented.
Eight routes to connect an account, one module that computes the toolbelt, one that fences what comes back. Open any of them in the repo.
composioScoped intersects three sets — the toolkits the agent asked for, the accounts your client actually connected, and the toolkits a platform skill already covers. What survives is the toolbelt for that one turn. The belt itself is never cached; only the count of active connections is held, for sixty seconds.
SKILL_TOOLKIT_MAP is why a workspace that already runs the Gmail skill does not also load the provider’s Gmail tools. One surface per job, so the model is never shown two ways to send the same email.
It is set to 20. Past twenty connected toolkits the agent stops loading tool schemas one by one and switches to the provider’s search-and-execute meta tools, so a client with a large stack does not push the model’s step out of shape.
Every integration result passes through applyModifiers on its way back, and the fence labels it as foreign data before the model reads it. Text inside a fetched email that says “ignore previous instructions” arrives as something to report, not something to obey.
Write tools carry needsApproval. Reads run. Anything that changes state somewhere else surfaces a confirmation in the conversation first, and the approval is what gets logged.
oneie auth login is a device flow. It opens a browser, you approve, and it mints a key carrying exactly your own authority — you are not handed one.
Five steps, each one a route or a function you can open.
Step 1 of 5
Their browser posts the toolkit they want. The route checks the caller may manage integrations for that workspace before it talks to the provider.
POST /api/composio/connect
Step 2 of 5
They sign in on the provider’s own screen. The account comes back bound to the workspace slug, not to a shared platform identity.
/api/composio/redirect → /api/composio/callback
Step 3 of 5
The agent counts active connections first. Zero means the whole integration branch is skipped for that turn.
getConnectedCount() — channels/src/composio.ts
Step 4 of 5
Scoped, full fallback, or the router path past FAST_PATH_MAX. Each call is deadline-bounded, so a slow provider costs this one turn its integration tools instead of holding the reply.
composioScoped() · composioFallback() · routerTools()
Step 5 of 5
Read tools execute. Write tools raise a confirmation in the conversation and wait for a human answer.
needsApproval — channels/src/aitools.ts
The connect route is the whole front door. This is its body, read line by line out of the file.
src/pages/api/composio/connect.ts
| Prop | Type | Default | Notes |
|---|---|---|---|
| toolkit | string | required | The provider’s toolkit slug. Missing it is a 400. src/pages/api/composio/connect.ts:39 |
| workspace | string | optional | Whose accounts these are. Falls back to the caller’s own slug, and is the identity the authority check runs against. src/pages/api/composio/connect.ts:43 |
| authScheme | 'API_KEY' | 'BASIC' | 'BEARER_TOKEN' | … | optional | For providers that are not OAuth. Chooses which credential shape is built. src/pages/api/composio/connect.ts:42 |
| credentials | Record<string, string> | optional | Supplied per user at initiate time. The stored auth config holds placeholders, not your client’s secret. src/pages/api/composio/connect.ts:41 |
| alias | string | optional | A label when one workspace connects the same provider more than once. src/pages/api/composio/connect.ts:40 |
The route calls requireAuthOver(request, 'manage_integrations', userId)
before it reaches the provider, so connecting an account is an act of authority over that
workspace, not an act of being signed in somewhere.
Paste this into Claude Code, Cursor, or any MCP client.
mcp.json
{
"mcpServers": {
"one": { "command": "npx",
"args": ["-y", "@oneie/mcp"] } } }3 rows here say no or partial. Those are the ones worth reading first.
| Feature | ONE | Zapier / Make | Build your own |
|---|---|---|---|
| Client connects their own account, agent works inside it | you build it | ||
| Toolbelt recomputed every turn from live connections | you build it | ||
| Approval gate on write actions, in the conversation | you build it | ||
| Foreign tool output fenced before the model reads it | you build it | ||
| One installed skill suppresses the duplicate integration tools | you build it | ||
| Agent consumes a third-party MCP serverNot shipped, and we are not going to imply it is. ONE runs an MCP server — @oneie/mcp, in the handoff above — so Claude Code and Cursor can call ONE. The reverse direction, an agent picking up tools from someone else’s MCP server at runtime, is not wired. | |||
| Browse the integration catalogue with no provider key configuredThe catalogue is read from the provider at request time and cached for six hours. With no key configured the list is empty and the page says so. That is also why this page prints no integration count. | n/a | ||
| Total control of every adapterWriting your own adapters wins on control. You then own every provider’s auth changes, rate limits and deprecations, for as long as the client is a client. |
Included in the subscription. No per-integration charge. Annual billing pre-selected.
Core integrations · 3 clients
Full catalogue · unlimited clients
Custom adapters · dedicated infrastructure
Your client connects their own accounts. The agent gets what they connected, and asks before it writes.