Every Clemali assistant is also an MCP environment: the same sources and actions, exposed as tools behind one URL. Paste it into Claude Code, Codex, Cursor or any MCP client. Credentials stay in the vault; the agent never sees a key. Change laptop, change agent, keep everything.
Admins connect Drive, Notion, Slack, databases and internal systems to an assistant. Credentials go into the vault. You do not touch a key.
From the assistant’s Developers tab, or the API. The URL is yours: scoped to you, revoked with you, rotatable without touching anyone else.
Claude Code, Codex, Cursor or any MCP client. Every source and action shows up as a tool, with the same permissions you have as a person.
claude mcp add --transport http acme-ops \ https://mcp.clemali.com/e/acme-ops/k_7f3a9c2e # Claude Code without --transport (older version): # claude mcp add-json acme-ops '{"type":"http","url":"https://mcp.clemali.com/e/acme-ops/k_7f3a9c2e"}'
# tools exposed by acme-ops notion.search notion.read_page drive.search drive.read_file slack.read_channel slack.post_message # action, confirmed in the agent pg.query # read-only, through the private link
Credentials are encrypted at rest and referenced by name. You never paste a key into a config file again.
The gateway adds the credential to the upstream request. The agent receives the result, not the key.
Your URL only reaches what you may read as a person. Leave the company and it stops the same minute.
Rotate your URL if it leaks; nobody else changes anything. Admins rotate credentials in the vault; every environment follows.
Any service with an API becomes a source or an action through an MCP server. Register it once in the assistant’s catalogue; the company’s employees and your agents get it at the same time, with the same permission checks.
Create assistants, connect sources, invite members and read the activity log from CI with a personal token. The API never returns a credential value. API reference →
# register an internal MCP server as a source
curl -X POST $API/v1/environments/acme-ops/tools \
-H "Authorization: Bearer $CLEMALI_TOKEN" \
-d '{"alias":"erp","url":"https://mcp.internal.acme.fr/erp","authMode":"token","secretName":"ERP_TOKEN","usage":"source"}'No. Credentials live in the vault and are added to the upstream request when a tool is called. The agent sees the tool’s name, its schema and its results.