A connector is an MCP tool set that the Clemali gateway runs itself, speaking the wire protocol of your system directly. You paste a credential once; there is no MCP server to install, host or patch.
Reaching a database or a server from an agent normally means running an MCP server somewhere: a Postgres MCP server, a Redis one, an SSH one, each a process to install, host and keep updated. Clemali removes that step. For these systems the gateway is the MCP server: it connects to yours at call time, with the credential kept in the environment vault, and exposes a set of tools we designed and secured.
| Connector | You provide | Tools |
|---|---|---|
| PostgreSQL | postgres://… connection string | query, schema, explain, execute (writes, when read-only is off) |
| MySQL / MariaDB | mysql://… connection string | query, schema, explain, execute when read-only is off |
| SQL Server / Azure SQL | sqlserver://… connection string (or the server=…;user id=… form) | query (SELECT and WITH only in read-only), schema, explain, execute when read-only is off |
| Redis / Valkey | rediss://… URL | get, scan, info, command (allow-listed), set and del when read-only is off |
| MongoDB | mongodb+srv://… connection string | find, aggregate, count, distinct, schema, plus insert_one, update_many, delete_many when read-only is off |
| ClickHouse | HTTPS URL with credentials (https://user:password@host:8443), ClickHouse Cloud included | query (sent with readonly=1 and a row cap), schema, explain, execute when read-only is off |
| Elasticsearch / OpenSearch | HTTPS URL with credentials, or the URL and an API key | search, count, get, indices, mapping, cluster_health, plus index_document and delete_document when read-only is off |
| SSH | host, user, and a private key or password | run (with a command allow-list), read_file, list_files, system_info |
| Kubernetes | the API server URL, a service-account token, and the cluster CA if it is private | namespaces, pods, deployments, services, logs, describe, events, plus scale, restart and delete_pod when read-only is off |
| Prometheus | the server URL (Prometheus, Thanos, Mimir, Grafana Cloud), and a token or basic credentials if it needs them | query, query_range, series, labels, alerts, targets. Read-only by nature. |
| Object storage (S3) | access key and secret; endpoint for non-AWS | list_buckets, list_objects, get_object, stat_object, plus put_object and delete_object when read-only is off |
| REST API (OpenAPI) | a base URL or an OpenAPI document, and an optional key | one tool per operation from the document, or a single request tool |
| GraphQL | the endpoint URL and an optional token (bearer, or a named header such as a Shopify access token) | schema (introspection, rendered compactly), query. Mutations are refused unless read-only is off. |
| Gmail | an authorization on the Google account (an “Authorize with Google” button; nothing to paste) | search_messages (Gmail query syntax), read_message, list_labels; create_draft and send_message when read-only is off |
| Google Drive | an authorization on the Google account | search_files, list_recent, read_file (Docs as text, Sheets as CSV, Slides as text, text files as is). Read-only. |
| Google Calendar | an authorization on the Google account | list_events, get_event, list_calendars; create_event when read-only is off |
| Outlook | an authorization on the Microsoft 365 account (an “Authorize with Microsoft” button; nothing to paste) | search_messages, read_message, list_folders; create_draft and send_message when read-only is off |
| OneDrive | an authorization on the Microsoft 365 account | search_files, list_recent, read_file (text files). Read-only. |
| Outlook Calendar | an authorization on the Microsoft 365 account | list_events, get_event, list_calendars; create_event when read-only is off |
| Google Sheets | an authorization on the Google account | search_spreadsheets, list_sheets, read_range; update_range and append_rows when read-only is off |
| BigQuery | an authorization on the Google account, and the project id | query (GoogleSQL, read statements), list_datasets, list_tables, describe_table |
| Microsoft Teams | an authorization on the Microsoft 365 account (reading channel messages needs an admin's consent once) | list_teams, list_channels, read_channel, list_chats, read_chat, search_messages; post_channel_message and post_chat_message when read-only is off |
| SharePoint | an authorization on the Microsoft 365 account | search_sites, search_files, list_files, read_file (Word and PowerPoint documents are read as text) |
| Microsoft Excel | an authorization on the Microsoft 365 account | search_workbooks, list_sheets, read_range; update_range when read-only is off |
| Salesforce | an authorization on the org (its My Domain URL; Clemali's connected app or your own external client app) | query (SOQL), search (SOSL), get_record, list_objects, describe_object; create_record and update_record when read-only is off |
| Snowflake | the account URL and a programmatic access token | query, list_tables, describe_table; execute when read-only is off |
| Databricks SQL | the workspace URL, a SQL warehouse id and a personal access token | query, list_tables, describe_table; execute when read-only is off |
The Google Workspace and Microsoft 365 connectors authorize with OAuth: the gateway keeps the grant in the environment's vault, refreshes it, and calls the provider's API with it at each tool call. Turning read-only off asks for the write scopes, so it prompts a new authorization. A company can also connect them with its own OAuth app (a Google Cloud client or an Entra app registration) instead of Clemali's.
The list a client sees is exactly the tools of the connectors in that environment, prefixed with the server's short name. Works with any S3-compatible store (MinIO, Cloudflare R2, DigitalOcean Spaces), any HTTP API with an OpenAPI 3 document, any GraphQL endpoint with introspection on, and hosted flavours of the databases (ClickHouse Cloud, Elastic Cloud, Azure SQL, Grafana Cloud metrics).
READ ONLY transaction; SQL Server accepts only SELECT and WITH; ClickHouse is queried with readonly=1; GraphQL refuses mutations; Kubernetes hides scale, restart and delete; Redis exposes only reading commands; SSH refuses destructive command patterns. Turn write access on per connector when you need it; write and destructive tools are annotated so the agent asks before using them.Clemali connects from a small set of fixed egress addresses, shown on the connector's setup screen. If your database or server sits behind a firewall, allow those addresses. For a private network with no inbound access, install Clemali Connect on a machine that can see the target: an outbound tunnel, only the routes you declare, and the connector picks the machine under Reach via.
Change the options later from the Sources tab; the connector is re-verified. Rotate the credential by rotating the secret; the connector picks up the new value.