Google Analytics, Vercel Web Analytics, Leadsy and the TikTok Pixel stay off until you accept. The help chat starts once you have chosen. The scheduling button starts once you have chosen. Read our Privacy Policy.
Many tools now offer an MCP server, the standard way AI assistants connect to a service, and many more publish a REST API with an OpenAPI description. When a tool you use is not in the list, you can connect it yourself, and your assistants use it like any other integration.
Its address, and its key (in the Authorization header or a header of its own), or a sign-in to the tool
A REST API
Its base address, its OpenAPI description (pasted, or the address it is published at), and its key
Use the address from the tool's own documentation. Never put a key in an address: it goes in the key field, where it is stored encrypted and never shown back.
Waits for your Approve, every time, when you let assistants ask
StellarFirm decides what a tool may do by itself, not by what the tool says about itself:
On an MCP server, a tool counts as reading only when the server marks it as read-only, and its name has a reading word (search, get, list, read) and no word for a change anywhere in it (create, update, delete, send, insert, and the like). Query and check are not reading words here, since a query or a check-in can change things. Everything else waits for your Approve.
On a REST API, the method decides: GET reads, and POST, PUT, PATCH, and DELETE wait for your Approve. A GET whose name has a word for a change, such as getOrCreatePet, waits for your Approve too.
Some tools take a sign-in instead of a key. StellarFirm signs in the standard way for MCP servers, with your browser and the tool's own page, and renews the sign-in on its own. If the tool signs in only apps registered with it, register one with the address the page shows, then paste its client id (and its secret, if it has one).
Use a key with only the access your assistants need. A read-only key is the safest.
Only add tools you trust. A tool you add reads what your assistants send it, and what it answers reaches their work.
StellarFirm reaches only public addresses. It does not connect to a server on your own network.
Switch it off or remove it at any time. Removing it deletes its key at once.
Changing its address signs it out, and moving it to another host also deletes its saved key, so a key never reaches a host it was not given for. Paste the key again, or sign in again.