Tool connections

An agent can always read its card and, with a repository connected, the code. Tool connections give it more: current library documentation, web search, your issue tracker, your payments data. Each connection is an MCP server.

This page is about tools your workers use. For the opposite direction — outside agents using your workflow — see The MCP server.

The catalogue

Open Tool connections from the workflow's menu. The catalogue is grouped:

Category	Examples
Code & docs	Context7, DeepWiki, GitMCP, GitHub, Microsoft Learn, AWS Knowledge, Cloudflare Docs, Postman, Hugging Face
Testing & CI	CircleCI, Buildkite, Semaphore, Cypress Cloud, Checkly, Currents, Sauce Labs, Datadog, Browserbase
Web & research	Exa, Tavily, Firecrawl, Apify
Project tools	Linear
Data & infrastructure	Supabase, Neon
Payments	Stripe
Customers	Intercom

You can also add a server that is not in the catalogue by its address.

Testing is a connection

The CodeBook application server does not execute repository code. Agents can ask a connected testing service — your CI system, a test platform or a cloud browser — or a command runner on a machine you own to run tests. Reading code alone is not a test run.

Connect that service from the Testing & CI category. One that is not in the catalogue can be added by its address; tick This connection runs tests on it.

Once a testing service is connected and its tools are switched on:

• It reaches every station that works on pull requests. The second switch below does not apply to it: the testing service is offered at each station that works with the repository. The factory's policy and each agent's own permissions still apply.
• Agents are told to use it. Before recording a pass on a pull request, the agent runs the tests there, or reads the run the service already started for the latest commit, waits for the result, and reports what ran and the outcome, naming the run. A failing run is a fail.
• Missing test execution is explicit. With no testing service connected, agents are told about that limit. A separately configured command runner can still execute allowed commands; without either option, a read-through is the only evidence and must not be reported as a test run.

What the service reports on the pull request itself — a check or a status — is what CodeBook reads before it merges: a failing check sends the card back to the developer.

BrowserStack, LambdaTest, mabl, GitLab CI/CD, Qase, Katalon, Harness and Zephyr are listed too, marked as OAuth only.

How a server signs in

Every entry says how it authenticates, because that decides whether it can be connected:

• Open — answers anyone. One click.
• API key — you paste a key or personal access token. Adding one connects immediately, so a key that does not work is a message at once, not a mystery in the middle of a run.
• OAuth only — servers that accept nothing but an OAuth sign-in. CodeBook cannot connect to these yet. They are listed — Jira & Confluence, Notion, Asana, Sentry, Vercel, Figma and others — because people look for them by name, and they are marked so you do not find out by failing.

Two switches

Connecting a server enables nothing by itself. Two switches stand between a tool and a run:

1. Every tool is off until you switch it on. A connected server lists the tools it offers; you turn on the ones you want. A server that offers thirty tools does not hand your agents thirty tools.
2. A station cannot use any of them until you allow that station. Under the station's Permissions, use tool connections is off by default.

So an engineer on Development can have live documentation while the analyst on Backlog has nothing, and a payments tool can be limited to the one finance station that needs it.

In the record

Every tool call an agent makes is a step in its run. Open the run under the station's Runs and the call is there, in order, with everything else the run did.

Tool output is data

Whatever a tool returns — a web page, a document, an issue — is read as information about the task, never as an instruction. Every skill CodeBook wrote says so, and the grants above hold whatever the content says. See The security model.