Connections
Connections are how your avatar reaches outside its own memory — into the tools, accounts, and data your business already runs on.
Ways to connect
| Way | What it's for |
|---|---|
| Account connections | Sign in once to your shop platform, code host, email, marketing, or analytics account |
| App catalog | 60+ work apps — office, email, scheduling, e-commerce, finance, CRM, project, developer, marketing, social, analytics, search |
| MCP servers | Any MCP-compatible service, by URL or local command |
| Custom | An HTTP endpoint, a webhook, or a pasted API key for anything else |
Accounts and who uses them
You can hold more than one account per provider — a personal and a work account, for example. Each connection can serve all your avatars or be assigned to specific ones, and you can rebind an avatar to a different account at any time. Adding a connection during avatar setup wires it up in the same flow.
MCP servers
When you connect an MCP server, Weavin runs a handshake immediately — verifying the connection and listing the tools it exposes before your avatar ever calls one. From there you stay in control per tool:
- Turn individual tools on or off
- Set an approval mode: approve every call, only writes, or let reads flow
- Override any single tool to always ask, or always allow
If a server's authorization expires, you'll see a reconnect prompt — one click to re-authorize, and your avatar picks up where it left off.
Site logins
For sites without an API, you can store a login: a guided window opens, you sign in yourself (the window is time-limited), and the session is saved for your avatar's use. Each stored login shows its health — verified, expiring, or needs attention — and you can switch the account or disconnect at any time. Disconnecting removes Weavin's stored copy only; your session on the site itself is untouched. Your avatar never logs in for you and never asks for a password in chat.
Reads flow, writes ask
Connecting a tool lets your avatar read from it. Anything that changes the outside world — sending, posting, updating records — goes through approval, as covered in Trust & approvals.
Credentials
Every credential — token, webhook secret, API key, stored login — is encrypted before it's stored, is never echoed back to you, and every use is recorded.
What's Next?
- Trust & approvals — how granted access is governed
- Superpowers — putting connections to work