---
title: "Connect an integration"
description: "Connect GitHub, Linear, PlanetScale and other tools to Firefight, and choose exactly what each one is allowed to do."
canonical: https://firefight.app/docs/api/integrations/
---

# Connect an integration

An integration is a connection to a tool you already use, so Firefight and the AI agents you connect can read from it and act in it during an incident. Connecting one never turns anything on by itself. Firefight discovers what the tool can do, and you pick which of those capabilities to allow.

Go to **Configure → Integrations** to see the catalog. Connecting and managing integrations requires admin access.

## What you can connect

Firefight lists these out of the box, grouped by what they are for.

| Category | Integrations |
|---|---|
| Code | GitHub, GitLab |
| Issues | Linear |
| Telemetry | New Relic, Datadog, Grafana |
| Errors | Sentry |
| Knowledge | Notion, Confluence |
| Databases | PlanetScale, Neon, Supabase, PostgreSQL |
| Custom | Any MCP server |

If the tool you want is not listed but speaks [Model Context Protocol](https://modelcontextprotocol.io), connect it with **Custom MCP server** and point Firefight at its URL. Nothing about the rest of this page changes.

## Connecting

Click **Connect** on the integration you want. Most connect in one click.

### One click

GitHub, GitLab, Datadog, Sentry, Linear, Notion, Neon, Supabase and PlanetScale all host their own servers, so you click **Continue with**, approve access on that tool's own consent screen, and land back in Firefight connected. There are no keys to copy and nothing to paste.

The consent screen belongs to the tool, not to Firefight, so it is the right place to narrow access. Several tools let you choose exactly what to share there.

- GitHub asks you to install its app and pick which repositories it covers
- PlanetScale asks you to tick which organizations and databases to grant

:::caution
Whatever you leave unticked on that screen, Firefight cannot reach later. If a capability keeps failing with a permissions error from the tool, reconnect and check what you granted there.
:::

### With a token

New Relic, Grafana, Confluence and PostgreSQL connect with a token instead. Choose **Use a token instead**, paste the server URL and an authorization header, and use a read-only key where the tool offers one.

Tokens are stored encrypted, scoped to that one connection, and never shown again after you save them. They are never sent to agents.

## Choosing what an integration can do

Once connected, open the connection to see every capability the tool offers. All of them arrive switched off.

Switch on only what you want available. Each capability you enable becomes a permission you can then grant to people and agents, described in [Permissions](https://firefight.app/docs/api/permissions.md).

For long lists, use the controls above the capabilities.

| Control | What it does |
|---|---|
| Reads only | Turns on every capability that only reads, and turns off every one that writes |
| Enable all | Turns on everything the tool offers, including capabilities that write |
| Disable all | Turns everything back off |

Capabilities that change something in the connected tool are marked **write**. The header tells you how many are on, and how many of those write, so widening access is visible at a glance.

:::tip
**Reads only** is the safer starting point when you are connecting a tool for AI agents to investigate with. You can always switch individual write capabilities on afterwards.
:::

## Environments

If your workspace has environments in the [service catalog](https://firefight.app/docs/catalog/overview.md), a connection can hold separate credentials for each one, so production and development are reached with different access.

Connect the same integration twice, choosing a different environment each time. You get one connection with two sets of credentials, one tool list, and the same capabilities. What changes is who is allowed to use it where, which you control in [Permissions](https://firefight.app/docs/api/permissions.md).

Connecting the same tool twice for the same environment is a different thing. Use it when you have two separate accounts, such as two GitHub organizations or two PlanetScale organizations. Choose **Add a second account** and give it a name. Its capabilities and permissions stay entirely separate from the first.

To change which environment an existing connection's credentials answer for, open the connection and use the dropdown next to those credentials.

## Keeping a connection healthy

Each set of credentials shows its own status.

| Status | Meaning |
|---|---|
| Healthy | Firefight reached the tool and read its capability list |
| Failing | Firefight could not reach the tool, with the error shown on the connection |
| Not checked | Firefight has not contacted the tool yet |

**Refresh tools** re-reads the capability list and rechecks health. Run it after the tool adds features you want, or when you are diagnosing a failure.

If a capability disappears from the tool, it switches off and stops being available. Should it come back, the permissions you granted for it are still there, so you do not have to set them up again.

## Turning an integration off

The toggle on an integration is a kill switch. Turning it off immediately removes its capabilities from everything, including agents connected over MCP, without losing your configuration. Turn it back on and everything returns.

**Disconnect** removes the connection from your list and stops every capability it provided.

:::caution
Disconnecting stops Firefight using the access, but it does not revoke it at the other end. To cut access completely, also revoke Firefight in that tool's own settings.
:::