# Integrations — Private Accounts, Exact Agent Permissions Source: https://mcpscraper.dev/integrations Integrations # Connect your tools. *Give your agent somewhere to act.* OAuth is only the handshake. MCP Scraper turns each account into a private set of approved reads and gated actions for live MCP work and scheduled agents. Connect an account See scheduled work $3/month per active Nango connection. Function, proxy, and compute usage draws from your plan's shared Credits. ** Private connection surface one user · one account · exact grants Google Analytics Google Search Console Google Drive Gmail Google Calendar Facebook Pages Meta Marketing Slack Zoom LinkedIn X YouTube GitHub Resend Xero Tenant credential boundary Grants stay encrypted. Scheduler credential storage keeps the grant. MCP sees only a connection reference and approved tools. ** Approved reads ** Writes off by default Ask now MCP Use approved reads and actions in the current conversation. Run later Scheduled Actions Grant one schedule an exact account and exact tools. Keep context Memory Snapshot one approved result into searchable private Memory. 15 configured provider types 212 live-approved read operations 179 gated account actions 0 shared customer connections One connection, three surfaces ## Use the account now, later, and as remembered context. A connection is not a separate plugin that lives beside MCP Scraper. It becomes a tenant-owned capability source that the MCP, the Mastra scheduler, and your private memory can each use within their own permission boundary. Ask now ### MCP List the user's connections, inspect approved tools, and run one exact read or enabled action from the current agent. Run later ### Scheduled Actions Attach selected accounts and tools to one recurring job. Ownership and provider allowlists are checked again at execution time. Keep context ### Memory Run one approved read, redact its result, and store it at a stable searchable path without giving Memory the provider credential. Connection + measured usage ## Pay for the accounts and provider work you actually use. Each active Nango connection is a $3/month add-on; Starter, Growth, and Scale do not include a connection. Reads, enabled actions, exports, Memory imports, and scheduled work debit the same Credit balance as the rest of MCP Scraper using measured provider activity. Keep connected ### $3 / month Per active Nango connection. Every account remains owned by the identity that connected it. Provider activity ### 2 + 2 Credits 2 Credits per connected function run and 2 Credits per provider proxy request. Function compute ### 5 Credits / second 5 Credits per compute-second, prorated from aggregate compute milliseconds so sub-second work is billed to its measured duration. Scheduled connected work also has the 75-Credit base per started run. Agent mode adds 1.5× OpenRouter’s reported model cost. Separately metered scraper, transcription, video-analysis, and browser tools keep their published rates. Billing starts only when execution starts. A started occurrence keeps its 75-credit base if the task later fails; an automatic retry of that same occurrence reuses the same billing identity and is not charged twice.[See the billing example and full rate card.](/pricing#connected-billing) Connected account → searchable Memory ## Save one approved result. Search it from the next prompt. `import_service_connection_to_memory` runs exactly one current read tool on one tenant-owned connection. The server redacts credential-bearing fields, labels the provider result as untrusted evidence, writes it to a stable server-generated path, and indexes it for RAG in the same request. 01 · Exact read One approved tool The connection ID, provider key, and tool must match the authenticated user's current `readTools` list. 02 · Safety pass Redacted, not trusted Credential fields, bearer tokens, signed URLs, and known secret formats are removed. Binary and oversized results fail closed. 03 · Stable snapshot Server-owned path The same connection, tool, and arguments resolve to the same Markdown path in an existing ordinary Memory vault. 04 · RAG receipt Indexed in the call The receipt returns the path, content hash, indexed chunk count, and either `search_ready` or `stored_not_indexed`. ``` mcpscraper tools call import_service_connection_to_memory \ --args '{"connectionId":"conn_…","providerConfigKey":"google-drive","tool":"","args":{},"vault":"Library"}' \ --json ``` **Snapshot contract, not account sync.** One invocation performs one bounded read. It does not paginate, crawl a whole account, continuously watch changes, propagate deletions, or create normalized tables. Use provider-specific bulk export or scheduled sync only where that dataset is explicitly supported. Resend · official remote MCP ## Email operations without handing an agent the keys. Connect through Resend's hosted OAuth screen. MCP Scraper keeps that grant encrypted inside the authorizing user's tenant credential boundary, discovers the official tool surface, and applies a reviewed policy before either MCP or Mastra can see a tool. Official endpoint Resend OAuth mcp.resend.com/mcp Private boundary Tenant credentials Encrypted scheduler storage Runtime access MCP + Mastra Exact account and exact grants Approved reads 33 Inspect sent and received email, attachments, logs, contacts, broadcasts, templates, automations, domains, segments, topics, and webhooks. Gated actions 45 Draft, send, schedule, update, verify, and remove only after the account action switch and the exact per-job grant are both enabled. Blocked sensitive tools 7 API-key and OAuth-grant administration, the raw editor connector, and raw webhook creation never enter the agent toolset. Approved results redact credential-bearing fields. **Investigate delivery.** Read request logs and message status without opening the Resend dashboard. **Work the inbox.** Pull inbound messages and attachments into support or operations triage. **Ship approved communication.** Prepare a template or broadcast, then use a separately granted send action. Policy reviewed against the [official open-source server ↗](https://github.com/resend/resend-mcp). Headless clients may use a Resend API key as a Bearer fallback, but OAuth is the default connection path. Provider-specific bulk data ## Where an export adapter exists, ask for the whole week. `export_connected_service_data` is a separate, provider-specific path for Gmail, Google Calendar, Google Search Console, Meta Marketing, Slack, Zoom, and Resend. For those supported datasets, MCP Scraper handles pagination, bounded detail hydration, normalization, and delivery behind the tool boundary—so the model does not read one record at a time. Slack exports paginate channel history, fetch threaded replies with bounded concurrency, honor provider retry delays, and preserve an exact continuation. Each invocation returns up to 5,000 records and an exact continuation when more remain. ** Connected data export one bounded MCP export Request “Give me the last 7 days of emails.” export_connected_service_data 01 Page Provider cursors handled server-side 02 Hydrate Messages fetched with bounded concurrency 03 Deliver Inline or private artifact automatically Range Last 7 days Fetched 1,284 emails Delivery Private JSONL emails-2026-07-04—2026-07-11.jsonl Private · retained 7 days · link expires in 15 minutes Ready Small result ### Returned inline Calendar events, recordings, transcripts, or messages can come straight back to the current agent when the bounded result fits. Large result ### Private artifact Large exports become private JSONL with seven-day retention and a 15-minute signed link. Expired links can be renewed without pulling the provider again. Long result ### Safe continuation If the export reaches its item bound, the response includes an exact continuation object so the next call resumes the same dataset and time range. Resend exports accept `resend_data` for a 12-collection account history: sent email, received email, logs, contacts, broadcasts, templates, domains, segments, topics, webhooks, contact imports, and contact properties. The six high-volume core resources can also be requested individually. Each provider page hydrates at most 25 records before the product export continues, checkpoints, or switches to private JSONL delivery. Search Console exports accept `search_console_performance`and walk bounded Search Analytics rows across every accessible property for a fresh live extract. Deterministic `connection_sync`also maintains one typed `gsc_performance_*` table per connection. Agents discover its `tableName` with` list_service_connections`, filter it with the Memory table tools, and call `export_search_console_table_data` for a private filtered JSONL download without calling Google again. API-only Search Console batches do not need that table. The live connection exposes `inspect-urls` and `query-search-analytics-batch` as reads, plus four action-gated property and sitemap batches. Each returns per-item receipts; destructive batches default to dry-run and require an explicit confirmation token. All integrations ## Every configured provider, with its actual capability status. OAuth-connected and scheduler-ready are different states. All 15 rows show what can actually be granted today. ### Google Analytics Ready now Run GA4 reports and metadata reads. Optionally enable property, data-stream, and conversion-event administration. **5** reads **6** actions ### Google Search Console Ready now Read verified properties, Search Analytics performance, sitemaps, and URL inspection results, including quota-conscious API-only batches. Scheduled sync can maintain a typed tenant-owned performance table, but batches do not require a database. Property and sitemap changes remain separately gated and destructive batches default to dry-run. **8** reads **8** actions ### Google Drive Interactive ready Browse shared drives and bounded file pages; inspect metadata, changes, Docs, Sheets, and small documents. Folder creation and file copy are separately gated. Bulk corpus delivery is still in development. **10** reads **2** actions ### Gmail Ready now Read messages, threads, drafts, labels, and filters. Sending remains a separately enabled and explicitly granted action. **9** reads **1** actions ### Google Calendar Ready now Read calendars, events, availability, and upcoming schedules. Event creation remains separately gated. **9** reads **1** actions ### Facebook Pages Ready now Read Pages, posts, comments, scheduled posts, and videos. Optionally enable approved publishing and moderation actions. **10** reads **9** actions ### Meta Marketing Permission-aware ready Inspect and operate campaigns, ad sets, ads, creative media, insights, audiences, catalogs, rules, studies, leads, and brand-safety data. Every mutation is separately gated; effective tools depend on Meta-granted permissions and approved app features. **55** reads **60** actions ### Slack Ready now Read channels, messages, threads, reactions, files, and user context. Whole-channel history and threaded replies can be exported as one resumable JSONL operation. Workspace mutations remain separately gated. **18** reads **19** actions ### Zoom Ready now Read meetings, registrants, recordings, transcripts, and users. Meeting creation remains separately gated. **9** reads **1** actions ### LinkedIn Core ready Read the connected member profile today. Community Management workflows require a separate approved LinkedIn app. **1** reads **0** actions ### X Ready now Monitor posts, mentions, lists, likes, users, and Spaces. Optionally enable posting, follows, likes, bookmarks, and list actions. **12** reads **13** actions ### YouTube Ready now Read channels, videos, playlists, comments, and captions. Optionally enable playlist, comment, and video actions. **9** reads **12** actions ### GitHub Ready now Read and sync repositories, issues, pull requests, commits, releases, and workflows. Optionally enable exact create, update, merge, run, or delete actions. **27** reads **20** actions ### Resend OAuth MCP ready Read email, inbound mail, delivery logs, contacts, broadcasts, templates, and account configuration. Sending and every mutation remain gated; credential, OAuth, and raw editor-session access stay blocked. **33** reads **45** actions ### Xero OAuth connected The account connection is configured. Live scheduler tools remain unavailable until the deployed Xero function inventory is enabled. **0** reads **0** actions What this changes ## Cross-account work becomes one inspectable agent run. Public web tools find outside facts. Integrations add approved inside-account context and actions without collapsing every account into one shared credential. ### Build a Monday marketing pulse Combine GA4, Facebook, YouTube, and X reads from the exact accounts you choose, then write one dated report into Memory. Summarize last week's marketing performance every Monday ### Publish only after approval Use an approved Facebook or X action after live writes are enabled for that account and the exact tool is granted. Publish this approved update Friday at 9am ### Review what changed in Drive List a bounded folder or change page, read supported Docs and Sheets, and summarize the material without exposing the account credential. Summarize the files changed in the campaign folder since Friday ### Keep client accounts separate Every connection belongs to one MCP Scraper identity. Agency schedules select the correct client account instead of sharing one token pool. Use the Acme GA4 connection for this report ### Turn activity into durable context Read current account data, compare it with prior runs, and file the result into the vault or table where future agents can find it. Compare this week with the last four stored runs The permission flow ## Connecting is step one. Granting is separate. This separation keeps a useful OAuth connection from silently becoming broad scheduled authority. 1. Connect through OAuth You approve the provider's consent screen. MCP Scraper never asks you to paste an access token into a prompt. 2. Inspect the capability list The connection reports the exact read tools and gated action tools currently available for that provider. 3. Enable writes if needed Reads and writes are separate. Live actions remain off for the account until you deliberately enable them. 4. Grant the minimum A scheduled action receives one exact connection and only the tools required for that job. Actual details ## The safety boundary is part of the feature. Provider approvals and available tools vary. MCP Scraper reports those limits instead of treating a successful OAuth screen as proof that every endpoint is ready. Are users connected to the same accounts? No. Every OAuth connection is stored under the authorizing MCP Scraper identity and receives its own connection reference. A schedule must select that exact connection. Does the model receive provider tokens? No. Credentials stay server-side. Agents receive a tenant-scoped connection ID plus the approved tool names they may request. Does connecting enable writes? No. Actions remain off until enabled for that account. Scheduled work still needs an exact per-tool grant after the account switch is enabled. What does one connected account cost? Each active Nango connection adds $3/month. Work through it uses the shared Credit balance at 2 Credits per function run, 2 per provider proxy request, and 5 per compute-second measured from milliseconds. The dashboard Credits tab shows the rate card and balance; History records settled usage. Are all provider endpoints available? No. Google Drive's interactive reads and two additive actions are live, while deterministic bulk transfer is still in development. LinkedIn Community Management needs a separate approved app. Meta Marketing has a reviewed permission-aware tool surface, but each connection only receives the operations its effective Meta grant and approved app features allow. Broad public access can still require Meta, Google, or LinkedIn review. Does the Memory import pull an entire connected account? No. It stores one bounded result from one exact approved read tool. It does not paginate or continuously sync. Dedicated bulk exports and scheduled syncs are separate capabilities available only for explicitly supported provider datasets. $3/month per active connection · measured usage spends Credits ## Connect the accounts your agents can actually use. Start with one provider. Add a second account only when the work needs it. Open Integrations