Connect Your Accounts Safely
Teach your agent to connect to your real accounts (mail, calendar, GitHub, stores) with the least access possible: read-only first, scoped tokens, no secrets in files, and approval before any send, post or spend.
What we found works best
Prefer the vendor's official remote MCP with OAuth, granted read-only scopes first. For APIs without OAuth, use fine-grained, expiring tokens (e.g. GitHub fine-grained PATs) limited to the repos and permissions you need. Keep keys in a secret manager or environment variables, never in AGENTS.md, skills or chat.
Most agent incidents come from over-broad access: a full-mailbox token, a classic PAT with every repo, or a key pasted into a memory file. OAuth consent screens and fine-grained tokens make the blast radius visible and revocable.
Options we compared
| Option | Cost / account | Can act? | Source |
|---|---|---|---|
| ✅ Official vendor MCP with OAuth (read-only first) Revocable, scoped access through the vendor's own consent screen | free (your existing plan) your existing account (OAuth consent) | read-only first; send/post/spend scopes only with owner approval | vendor docs |
| ✅ Fine-grained, expiring tokens (e.g. GitHub fine-grained PAT) Limit a token to specific repos and permissions, with an expiry date | free the service account you're connecting | only what the token's permissions allow | vendor docs |
| Secrets via a manager or env vars (1Password CLI, OS keychain, .env outside the repo) Keeps keys out of prompts, memory files and git history | free (OS keychain) or your password manager's plan password manager (optional) | none | vendor docs |
Steps
- Inventory: list the accounts the agent needs and, for each, the one job it does there.
- Connect each with the official OAuth connector or a fine-grained token, read-only first.
- Move secrets out of files into a secret manager or env vars.
- Write approval rules in AGENTS.md: never send, post, spend, delete or change permissions without the owner's OK.
- Review the granted scopes monthly and revoke what isn't used.
Traps to avoid
- Classic tokens with every repo and permission
- Browser session cookies as 'connectors'
- Keys saved in AGENTS.md or committed .env files
- Granting send or delete on day one
Safety
- Never send, post, publish or spend money or credits without the owner's OK.
- Read-only first; add write scopes one at a time, with the owner's approval.
- Never paste passwords, tokens or session cookies into chat, memory or skills.
- Don't connect personal accounts to shared or untrusted agents.
- Revoke tokens you stop using.
🔒 Pro plan: guided install
Exact commands for Claude Code, Codex, Grok Bot and Gemini CLI, pinned commits, one step at a time with next_lesson and check_lesson, plus updates.
Stars and last push were checked against the GitHub API. Install commands come from vendor and README docs and have not been executed by us. Marked "unverified" where we couldn't confirm.