maxsuite Diagrams

Connected apps

Connected apps

Connected apps lets an outside app, such as Claude on the web, connect to Max by signing in as you instead of with an API key (module mcpauth, listed among modules as "MCP sign-in"). You approve the app once. From then on it acts as you, with your permissions, through Max's MCP tools, and you can disconnect it at any time.

In the sidebar under Connections → Connected apps. Needs: MCP. Handles sign-in: the module is marked as touching sign-in, so any agent act on it would go to a person. It offers no agent tools in any case.

Connected apps

  • Outside apps: Allowed or Not allowed for this workspace.
  • Your connections: how many apps you have connected. An administrator also sees In this workspace, the total.
  • Sign-in for outside apps: whether people here may connect apps, when that last changed and who changed it. An administrator has the switch here.
  • Your connected apps: one row per app you approved:
    • App: the host the app's identity is published at, and the name it calls itself. The host comes first, because the name is whatever the app says and the host is the part nobody else can claim.
    • Tools: all tools or search only.
    • Connected and Last used.
  • Everyone in this workspace (administrators only): every connection, with Acts as naming the person.

What you can do

Allow outside apps in this workspace

Sign-in for outside apps is off until an administrator turns it on.

  1. Open Connections → Connected apps.
  2. Under Sign-in for outside apps, press Turn on.

Turn off ends every connection in the workspace at once, after you confirm.

Connect Claude, or another app

  1. In the app, add Max as a custom connector with the address https://<your-deployment>/api/mcp.
  2. The app sends you to Max. Sign in if you are not already.
  3. Max shows a consent page naming the app's host and the name it calls itself. It says that:
    • the app will act as you, with your permissions, and anything you cannot do it cannot do;
    • it reaches Max only through the MCP tools this workspace offers to outside apps;
    • if you are given more permissions later, you connect again to pass them on.
  4. Choose how the app is shown the tools:
    • Search only: four tools that find and run the rest. Best for a large workspace, and chosen for you when you can use more than 150 tools.
    • All tools: every tool listed at once.
  5. Press Approve. You go back to the app, and the connection appears under Your connected apps.

If you do not hold the permission to use MCP (mcp:read), the consent page warns that the app would be refused on its first call. Ask an administrator first. Connecting the same app again replaces your existing connection to it.

Change how an app sees the tools

On your app's row, press Search only or List all tools. The app sees the change the next time it lists tools. It can call the same tools either way.

Disconnect an app

Press Disconnect on its row and confirm. It takes effect on the app's very next request. An administrator can disconnect anybody's app under Everyone in this workspace.

What a connection can reach

A connected app is an acting API key in every respect Max checks. Its reach is fixed when you connect: gaining a permission later does not pass to the app until you connect again, while losing one applies at once. What MCP clients may reach at all is also narrowed by the workspace's MCP settings (see MCP).

A connection ends by itself:

  • when it goes unused for 30 days, and the app asks you to sign in again;
  • when the person it acts as is suspended or removed;
  • when a refresh of its sign-in is reused, which looks like a stolen token.

Its access lasts an hour at a time and is renewed quietly while it is in use.

Who can do what

This module declares no permissions. Everything on the page is for a person signed in as themselves: an API key, or a connected app itself, is refused, so an app cannot list, keep or end connections through the access it was given.

  • Anyone signed in sees and manages their own connected apps.
  • An administrator turns sign-in for outside apps on or off, and sees and ends everyone's connections.
  • Using a connection needs mcp:read, the permission on Max's MCP endpoint (see MCP).

What happens on its own

JobWhenWhat it does
sweepEvery day at 03:23 UTCEnds connections unused for 30 days and those whose person is suspended or gone. Deletes expired sign-in codes and tokens a week after they expire, and ended connections after 90 days.

Needs

MCP.

What agents can do

This module offers no agent tools. It is how outside apps reach the agent tools of every other module, as the person who connected them.