Using Xome
Connections.
Link the apps you already use. Tools only reach the model for connections you've enabled, and every write asks first.
What you can connect
| Connection | Auth | What the agent can do |
|---|---|---|
| One OAuth login | Gmail: search, read, draft, send. Calendar: list, create, update, delete events. | |
| Slack | OAuth | Send messages, search, list channels, read history. |
| GitHub | OAuth | Issues, PRs, code search, notifications, comments. |
| Notion | Pasted internal token | Search, read, create and update pages, query databases. |
| Solana wallet | Privy embedded wallet | Balances, prices, send, swap, see the Wallet page. |
| Local folder | Folder picker | List, read, search files; write files with approval. |
| MCP servers | URL (+ optional bearer) | Whatever tools the server exposes. |
How connecting works
OAuth providers open a popup; the resulting token is handed straight to your browser and stored locally. When a tool runs, the token rides along on that single request through the stateless proxy and is never retained server-side. Disconnecting deletes the token from your browser immediately.
- Google is one connection, a single login grants both Gmail and Calendar (combined scopes), mirroring the mobile app.
- Notion: create an internal integration at notion.so/my-integrations, paste its secret, then share the pages you want with it, Notion only exposes explicitly-shared content.
- Local folder: uses the File System Access API (Chrome/Edge). Access is scoped strictly to the folder you pick; writes always show the approval sheet.
The system prompt tells the model which integrations are active (and which account), so it knows what it can act on, but tools for disabled integrations are never even visible to it.