Workspace plugins
Manage installed plugins for your workspace — connect, authenticate, monitor health, and enable or disable.
Overview
After installing a plugin from the marketplace, you manage it from Workspace settings → Plugins. This page lists all plugins installed in the current workspace, their connection status, and their health.
Plugin status
Each installed plugin shows one of the following statuses:
| Status | Meaning |
|---|---|
| Active | Installed and available to agents. For MCP servers and integrations, the server is connected and responding. |
| Needs Connect | Installed but not yet connected (MCP servers and integrations only). Run the Connect step to activate. |
| Needs re-auth | OAuth token expired or revoked. Re-authentication required. |
| Disabled | Manually disabled. Tools are not injected into the agent toolchain. |
| Healthy / Degraded / Unreachable | Health probe results for connected MCP servers and integrations (see Health status). |
Connecting an MCP server or integration
Agent Skill, Knowledge Source, and Agent Capability plugins activate immediately on install. For mcp_server and integration plugins, you must complete a Connect step:
OAuth
- Click Connect next to the plugin.
- You are redirected to the provider's authorization page.
- After granting access you are returned with status Connected.
- Tokens are stored encrypted (AES-256-GCM + KMS). You receive an in-app notification if your token expires.
API key (secret auth)
- Click Set secret next to the plugin.
- Paste your API key or bearer token.
- Click Save. The secret is encrypted at rest and never shown in the UI again.
Re-authenticating
If an OAuth token expires or is revoked, the plugin's status changes to Needs re-auth. A notification appears in the bell menu with a link to re-authenticate. You can also click Re-authenticate directly on the plugins page.
Health status
Connected MCP server and integration plugins report a live health status:
| Status | Meaning |
|---|---|
| Healthy | Server is reachable and responding to health probes. |
| Degraded | Some MCP calls are failing; tools may be unreliable. |
| Unreachable | Server did not respond to the last health probe. |
| Unknown | No health probe has run yet since the server was connected. |
Agents skip servers with Degraded or Unreachable status and log a warning in execution telemetry.
Disabling a plugin
Toggle a plugin off from the installed plugins list at any time. For MCP servers and integrations, this deactivates the workspace server connection — the plugin listing and any stored credentials remain intact and can be re-enabled later.
Role requirements
| Action | Required role |
|---|---|
| View installed plugins | Any workspace member |
| Connect / re-authenticate OAuth | Org Owner or Org Admin |
| Set API key / secret | Org Owner or Org Admin |
| Enable / disable a plugin | Workspace Owner or Org Owner/Admin |
| Uninstall a plugin | Workspace Owner or Org Owner/Admin |