Connected apps

Open Connected apps from the sidebar, choose a service, and complete its authorization in your normal browser. MengBot turns the resulting connection into tools that supported agent engines can use.

Official packaged app

The signed desktop app registers its own installation with MengBot's managed connected-apps service. You do not need to find or paste a Composio key.

1. Open Connected apps.
2. Search for Gmail, GitHub, Slack, Notion, or another toolkit.
3. Select Connect.
4. Finish OAuth in the browser window that opens.
5. Return to the app and ask a bot to use the service.

The installation identity is stored using Electron's operating-system-backed secure storage. Provider OAuth tokens remain with Composio and are not written into bot prompts or the renderer.

MengBot Cloud

Connected apps come with a MengBot Cloud plan. Each Cloud registers its own installation with the same managed service when it starts, so there is no key to add: open Connected apps on the Cloud and connect an app as above. The installation stays with that Cloud across restarts and is never copied into a backup.

Self-hosted or source builds

The managed service is a convenience for official packaged builds. A source build can use your own Composio project and COMPOSIO_API_KEY; see Self-hosted Composio.

You can also use your own Composio project in the packaged app or on a Cloud. Open App Settings → Connections → Self-host connected apps and paste its project key. A saved project key takes priority over the managed service for the marketplace, connection management, and bot tools. Clear the key to return to the managed service.

Connect X (Twitter)

To let bots search and read X, you do not need an X account or a Composio connection. Open Apps and find the X (Twitter) card:

• On a paid MengBot Cloud plan it says Included with your plan, with this month's use ("312 of 5,000 X calls this month"). There is nothing to set up. The allowance is 500 calls a month on Starter, 1,500 on Personal, 5,000 on Pro and 15,000 on Max, and it resets on the first of each month. Once it is used up, the card and your bots say so and when it resets.
• Everyone else pastes their own treg key on the card (it is the same key as under Settings → API keys). The card checks it with treg and shows your balance or the exact problem. Test checks it again, and Remove key takes it away. Calls are billed to your treg balance, with no limits from MengBot.
• With both, your own key is used first and the card says so. Remove it and your bots go back to the plan's included calls.

Every bot then gets Research (treg): read-only tools to search posts, read an account's posts, read a post with its replies and look up a profile, plus research tools that find and call treg's catalog for companies, people, funding, news and more. With neither a key nor a plan, no bot is shown these tools. Turn them off for one bot in its settings under Access. A routine on that bot can check X on a schedule and report only new posts. On a Cloud, your key stays with the Cloud's own settings: bots call X through MengBot and never see the key.

The steps below are only needed to post to X through Composio. Composio does not provide managed credentials for its twitter toolkit. To connect an X account:

1. Create an app in the X Developer Portal.
2. Create a twitter auth config in your Composio project using that app's credentials.
3. Save the project's key under Self-host connected apps.
4. Return to Connected apps and connect X (Twitter).

The official managed MengBot service keeps X disabled until it owns an appropriate X OAuth app. Older MengBot tasks that refer to the connector as x continue to work; MengBot translates that alias to Composio's twitter toolkit automatically.

Apps that need your own OAuth app

Some apps, such as Xero and Buffer, have no sign-in that Composio provides, so they connect only with your own OAuth app:

1. In your Composio project, create an auth config for the app (Auth Configs → Create) with your OAuth app's client ID and secret, and keep it enabled.
2. Save the project's key under Self-host connected apps.
3. Connect the app from Connected apps, or let a bot ask for it in chat.

MengBot finds the auth config by itself, switches on what Composio needs before it uses it ("enabled for Tool Router", which a config you made yourself can have off), and tells the bot which config it used. If you have several for one app, it uses the most recently created. A connection you made in the Composio dashboard itself is not visible to MengBot, so connect the app once from MengBot.

With the managed service, these apps can't connect: it uses MengBot's own Composio project, which cannot use your OAuth app. Add your own project key as above.

Multiple accounts

Connect more than one account for the same toolkit and give each a clear alias such as work, personal, or client-acme. When several accounts could perform an action, MengBot requires explicit selection instead of silently replacing the first connection.

Limit which tools a bot may use

Connecting a service makes its tools available to the workspace; it does not hand every bot every tool. Open a bot's settings on the desktop and, under Connected apps, choose per service whether that bot gets all tools, an exact list of tools, or no tools.

By default every bot keeps all tools on the apps it can see — nothing changes when you upgrade or connect a new app until you assign a grant. Once a bot has any grant, services missing from its list grant it nothing. Imported bots and shareable packages always land with no grants.

Phones show each bot's grants read-only in its profile under App tools. Editing happens on the computer; a paired phone can never change grants.

Disconnecting

Disconnecting an account revokes the upstream grant. It does not only hide the account in the local UI. Other accounts for the same toolkit remain connected.