How to Connect an MCP Connector

Connectors give Accounting Intelligence and your agents the ability to act in systems outside DualEntry. Each one exposes a set of tools over the Model Context Protocol, and Accounting Intelligence can call those tools inside a conversation once the connector is authenticated. Use this guide to install a connector from the Marketplace, connect your own account to it, set how its tools behave for you, add a connector of your own, or work out why an installed connector reports no tools.

​

Before you start

Installing a connector and using one are separate steps with different requirements, so check which half applies to you before starting. Installing a connector for your organization requires the Admin, IT, or HR role, or a custom role with permission to create integrations. Removing a connector requires Admin or IT, or a custom role that can archive integrations, so HR can install a connector but not remove it. Installation affects everyone, because it fixes the server address and the OAuth client that every user connects through. Connecting your own account to an already-installed connector requires no special role. Any user can do it for themselves, and it only ever touches their own credentials and tool permissions. Some connectors also need an OAuth client that belongs to your organization rather than to DualEntry. Gmail is the common case: it runs against Google’s hosted Gmail MCP server and requires a Google Cloud OAuth web application client that you own. Create that client in the Google Cloud console before you begin, or the consent step fails for everyone. Installing a connector does not by itself let Accounting Intelligence change anything in the external system without asking. Tools that write ask for approval in the conversation until the person using them decides otherwise for their own connection.

​

How connectors work

A connector has two layers: organization and personal. The organization installs the connector once, and each person then connects their own account to it. The organization-level install holds the server address and the OAuth client configuration. Someone whose role can create integrations sets it up, and it is shared by everyone in the organization. Credentials are not shared. Every user who wants to use the connector completes the provider’s authorization flow themselves, and DualEntry stores that person’s tokens against their own user record. Accounting Intelligence loads a connector’s tools only for users who have personally connected, so an installed connector does nothing for a colleague who has not authorized it yet. Tool permissions are personal too. Each user decides, for their own connection, which tools run without asking, which ask for approval first, and which are blocked. A colleague who lets a tool run without approval changes nothing about how that tool behaves for you. Interactive tools reach only the conversations you are present for. A scheduled agent receives a connector’s read-only tools and nothing else, whatever your interactive tools are set to, so an unattended run can search an external system but cannot change anything in it. This is why the Gmail connector drafts into the mailbox of whoever is asking. There is no single organization mailbox behind it. If you and a colleague both connect Gmail, each of you gets drafts in your own mailbox, and neither of you can read the other’s mail through Accounting Intelligence. Connectors authenticate one of three ways, decided by the connector rather than by you: OAuth with credentials DualEntry registers automatically, OAuth with a client your organization owns, or a static bearer token you supply. Servers are reached over Streamable HTTP, or over SSE for older servers.

​

Install a connector from the Marketplace

The Marketplace lists connectors DualEntry has already integrated, Gmail among them. Installing one records the server for your organization and opens it for individual users to connect. The MCP Connector Directory lists every connector in the Marketplace by category, with a link to each provider’s own MCP documentation, so check there first for what a given connector exposes.

1. Open the Agents panel and choose Connectors. The Installed tab lists connectors already installed for your whole organization, and the Marketplace tab lists the ones you can add.
2. Choose the Marketplace tab, then search for the connector or filter by Category.
3. Choose Install on the connector’s card. If the connector requires an organization-owned OAuth client, as Gmail does, supply the client details when DualEntry asks for them.
4. Complete the provider’s authentication flow. This also connects your own account.
5. Confirm the connector appears on the Installed tab, then set your tool permissions as described in the next section.

If your role cannot install connectors, the connector’s card shows Ask your admin in place of Install. Choosing it opens Request admin for access with a link to the connector that you can copy and send to your admin. DualEntry does not send the request for you. Once your admin installs the connector, it appears on the Installed tab and you can connect your own account.

​

Connect your account and set your tool permissions

An installed connector does nothing for you until you connect your own account. Open Connectors in the Agents panel, find the connector on the Installed tab, choose Connect, and complete the provider’s authorization flow for yourself. This is the step that creates your credentials and makes the connector’s tools visible to your conversations. Once you are connected, the connector’s details list its tools in two groups: Interactive Tools, which change something in the external system, and Read Only Tools, which only read. Each tool has one of three permissions, and the permissions you set apply only to your own connection. Interactive tools start at Needs approval, and read-only tools start at Always allow. Change a single tool with the buttons beside it, or a whole group with the menu in the group’s heading, then choose Save. Drafting a Gmail message is an interactive tool, so by default each draft waits for you to approve it in the conversation. If a tool’s buttons are unavailable, an admin has blocked that tool for everyone in your organization, and nobody can turn it back on from their own connection. Reconnecting your account, for example after a token expires, resets your tool permissions to these defaults. Check them again after you reconnect. Use caution before setting a customer-facing tool to Always allow. It then acts whenever Accounting Intelligence judges it useful, with nobody reviewing the call. Leave such tools at Needs approval unless you are comfortable with that. Permission changes apply from your next message rather than requiring a restart, because Accounting Intelligence re-reads your tool permissions on every turn.

​

Add a custom connector

A custom connector points DualEntry at an MCP server you supply by URL rather than one from the Marketplace. Use it for a server your team runs internally, or for a third-party server that is not in the Marketplace yet.

1. From the connectors page, choose Add Custom Connector.
2. Provide the server URL and a display name. The display name is what appears in the connector list and what you refer to when asking Accounting Intelligence to use it.
3. Choose how the server authenticates: OAuth, or a static bearer token with the header name the server expects.
4. Save, then connect your own account and confirm the tool count populates.

A custom connector behaves like a Marketplace connector once it is connected, including per-user credentials and per-user tool permissions. The tool list comes from the server itself, so the tools available to Accounting Intelligence are whatever that server exposes, and they change when the server changes without any corresponding action in DualEntry. Adding a custom connector requires the same role as installing a Marketplace connector: Admin, IT, HR, or a custom role that can create integrations.

​

Confirm the tools reach Accounting Intelligence

A connector on the Installed tab is not necessarily one Accounting Intelligence can use for you, so confirm the tools reach the assistant before building a workflow on them. Open an Accounting Intelligence conversation and ask what it can do with the connector by name. Accounting Intelligence lists the tools it can see. If it reports nothing, either you have not personally connected or your authorization has expired. A tool you set to Blocked does not appear in that list. A tool count of 0 tools available means the same thing from the other direction. It is the state of a connector nobody has authorized yet rather than a fault, and it resolves when authentication succeeds. Check from the surface you plan to work in. Connectors are available to conversations in the Agents panel and to the scheduled agents you own. Tool calls run under the permissions of the credential you authenticated with, not under DualEntry’s role model. A credential with broad access in the external system gives Accounting Intelligence that same breadth, regardless of the DualEntry role of the person asking. Every call is logged with the tool name, who ran it, whether it succeeded or was denied, and how long it took. Argument values are deliberately not recorded, so the log shows that a draft was created without storing its recipient or its text.

​

Disconnect your account or remove a connector

Disconnecting and removing both stop a connector from working, but disconnecting affects only you and removing affects everyone in your organization. To stop using a connector yourself, choose Disconnect my account on the connector. This removes only your own connection, and other users keep theirs. Check your scheduled agents first: an agent that calls a connector you have since disconnected fails at run time with nobody present to notice. Removing a connector is different. Choosing Remove from the connector’s actions menu disconnects every user in your organization and deletes the install, and it cannot be undone. It requires Admin or IT, or a custom role that can archive integrations. For anyone else, Remove is unavailable.

​

Troubleshooting

Most connector failures are authentication problems that often trace to the per-user layer. The table below maps what you see to what to do about it.

​

Related reading

• MCP Connector Directory
• How Accounting Intelligence Works
• Agents Panel Reference
• How to Send Dunning Emails with Accounting Intelligence and Gmail
• User Roles and Permissions Reference
• Audit Trail and Compliance