Everything your agent needs, in one place.
Every connector points at accounts you already run — delegated OAuth, scoped tools, and one endpoint for MCP or plain HTTP.
One question. Everything it touched, and everything it couldn't.
google_ads.spendSpend and ROAS, last 7 days
hubspot.dealsDeals that changed stage
gong.transcriptWhat was said on the calls
stripe.balanceNot connected by this org
absent
"What did we spend on ads last week, and which deals moved?"
Spend, last 7 days$47,000Deals advanced14Calls naming the top creative4 of 9Spend is up, and the pipeline moved with it — but the lift is one creative.
GoogleOAuth 2.0
yours
HubSpotOAuth 2.0
yours
gong.calls · org netflixAnother tenant's account
denied
Connect once. Then watch what it does.
Your own login, your own permissions, revocable in a click.
It reaches only the accounts you connected.
What was asked, of which account. Never the data itself.
Enforced by the database, not by our code remembering to check.
What you don't have to build.
Managed auth
OAuth, refresh and revocation, handled. Granted by you, revocable by you.
Tools scoped to your connections
An agent sees tools for the accounts you connected. Nothing else is listed.
One endpoint, any client
MCP for Claude and friends, plain HTTP for the rest. No SDK to adopt.
claude mcp add singlebrain \ --url $GW/mcp curl $GW/v1/hubspot/deals \ -H "Authorization: Bearer $KEY"
Nothing crosses between clients
Each client is its own tenant. Postgres refuses the query itself, so a bug returns nothing rather than someone else's data.
The ones that actually come up.
What exactly can the key reach?
Only the accounts its org connected, in the scopes that org granted, read-only. The reach is a consequence of the connections, so there is no separate permission list to drift out of sync.
Do you store our data?
We store the encrypted credential and a shape-only audit row per call — who asked, which service, which kind of request. Not the payload that came back, which is why the log is safe to forward to a client.
Is isolation a convention or a boundary?
A boundary. Row-level security in Postgres, with the application connecting as a role that cannot bypass it and has no schema rights. The tests run against a real database as both roles, because a mocked fence proves nothing.
How does this relate to a Single Brain deployment?
Single Grain sells managed revenue agents; the Gateway is how one reaches your accounts. Shared and multi-tenant here, with the fence doing the work — or a dedicated deployment on infrastructure nobody else shares, for agents that act rather than only read. Same operating standard either way.
Point your agent at the real accounts.
Connect an account, take a key, and point your agent at it. The activity log shows you everything it did.