Catalog
Pre-configured MCP servers and OAuth-protected APIs, all governed by Keycard identity, policy, and audit.
Pre-configured integrations for the tools your agents and apps already use - GitHub, Slack, Notion, Stripe, and dozens more. Install one from the Keycard Console and Keycard handles the OAuth setup, scopes, and per-user audit so you don’t have to wire it up yourself.
Install from the catalog
Section titled “Install from the catalog”-
Open the catalog
In Keycard Console, open Resources and click Add Resource → Explore Resources. Search with Find an API or MCP and pick a card.
-
Protect it
What happens next depends on the entry:
- One click. Where Keycard can set up trust with the vendor by itself, the card opens to a single button, for example Continue with Linear MCP.
- Bring the vendor’s app. Most API entries, and some MCP servers, need an OAuth app you register with the vendor the first time. Console shows the vendor’s setup steps, including the callback URL to paste into their form. Enter the app’s Client ID and Client Secret and click Protect GitHub API (the button carries the entry’s name).
- Paste an API key. Some MCP servers take a vendor API key instead of OAuth, and GitHub API accepts a personal access token instead of an OAuth app. Console shows the vendor’s steps for creating one; paste it and click Protect. Keycard stores the key in the Zone’s Vault and hands the same key out on every call, so the vendor sees the key’s owner rather than the signed-in user, and the key never sits in a client config.
Whichever path, Console creates the Resource and whatever credential setup it needs, then opens the new Resource’s page.
-
Connect it
- MCP server: on the Resource’s page, click Add to Coding Agent and pick Cursor (opens Cursor with the server added), Claude Code (shows the command to run), or Install manually (the server name and URL for any other MCP client). Each user signs in through your identity provider the first time their client connects. To hand out several servers as one endpoint, create a Gateway.
- API: your own code calls it with a token Keycard exchanges for the signed-in user. Call External APIs from MCP walks through the exchange, and the GitHub guide is a complete example.
Featured MCP servers
Section titled “Featured MCP servers”Official MCP servers from each vendor, run by Keycard. You install the URL into Cursor or Claude Code; every tool call is authenticated against your zone’s identity provider, evaluated against your access policies, and recorded in the audit log.
Featured API servers
Section titled “Featured API servers”Pre-configured third-party APIs (Gmail, Slack, GitHub, …) your backend can call on behalf of authenticated users. Each install creates the OAuth provider and resource your app needs. Default scopes are pre-set; you can override them at install time.