Claude speaks MCP, which means it can use any tool an MCP server offers it. The usual obstacle is not Claude. It is that somebody has to run that server, register an OAuth application with every vendor whose data you want to reach, store the tokens somewhere safe, and refresh them before they expire.
That is the part this skips. Claude connects to one URL, and everything behind it is already authorised.
What you need
An account, and an app you want Claude to reach. There is nothing to install locally and no server to deploy — the gateway is a hosted HTTP endpoint, so the only thing that changes on your machine is one line of configuration.
1. Connect the app
From your workspace, open Apps, find the toolkit you want, and press Connect. You will be sent to the vendor's own consent screen — Google's, Notion's, Slack's — and asked to approve the scopes.
Two things worth knowing about what happens next.
The authorisation is scoped to the workspace that created it, and it never becomes a value you have to handle. For connectors Spinrun runs itself the credential goes into an encrypted vault that only the server role can decrypt; for the rest it stays with the connection provider and Spinrun holds a reference. Either way there is no token in a config file on your laptop.
And connecting the same app twice gives you two connections, not one. Two Slack workspaces or two Google accounts have separate credentials, so they stay separate here — which matters more than it sounds once an agent can reach both.
2. Set the rules before you hand it over
Do this before an agent gets access, not after. Open the app's settings and set its policy — three rows per app, each of them allow or block:
| App | Read | Write | Destructive |
|---|---|---|---|
| Gmail | Allow | Allow | Block |
| Notion | Allow | Allow | Block |
This is checked at the gateway, on every call, before it reaches Google or Notion. It is not advice to the model, and it is not a prompt the model can talk itself out of. Blocked tools do not even appear in the list Claude is given.
The classifier reads the verb in each tool's name — GMAIL_SEND_EMAIL is a
write, GMAIL_LIST_MESSAGES is a read, GMAIL_TRASH_MESSAGE is destructive —
and anything it cannot place is treated as a write rather than a read. There is
more on how that works, and where it is imperfect, in
Agent permissions belong at the gateway.
3. Point Claude at the gateway
Open Claude's settings, add a remote MCP server, and paste your gateway URL:
https://spinrun.ai/mcpThat is the whole configuration. There is no API key to paste, because Claude is
one of the clients that can complete a browser authorisation: the first time it
reaches the gateway it gets a 401 carrying a WWW-Authenticate header, follows
that to the sign-in page, and asks you which workspace it may reach.
4. Ask for something real
Not a test. Something you would otherwise have done by hand:
Find every email from last week where somebody asked for a demo, and add a row to the Notion database "Inbound" for each one with the name, company and the date they wrote.
Claude will look at the tools it can reach, search Gmail, and write the rows. If it tries something you blocked, it will say which rule stopped it rather than failing mysteriously.
When there are more tools than Claude wants to read
A workspace with a dozen connected apps offers a lot of tools, and every one of them costs context before the conversation even starts. Two things help.
The gateway has a compact mode that stops sending the full tool list
entirely. Instead Claude gets a small set of discovery tools and searches for
what it needs — spinrun_search_tools to find a tool by describing the job,
spinrun_get_tool_schemas to read its arguments. Both are free: a workspace that
searches before it calls should come out cheaper than one that guesses, or the
feature would be arguing against itself.
Large results are handled the same way. Anything past a threshold is written to storage under an opaque handle and kept for a day, and Claude reads it back a page at a time rather than swallowing a 4 MB CSV whole.
What to do next
Look at the activity log. Every call the agent made is a row — the tool, the outcome, the duration, which connection it used and who it acted as. Reading it after the first real task is the fastest way to build an accurate picture of what your agent actually does, which is usually both less mysterious and more interesting than expected.
Then go and connect the second app. Almost everything worth automating spans two of them — the use-case library is mostly examples of exactly that.