Zapier is the default answer to "connect two apps", and has been for a decade. It now speaks MCP, which makes it a plausible answer to "give my agent tools" too.
We build a competing product, so weigh this accordingly. But the difference here is not a feature list — it is what each thing was built to be, and that decides more than any individual capability does.
Two different origins
Zapier began as workflow automation: a trigger, a fixed sequence of steps, run the same way every time. Enormous app coverage, built over years, aimed at someone drawing a flow rather than an agent deciding one. MCP is a surface added on top of that.
Spinrun began as a gateway. The question it was built to answer is not "how do I connect two apps" but "how do I let an agent act in my systems without losing control of what it does". Everything in it points at that.
Neither origin is a flaw. They just produce different products.
Where the difference actually shows
Permissions. This is the big one. An agent is not a flow you drew — it chooses at runtime, and the interesting question is what happens when it chooses something you did not intend.
Spinrun classifies every tool as read, write or destructive from the verb in its name, and you set a rule per app. The check happens at the gateway on every call, before anything reaches the vendor, and blocked tools are not even offered to the agent. "This agent may read anything and delete nothing" is one rule per app instead of one per tool.
If you are handing an agent access to a CRM, that is not a nice-to-have. It is the difference between a bad afternoon and a bad quarter.
Attribution. Spinrun clients that can open a browser — Claude, ChatGPT, Codex — authorise as you. Every row in the activity log carries a person's name, and workspace membership is re-checked on every single call, so removing someone cuts their agent off on its next request rather than whenever a token expires.
The audit trail. Every call: the tool, the arguments, the outcome, the duration, which connection it used, which client it came from and who it acted as. Not a run history of flows you built — a record of what an agent did with your accounts.
Multiple accounts of the same app. Two Slack workspaces, two Google accounts.
Each connection keeps its own credential and is addressed apart by a suffix
(SLACK_SEND_MESSAGE__work), while the bare name keeps routing to your default.
Context cost. A workspace with many connected apps offers a lot of tools, and every definition costs context on every request. Spinrun has a compact mode that stops sending the full list and gives the agent free search tools instead. That is an agent-shaped problem, and it only exists if you built for agents.
Side by side
| Zapier MCP | Spinrun | |
|---|---|---|
| Built for | Deterministic workflows, extended to MCP | Agents, from the start |
| App coverage | Very large, built over a decade | The toolkit catalogue |
| Permission model | Flow-level | Read / write / destructive per app, at the gateway |
| Blocked tools | — | Hidden from the agent and refused if called |
| Attribution | Per connection | Per person, re-checked every call |
| Audit trail | Run history | Every call, with arguments and outcome |
| Two accounts of one app | Separate connections | Separate connections, addressed by suffix |
| Tool-list context cost | — | Compact mode with free search |
| Fixed multi-step flows | Excellent | Not what it does |
When Zapier is the better answer
Plainly: when what you want is a workflow.
If the path is fixed — "new payment, create invoice, notify finance" — you do not want an agent at all. You want a graph that runs the same way every time, and Zapier has spent a decade being very good at exactly that. An agent there adds cost, latency and variance to a problem that has none.
Their app catalogue is also larger than ours and will be for a while. If the one integration you need is theirs and not ours, that settles it.
We wrote about that line in more detail in MCP vs workflow automation, and the conclusion there is genuinely that deterministic flows should stay deterministic.
When Spinrun is
When the thing acting is an agent rather than a graph, and when you would rather decide in advance what it may do than find out afterwards.
That is not a marketing distinction. An agent with tools and no enforced permissions is a system where your only control is a sentence in a prompt competing with everything else in the context window — and losing, occasionally, in ways that are perfectly ordinary rather than adversarial.