Connectors
Connectors give the AI Assistant its tools, its connections to your other systems and written know-how for recurring tasks. This page explains the three kinds of connector, how they sign in, and how every call passes the same rights checks as the screen you click in.
The AI Assistant can only do what its connectors let it do. A connector is one capability you hand to the assistant: reading a web page, creating an Excel file, searching your mailbox in Outlook, filing a scan into your archive, or following your company’s way of writing meeting minutes. Admins decide which connectors the organisation has. Each person switches connectors on for a conversation and connects their own accounts. Whatever the AI Assistant does through a connector, it does with the rights of the person asking.
Take Brandt & Söhne, a machine builder with 60 people. Jana Brandt, their admin, installs Outlook Mail, Outlook Calendar and Paperboi, the archive the company already uses. Tom Keller, project lead for the Nordwind Relaunch, asks the AI Assistant: “Which supplier contracts expire this quarter? Draft a reminder to each contact.” It searches Paperboi with Tom’s own key, reads the contacts, and prepares the drafts in Outlook with Tom’s Microsoft account. Nothing is sent until Tom clicks Confirm on each draft.
The catalog sorts connectors into three kinds. You see the kind as a chip on every connector page.
Tool
A capability built into nexxus: read a web page, search the web, create a Word or Excel file, generate an image, run code, search your files and company knowledge. Tools keep their data inside your installation or go where the chat already goes, so most of them are installed for every organisation from the start.
Integration
A connection to another system: Microsoft 365, Google Workspace, Slack, Jira, HubSpot, Personio, Paperboi and many more. An integration acts with a real account at that provider, so it needs a sign-in, and an admin installs it on purpose because data leaves for a third party.
Skill
Written instructions for a recurring task, such as turning a transcript into meeting minutes. A skill can name the connectors it needs. When you switch the skill on in a conversation, nexxus switches those connectors on with it.
Some connectors are marked Planned. They appear in the catalog so you can see what is coming, but they cannot be installed yet.
Most connectors ship with nexxus in the catalog. People with the right to build connectors add their own and share them with colleagues, roles, a business unit or the whole company.
Sources
Connectors
Installation, connections and rights per organisation
Where they show up
A connector has to pass three gates before the AI Assistant can use it in your conversation.
When the AI Assistant needs a connector that is installed but switched off, it can suggest it. You see a card These connectors could help with a button Activate. The AI Assistant never switches a connector on by itself.
Each connector offers actions. Paperboi, for example, has 36: 24 that read (search documents, list the inbox, show expiring retention periods) and 12 that write (create a task, file a document into a folder, archive an inbox document).
Built-in tools need no sign-in. Integrations do, and each connector declares how.
| Sign-in | What happens | Examples |
|---|---|---|
| None | Nothing to set up. | Read web page, Create table |
| API key | Each person, or an admin for everyone, enters a key from the provider. | Paperboi, Perplexity, DeepL |
| Login | Username and password or token, for APIs that use HTTP basic authentication. | Toggl Track, Guru, HiBob |
| OAuth | Each person signs in at the provider in a pop-up window. An admin registers an app with the provider once. | Outlook Mail, Gmail, Slack, Jira Cloud |
| OAuth with automatic registration | Like OAuth, but nexxus registers itself with the provider. There is nothing for the admin to set up. | Zapier |
| Client ID and secret | The organisation’s app signs in by itself. No person connects. | Personio, PayPal |
Every connection is either personal or shared.
Some connectors allow both. Then your own connection wins, and the shared one covers everyone who has not connected their own. Decide this on purpose: with a shared key, everyone with access to the connector sees what that key sees.
A connection belongs to the provider and the app it signed in with, not to a single connector. If you connect Outlook Mail and your admin has set up Outlook Calendar and SharePoint with the same Microsoft app, all three use that one sign-in. When a connector needs permissions your existing sign-in does not have yet, its page offers Add permissions, and the provider asks only for what is missing.
Many OAuth connectors split what they can do into permission groups. Outlook Mail, for example, has three:
| Group | Unlocks | Default |
|---|---|---|
| Read mail | Search and read mails, list folders | Always on, required |
| Create drafts | Create drafts and reply drafts | Ticked when you connect |
| Send mail | Send drafts, mails and replies | Off until you tick it |
The admin decides which groups the organisation allows. When you connect, nexxus asks What may the assistant do at Outlook Mail? and requests only the groups you tick. The provider’s own consent screen then asks for exactly that. Actions of a group the provider did not grant are not offered to the AI Assistant at all. You can add a group later with Grant.
This is what happens between “File this invoice in the 2026 folder” and the document landing in Paperboi.
The AI Assistant picks an action
Only from connectors that are switched on in this conversation and that you may use.
nexxus checks your rights
Installed and on, your role and business unit, the action allowed, the permission group granted.
You confirm
Writing actions show a card with every argument. Nothing runs before your click.
The call leaves with your account
The server adds your key or token and checks the target address against the network allowlist.
The answer comes back marked
The provider answers with what your account may see. nexxus marks it as outside content before the AI Assistant reads it.
Each check has a reason:
The + button in the chat input (Attach files and connectors, with the number of active connectors) opens a menu with File from this computer, One of your files and Connectors. The last one leads to Connectors of this conversation: a search, a switch per connector, grouped into Tools and Integrations and connectors, a Connect button where your account is still missing, and More connectors, which leads to the catalog. Typing @ in the chat input lists connectors by name and switches on the one you pick.
In a new, still empty conversation, integrations that still need your account also appear under the chat input, in the row Connect accounts: one icon per account, and a click starts the connection.
While the AI Assistant works, the answer shows a line Working that turns into Done with the number of tools used. Open it to see every call with its Input and Result.
If the AI Assistant needs an account you have not connected, the chat shows a card Connection missing with a Connect button. After connecting, Try again sends your question once more.
A connector can appear as its own folder tree in Files. Paperboi does this when the admin switches on its setting In Dateien anzeigen (show in Files). The folders and documents are read live from Paperboi with your key or the shared one and marked Read only. Nothing is copied into nexxus. To change something, you use Paperboi itself or ask the AI Assistant.
Some connectors can start one of your AI schedules when something new arrives: a new mail in Outlook, a new merge request or issue in GitLab, a new ticket in Tackl, or an event that an n8n workflow sends. You set this up on the connector page under Triggers. A polling trigger checks at an interval of at least 5 minutes, with your rights, and only reads. The first check only records what is already there, so subscribing never fires for your whole existing inbox.
My profileConnected accounts lists every account you have connected, which connectors use it, which permissions it holds and until when it is valid. There you reconnect or disconnect, and under Connect more accounts you see installed connectors that still need your account.
For admins and developers: each connector declares a runtime that does its work.
| Runtime | What it does | Used by |
|---|---|---|
| REST | Each action is one HTTP call to the provider’s API, with paging, size limits and the provider’s error messages passed through. | Most integrations, and every connector you build from REST actions or OpenAPI |
| MCP | The tools come from a remote MCP server. Tools the server does not mark as read-only count as writing and ask first. | Your own MCP connectors, Zapier, DocuVault |
| Built in | Claims tools nexxus already has, such as the file search or the document creator. Each action switches one capability on or off. | Most tools |
| Gateway | Tools that run in the AI gateway, such as code execution and subagents. They cannot be switched off per conversation, so they are always on. | Run code, Subagents, Image, Transcription |
Connector rights are part of the role model. Administrators hold all of them.
| Right | Allows |
|---|---|
ai.plugin.read | See the connectors page and the installed connectors |
ai.plugin.use | Use installed integrations and your own or shared connectors in a chat. Built-in tools need no extra right. |
ai.plugin.connect | Connect your own account with a connector |
ai.plugin.create | Build your own MCP connectors and REST or OpenAPI connectors, and import skills, for yourself |
ai.plugin.share | Share your own connectors with people, roles, a business unit or the whole company |
ai.plugin.admin | Install and configure catalog connectors, edit the network allowlist, manage every connector |
Roles created from the onboarding templates for AI users get ai.plugin.read, ai.plugin.use and ai.plugin.connect. For roles that already existed before connectors, assign these rights in the role editor. See Roles and the permission reference.
