Connected Apps and MCP

What connected apps are

Connected apps are a user-level concept representing real services such as Gmail, Outlook, calendars, browsers, knowledge bases, or databases. MCP may power them under the hood, but everyday tasks don't require understanding the protocol.

A connected app does not automatically get access to all of your projects. Read and write permissions are granted separately, and high-impact operations — sending email, creating events, modifying or deleting data — still require confirmation according to policy.

Four MCP distribution types

Official npm

Maintained and published to npm by the app vendor or an official project, such as @playwright/mcp from Microsoft. The Nexts marketplace only stores the install definition; the client runs the publisher's package directly, and Nexts does not repackage it.

{ "command": "npx", "args": ["-y", "@playwright/mcp@latest"] }

Community npm

npm MCP packages maintained by independent developers or the community. Before installing, verify the publisher, source code, permissions, and network access scope. Nexts explicitly labels these as community third-party packages and never presents them as official connectors.

NEXTS Hub

Adapters maintained by Nexts. The source lives in nexts-hub/mcp/_adapters; each service is built and released separately as a versioned .tgz — connectors are no longer bundled into a single shared runtime package.

Production install URLs must be HTTPS Release assets from nexts-hub. 127.0.0.1, localhost, local file paths, and local account-service asset URLs are for development only and must never appear in published install definitions.

Remote MCP

The client connects directly to an HTTPS Streamable HTTP MCP endpoint provided by the publisher, without downloading a local npm package. Verify the target domain before enabling — data selected for a task may leave your device and be sent to that remote service.

Authorization and data boundaries

• OAuth callbacks can be coordinated through the public domain of the Nexts account backend, which then hands the one-time result to the desktop client.
• API keys, access tokens, and refresh tokens are kept in local secure storage; they never enter your account profile or the marketplace catalog.
• Email bodies, calendar contents, cloud files, and database results are not uploaded to the account backend just because a connector is installed.
• After uninstalling a connector, revoke its local credentials as well; if needed, also revoke the authorization on the third-party service.

Troubleshooting installs

• Official or community npm: confirm Node.js/npm is available, the package name is correct, and the publisher still provides that version.
• NEXTS Hub: confirm the Release URL is HTTPS, the asset exists, and the version is compatible with your Nexts build.
• Remote MCP: confirm the HTTPS URL, network, and service status, and check whether extra request headers are required.
• OAuth: after authorizing in the browser, allow it to open Nexts; if the state has expired, restart the authorization.

If the install screen shows 127.0.0.1:3001/api/v1/catalog-assets/...tgz, the catalog still contains an old local development definition. An administrator should re-sync the catalog — it must not be used as a production install URL.