# What AI can do in each system, through Kroy

Kroy connects to each system below once, and holds the connection. An AI tool never receives the system’s credentials. Every action is checked against the person, the AI acting for them, what the person has allowed, the organisation’s rules and whether a person must approve.

"Needs approval by default" means Kroy holds the action until an authorised person approves it. Organisations can tighten any default.

Kroy is in early access. The Kroy app, API and MCP endpoint are opening to organisations in stages, starting with professional firms in London. New organisations join through the waitlist. The Kroy MCP Marketplace is open to everyone.

## ChatGPT

ChatGPT connects to Kroy as an AI client, for example through MCP-based connectors where the ChatGPT plan supports them. Through Kroy it can read authorised state, use granted Skills and draft work, without receiving system credentials.

- How Kroy connects: The person signs in to Kroy and authorises ChatGPT to act for them when adding Kroy as a connector. ChatGPT holds a Kroy delegation only; it never receives credentials for connected systems.
- What it can reach: Kroy State the person may see; Skills granted to the person and to ChatGPT; Connector actions those Skills allow (for example SharePoint, Google Drive, Salesforce); Artifacts and drafts; Projections shared with the person

| Action | What it does | Kind | Needs approval by default |
| --- | --- | --- | --- |
| `kroy.state.read` | Read shared state | read | no |
| `kroy.state.update` | Update shared state | write | no |
| `kroy.skill.invoke` | Use a Skill | write | no |
| `kroy.artifact.draft_create` | Create draft artifact | write | no |
| `kroy.approval.request` | Request human approval | write | no |
| `kroy.artifact.publish` | Publish artifact | write | yes |

**Limits:**

- Support depends on the ChatGPT plan in use and on its current connector capabilities. Some plans may offer read-only connectors, and some may not allow custom connectors at all.
- Workspace administrators may need to enable or approve the Kroy connector.
- ChatGPT can do only what Kroy allows for the person it acts for. Connecting it grants no extra access.
- Kroy governs what ChatGPT receives and does through Kroy. It does not control what a person pastes into ChatGPT directly.

Page: https://getkroy.com/integrations/chatgpt

## Claude

Claude connects to Kroy as an AI client, for example through MCP where the Claude product supports it. Through Kroy, Claude can read shared state, use authorised Skills and connector actions, and draft work — without receiving any system credentials.

- How Kroy connects: The person signs in to Kroy and authorises Claude to act for them, typically through an OAuth flow when adding Kroy as a connector. Claude holds a Kroy delegation only; it never receives credentials for Xero, Microsoft 365 or any other connected system.
- What it can reach: Kroy State the person may see; Skills granted to the person and to Claude; Connector actions those Skills allow (for example Xero, Microsoft 365, GitHub); Artifacts and drafts; Projections shared with the person

| Action | What it does | Kind | Needs approval by default |
| --- | --- | --- | --- |
| `kroy.state.read` | Read shared state | read | no |
| `kroy.state.update` | Update shared state | write | no |
| `kroy.skill.invoke` | Use a Skill | write | no |
| `kroy.artifact.draft_create` | Create draft artifact | write | no |
| `kroy.approval.request` | Request human approval | write | no |
| `kroy.artifact.publish` | Publish artifact | write | yes |

**Limits:**

- Support depends on the Claude product and plan in use, and on its current connector capabilities. Where remote MCP connectors are not available, Claude cannot reach Kroy directly.
- Claude can do only what Kroy allows for the person it acts for. Connecting Claude grants no extra access.
- Kroy governs what Claude receives and does through Kroy. It does not control what a person pastes into Claude directly.
- Organisation administrators may need to allow the Kroy connector in their Claude workspace settings.

Page: https://getkroy.com/integrations/claude

## Cloudflare

The Kroy Cloudflare connector triggers deploy hooks for Cloudflare-hosted sites when Kroy Publish publishes approved content, and can read deployment status. Kroy holds the hook and API token; AI never receives them.

- How Kroy connects: A deploy hook URL and, optionally, a scoped Cloudflare API token, both held by Kroy. AI clients never receive the hook URL or the token.
- What it can reach: Deploy hooks for Cloudflare-hosted sites, such as Cloudflare Pages projects; Deployment status (read, with an API token); Cache for the site’s zone (with an API token)

| Action | What it does | Kind | Needs approval by default |
| --- | --- | --- | --- |
| `cloudflare.deployments.read` | Read deployment status | read | no |
| `cloudflare.deploy_hook.trigger` | Trigger site rebuild | write | yes |
| `cloudflare.cache.purge` | Purge cached pages | write | yes |

**Limits:**

- Kroy triggers builds; it does not host your site or edit your site’s code.
- DNS, security settings, firewall rules and account settings cannot be changed through Kroy.
- Deployment status and cache purge need an API token with the relevant scope. A deploy hook alone can only start a build.
- Build success depends on your site’s own build configuration.

Page: https://getkroy.com/integrations/cloudflare

## GitHub

The Kroy GitHub connector gives authorised AI agents controlled access to repositories, issues and pull requests. Kroy holds the GitHub credentials, applies per-agent permissions and requires approval for merges, releases and workflow runs.

- How Kroy connects: A GitHub App installed on the repositories you choose, or OAuth for per-user access. Kroy holds the installation credentials; AI clients never receive GitHub tokens.
- What it can reach: Repositories and file contents (read); Branches; Issues and comments; Pull requests and reviews; Releases; Actions workflow runs (read)

| Action | What it does | Kind | Needs approval by default |
| --- | --- | --- | --- |
| `github.repos.read` | Read repository contents | read | no |
| `github.issues.read` | Read issues | read | no |
| `github.pull_requests.read` | Read pull requests | read | no |
| `github.issues.create` | Create issue | write | no |
| `github.issues.comment` | Comment on issue or pull request | write | no |
| `github.branches.create` | Create branch | write | no |
| `github.pull_requests.create` | Open pull request | write | no |
| `github.pull_requests.merge` | Merge pull request | write | yes |
| `github.releases.create` | Create release | write | yes |
| `github.workflows.dispatch` | Run workflow | write | yes |

**Limits:**

- Kroy cannot change repository settings, branch protection rules, secrets or organisation membership.
- Branch protection and required reviews in GitHub still apply; Kroy cannot bypass them.
- Access is limited to the repositories the GitHub App is installed on.
- Actions are subject to GitHub’s own API rate limits.

Page: https://getkroy.com/integrations/github

## Google Workspace

The Kroy Google Workspace connector gives authorised AI controlled access to Gmail, Google Drive and Calendar. Kroy holds the connection, respects Workspace sharing, and requires approval to send mail or share files externally.

- How Kroy connects: OAuth 2.0 with Google, configured by a Google Workspace administrator. Kroy holds the connection; AI clients never receive Google tokens.
- What it can reach: Gmail messages and drafts; Google Drive files and shared drives; Google Docs and Sheets content (read); Google Calendar events

| Action | What it does | Kind | Needs approval by default |
| --- | --- | --- | --- |
| `gmail.mail.read` | Read mail | read | no |
| `gmail.draft.create` | Create draft | write | no |
| `gmail.mail.send` | Send mail | write | yes |
| `gdrive.files.read` | Read files | read | no |
| `gdrive.files.create` | Create file | write | no |
| `gdrive.files.share` | Share file | write | yes |
| `gcalendar.events.read` | Read calendar | read | no |
| `gcalendar.events.create` | Create calendar event | write | no |

**Limits:**

- Sending mail and sharing files require human approval by default.
- Kroy respects Google Drive sharing; it cannot grant access Google Workspace does not.
- Workspace administration, user management and security settings cannot be changed through Kroy.
- Actions are subject to Google’s own API quotas.

Page: https://getkroy.com/integrations/google-workspace

## Jira

The Kroy Jira connector lets authorised AI search, create, comment on and update Jira issues through Kroy, which holds the Atlassian connection, respects project permissions and can require approval for transitions.

- How Kroy connects: OAuth 2.0 with Atlassian for Jira Cloud. Kroy holds the connection; AI clients never receive Atlassian tokens.
- What it can reach: Projects; Issues, including fields, labels and links; Comments; Workflow transitions; Sprints and boards (read)

| Action | What it does | Kind | Needs approval by default |
| --- | --- | --- | --- |
| `jira.issue.read` | Read issue | read | no |
| `jira.issue.search` | Search issues | read | no |
| `jira.issue.create` | Create issue | write | no |
| `jira.issue.comment` | Add comment | write | no |
| `jira.issue.update` | Update issue fields | write | no |
| `jira.issue.transition` | Move issue through workflow | write | yes |

**Limits:**

- Jira Cloud first. Self-managed Jira is not in scope for the first release.
- Issues cannot be deleted through Kroy.
- Project configuration, workflows and permission schemes cannot be changed through Kroy.
- Kroy respects Jira project permissions; it cannot grant access Jira does not.
- Actions are subject to Atlassian’s own API rate limits.

Page: https://getkroy.com/integrations/jira

## Microsoft 365

The Kroy Microsoft 365 connector gives authorised AI controlled access to Outlook mail and drafts, SharePoint and OneDrive files, with sending and sharing governed by Kroy policy.

- How Kroy connects: Microsoft Entra ID (OAuth 2.0). Kroy holds the connection; AI clients never receive Microsoft tokens.
- What it can reach: Outlook mail and drafts; Outlook calendar; SharePoint sites and document libraries; OneDrive files

| Action | What it does | Kind | Needs approval by default |
| --- | --- | --- | --- |
| `outlook.mail.read` | Read mail | read | no |
| `outlook.draft.create` | Create draft | write | no |
| `outlook.mail.send` | Send mail | write | yes |
| `sharepoint.files.read` | Read files | read | no |
| `sharepoint.files.upload` | Upload file | write | no |

**Limits:**

- Sending mail requires human approval by default.
- Kroy respects SharePoint permissions; it cannot grant access Microsoft 365 does not.

Page: https://getkroy.com/integrations/microsoft-365

## Microsoft Copilot

Microsoft Copilot experiences that support external tools, such as agents built in Copilot Studio with MCP, can connect to Kroy as an AI client. Kroy decides what Copilot can reach for each person and never hands over system credentials.

- How Kroy connects: The person signs in with Microsoft Entra ID and authorises the Copilot agent to act for them through Kroy. Copilot holds a Kroy delegation only; it never receives credentials for systems connected to Kroy.
- What it can reach: Kroy State the person may see; Skills granted to the person and to the Copilot agent; Connector actions those Skills allow (for example Xero, Salesforce, PostgreSQL); Artifacts and drafts

| Action | What it does | Kind | Needs approval by default |
| --- | --- | --- | --- |
| `kroy.state.read` | Read shared state | read | no |
| `kroy.state.update` | Update shared state | write | no |
| `kroy.skill.invoke` | Use a Skill | write | no |
| `kroy.artifact.draft_create` | Create draft artifact | write | no |
| `kroy.approval.request` | Request human approval | write | no |
| `kroy.artifact.publish` | Publish artifact | write | yes |

**Limits:**

- Microsoft offers several Copilot products with different extension options. Support depends on the product, licence and its current connector capabilities.
- Connecting to Kroy is typically set up by an administrator, for example as a tool in a Copilot Studio agent.
- Kroy does not change what Copilot can already reach through Microsoft 365 and Microsoft Graph. It governs only what Copilot does through Kroy.
- Copilot can do only what Kroy allows for the person it acts for.

Page: https://getkroy.com/integrations/microsoft-copilot

## Microsoft Entra ID

Kroy uses Microsoft Entra ID for sign-in and maps Entra groups to Kroy roles, so every AI request traces to a known person. Disabling a user in Entra removes their Kroy access and that of the agents acting for them.

- How Kroy connects: OpenID Connect sign-in with Microsoft Entra ID, plus an app registration with administrator consent for reading users and groups. Kroy holds the credentials; AI clients never receive Entra tokens.
- What it can reach: Users (sign-in identity, name, email, account status); Security groups and group membership

| Action | What it does | Kind | Needs approval by default |
| --- | --- | --- | --- |
| `entra.users.read` | Read users | read | no |
| `entra.groups.read` | Read groups | read | no |
| `entra.group_members.read` | Read group membership | read | no |

**Limits:**

- Kroy reads identity information. It does not create, change or delete users or groups in Entra ID.
- Kroy does not replace your Entra conditional access policies; they continue to apply at sign-in.
- How quickly a change in Entra reaches Kroy depends on how synchronisation is configured.
- Agent identities are managed in Kroy. Kroy links each agent to the person or team it acts for.

Page: https://getkroy.com/integrations/microsoft-entra-id

## PostgreSQL

The Kroy PostgreSQL connector lets authorised AI run reviewed read queries against your PostgreSQL databases through Kroy, which holds the credentials, limits tables and rows per user, and requires approval for any write.

- How Kroy connects: Database credentials for a dedicated, least-privilege PostgreSQL role, held by Kroy. AI clients never receive the connection string or password.
- What it can reach: Schemas, tables and views you choose to expose; Named queries defined by your team; Named statements for approved writes

| Action | What it does | Kind | Needs approval by default |
| --- | --- | --- | --- |
| `postgresql.schema.read` | Read exposed schema | read | no |
| `postgresql.query.read` | Run named read query | read | no |
| `postgresql.query.adhoc_read` | Run ad hoc read-only query | read | yes |
| `postgresql.statement.execute` | Run named write statement | write | yes |

**Limits:**

- Kroy does not run schema changes (DDL) or grant database privileges.
- Writes happen only through named statements your team has defined, and require approval by default.
- Databases on private networks need a network path Kroy can reach; the options are described in the docs.
- Kroy cannot see more than the PostgreSQL role it holds is allowed to. Use a dedicated role with the smallest grants that work.
- Large result sets are truncated; the AI is told when that happens.

Page: https://getkroy.com/integrations/postgresql

## QuickBooks

The Kroy QuickBooks connector lets authorised AI read customers, invoices, bills and reports from QuickBooks Online and prepare estimates, through Kroy — which holds the connection and applies per-user permissions and approval.

- How Kroy connects: OAuth 2.0 with Intuit, authorised by a QuickBooks Online administrator. The connection is held by Kroy; AI clients never receive QuickBooks tokens.
- What it can reach: Company information; Customers; Suppliers; Invoices; Bills; Estimates; Payments (read); Reports (profit and loss, balance sheet, aged receivables, aged payables)

| Action | What it does | Kind | Needs approval by default |
| --- | --- | --- | --- |
| `quickbooks.customers.read` | Read customers | read | no |
| `quickbooks.invoices.read` | Read invoices | read | no |
| `quickbooks.bills.read` | Read bills | read | no |
| `quickbooks.reports.read` | Read reports | read | no |
| `quickbooks.estimates.create` | Create estimate | write | no |
| `quickbooks.invoices.create` | Create invoice | write | yes |
| `quickbooks.invoices.send` | Send invoice to customer | write | yes |
| `quickbooks.bills.create` | Record bill | write | yes |

**Limits:**

- QuickBooks Online only. QuickBooks Desktop is not in scope for this connector.
- Payroll is excluded by default.
- Bank details and bank feed settings cannot be changed through Kroy.
- Kroy cannot see or do more than the QuickBooks connection it holds is allowed to.
- Actions are subject to Intuit’s own API rate limits.

Page: https://getkroy.com/integrations/quickbooks

## Salesforce

The Kroy Salesforce connector lets authorised AI read accounts, contacts and opportunities, log activity and propose opportunity updates through Kroy, which holds the Salesforce connection and applies permissions and approval.

- How Kroy connects: OAuth 2.0 through a Salesforce connected app, approved by a Salesforce administrator. Kroy holds the connection; AI clients never receive Salesforce tokens.
- What it can reach: Accounts; Contacts; Leads; Opportunities; Tasks and activity history; Notes

| Action | What it does | Kind | Needs approval by default |
| --- | --- | --- | --- |
| `salesforce.account.read` | Read accounts | read | no |
| `salesforce.contact.read` | Read contacts | read | no |
| `salesforce.opportunity.read` | Read opportunities | read | no |
| `salesforce.task.create` | Log task or call | write | no |
| `salesforce.note.create` | Add note | write | no |
| `salesforce.lead.create` | Create lead | write | no |
| `salesforce.contact.update` | Update contact | write | yes |
| `salesforce.opportunity.update` | Update opportunity | write | yes |

**Limits:**

- Records cannot be deleted through Kroy.
- Bulk updates and data imports are not supported.
- Salesforce configuration, metadata and user administration cannot be changed through Kroy.
- Salesforce profiles, permission sets and field-level security for the connected user still apply.
- Actions count towards your Salesforce API limits.

Page: https://getkroy.com/integrations/salesforce

## Xero

The Kroy Xero connector lets authorised AI read contacts, invoices, bills and reports, and create drafts, through Kroy — which holds the Xero connection and enforces per-user permissions and approval.

- How Kroy connects: OAuth 2.0 with Xero. The connection is held by Kroy; AI clients never receive Xero tokens.
- What it can reach: Organisations; Contacts; Invoices; Bills; Bank transactions (read); Reports (profit and loss, balance sheet, aged receivables)

| Action | What it does | Kind | Needs approval by default |
| --- | --- | --- | --- |
| `xero.contacts.read` | Read contacts | read | no |
| `xero.invoices.read` | Read invoices | read | no |
| `xero.bills.read` | Read bills | read | no |
| `xero.reports.read` | Read reports | read | no |
| `xero.invoices.draft_create` | Create draft invoice | write | no |
| `xero.invoices.approve` | Approve invoice | write | yes |

**Limits:**

- Payroll is excluded by default and is not planned for the first release.
- Bank details cannot be changed through Kroy.
- Actions are subject to Xero’s own API rate limits.

Page: https://getkroy.com/integrations/xero