Metorial

More than 1,000 catalog integrations are available, each deployed as a provider with its own config and per user authentication (OAuth through Provider Setup Sessions, API tokens or custom credentials), and their tools reach the agent through a session's MCP URL or direct tool calls on the API. Customers add their own tools as custom providers deployed from code, container images or remote MCP servers, and can use their own OAuth apps.

Sourcemetorial.com/docs/build/operate/providersread 2026-09-22

Agents connect to tools through Metorial, which does not run the agent itself: sessions merge the tools of several providers behind one connection, and Magic Skills package instructions, files and optional scripts that the customer's AI client or agent follows when it invokes the skill. Sequencing and branching happen in that client or in the customer's framework, and no workflow runtime of Metorial's own is documented.

Sourcemetorial.com/docs/platform/workforce/magic-skillsread 2026-09-22

Live access to the systems that hold company knowledge (Google Drive, Notion, Confluence and others through its integrations) is what Metorial gives agents, and a Magic Skill can carry reference documents for its instructions. No index, retrieval layer or semantic search over the customer's corpus is documented, and the API's Documents and Stores resources are not described as retrieval.

Sourcemetorial.com/docs/platform/get-started/core-conceptsread 2026-09-22

Several controls constrain what agents may do: access groups decide which integrations and skills each user or SSO group sees, people request more access and administrators review and resolve those requests, session tool filters can restrict a provider to read only tools, and Protoguard screens each message and tool call, blocking prompt injection and requests outside the customer's policies. These are constraints on the agent and approvals of access; no approval step a person acts on before a specific agent action commits is documented.

Sourcemetorial.com/docs/platform/workforce/portalsread 2026-09-22

Metorial states SOC 2 Type 2, independently audited for security, availability and confidentiality with reports under NDA, and GDPR compliance with a DPA and a published subprocessor list, and the homepage carries a SOC 2 badge. The access side is specific: SSO and SAML with per user and per group policies, roles as named permission sets attached to members and teams, SCIM and SAML IdP sign in on the homepage, and secrets encrypted in Vault with keys managed through KMS; RBAC and SAML SSO are listed on the Enterprise plan.

Sourcemetorial.com/securityread 2026-09-22

Connection logs record what agents did: each session's timeline, and every tool call opened to its tool name, arguments and result, filtered across sessions by status, source and agent, with tool errors listed separately. Workforce shows each agent's operations and connection history tied to its linked identity, the logs also carry provider auth and Protoguard events, and the Tool Calls API exposes inputs, outputs and status. Log retention is 30 days on Dev, 90 on Scale and custom on Enterprise.

Sourcemetorial.com/docs/platform/integrations/review-connection-logsread 2026-09-22

Sessions are lightweight runtime contexts created per request or per user interaction, and Metorial stores each user's provider credentials as auth configs for reuse, but no memory layer that keeps an agent's context across runs is documented. Stored credentials and a session's connection record are not memory with a stated scope and lifetime.

Sourcemetorial.com/docs/build/operate/sessionsread 2026-09-22

Deployment can sit in Metorial's cloud or the customer's: the Security page offers on premises deployment in the customer's own cloud or data center and a choice of EU or US regions for data residency, and each provider runs in its own isolated enclave behind firewalls. On premises deployment is listed on the Enterprise plan.

Sourcemetorial.com/securityread 2026-09-22

The machinery to package a customer's own workflows is what Metorial supplies: Magic Skills with templates, groups and curated skill marketplaces, imports from public repositories, and portals that publish them to users. The skills in those catalogs are written by the customer's own experts, the integration catalog is a set of integrations rather than packaged work, and the three sample apps in the docs are tutorial code. No ready made skill, template or role specific agent of Metorial's own is documented.

Sourcemetorial.com/docs/platform/workforce/magic-skillsread 2026-09-22

Providers expose triggers that fire on events in the external system, and a callback, a webhook Metorial registers against every matching integration instance, notifies the customer's application so it can run event driven workflows (glossary and Callbacks API reference). Callbacks are a metered plan feature, 10,000 a month on Dev and 100,000 on Scale. Events in outside systems can start work without a person asking.

Sourcemetorial.com/docs/build/glossaryread 2026-09-22

Tools reach whatever model the customer runs: the provider runtime formats session tools for OpenAI, Anthropic, Google Gemini and OpenAI compatible APIs such as DeepSeek, Together AI and xAI, and for the Vercel AI SDK, each called with the customer's own provider key, and any MCP client such as Cursor, Claude Code or Codex can connect. Metorial names no model of its own, so model choice, provider and key are the customer's throughout.

Sourcemetorial.com/docs/build/providersread 2026-09-22

A documented REST API with keys scoped to one environment makes Metorial callable from outside, covering providers, deployments, sessions, tool calls, skills, portals and callbacks, alongside JavaScript and Python SDKs and a CLI. It serves MCP as addressed endpoints, a session connection URL and Magic MCP URLs, and customers package their own tools as versioned custom providers with rollback.

Sourcemetorial.com/docs/build/apiread 2026-09-22

A testing path exists before production: sandbox environments with their own deployments, keys, auth configs and logs, where a development key never reaches production, Metorial Explorer for calling a provider's tools against test data, and version pinning and instant rollback for custom providers. That is validation and debugging before release; no way to evaluate the customer's agent with a readable, comparable result (scored test cases, a pass rate or a judge verdict) is documented.

Sourcemetorial.com/docs/build/operate/organizations-and-projectsread 2026-09-22

Everything runs through APIs and MCP servers: Metorial's providers reach applications that way, and no browser, desktop or remote machine control of its own is documented.

Sourcemetorial.com/docs/build/operate/providersread 2026-09-22