Connect to the apps your users rely on without maintaining the infrastructure that keeps it working.
Customer configuration by integration.
Send a calendar invite and email to Garry Tan for Thursday morning for the sales call. Prep the sales team too and see who can join.
Pull all orders that haven't been shipped from Airtable.
Reply to Dev's email and tell him we'd like to start using Corsair this week and to send over the agreement.
Message me in Slack when Dev finally uploads the Q4 financials to Drive.
The problem
APIs are a moving target.
Auth flows rotate, routes deprecate, schemas change, and error handling varies wildly per provider. What works today breaks quietly in six months.
Closed source tools hold you hostage.
You're limited to whatever integrations they've built. If you need an integration they don't support, you're at the mercy of their roadmap.
The solution
Set a permission mode per integration. Destructive actions require explicit approval before they execute. Your users get a review link, not a surprise.
Run the full SDK on your own infrastructure at no cost. No per-seat pricing, no data leaving your stack, no vendor markup on API calls you're already paying for.
Need an integration we don't have? Open a PR and we'll merge it. Or fork our repo and add exactly what you need. Thousands of eyes are on Corsair's infrastructure, so you're never trusting a black box.
Choose your path
Strongly typed. One credential model. One webhook pattern. Deeply integrated and custom-built to your stack.
Best for: teams who want to own the stack
Drop in a Corsair MCP URL and any agent has access to Corsair immediately. Permission gates, approval flows, and secure auth links out of the box.
Best for: teams who want to be live in minutes
Use hosted and stay code-first. Provision instances, create tenants, configure plugins, and set permissions programmatically via API.
Best for: teams building multi-tenant products
Most are closed source. If they're missing an integration, you wait for them to add it. Corsair is open source. Add any integration yourself.
You can get 80% there fast. The other 20% (token refresh, webhook signature verification, API deprecations, rate limit handling, multi-tenant credential isolation) compounds into a maintenance burden that distracts from your actual product.
No. Corsair resolves credentials internally at call time. Your agent sees method names and results only.
Data flowing through Corsair is stored and kept fresh via webhooks and polling, partitioned per tenant. This is useful if you need to query the same data repeatedly and are worried about rate limits. Reads hit the database, not the third-party API on every request.
Yes. Call it like any typed library. Add a "Sync from Airtable" button, a "Create calendar invite" action, a "Post to Slack" trigger. No agent required.
Open a PR, fork the repo, or scaffold a new plugin with one command and build it yourself. It's all open source TypeScript.
Credentials use envelope encryption. A key you control wraps per-tenant encryption keys, which wrap the actual secrets. Nothing stored in plaintext. Both keys are stored in separate places and you can't decrypt credentials without both.