Integrations

Integrations

Agent products with a built-in TAP mode: turn it on and that agent reaches its services through TAP — no service keys in the agent process, per-call audit, and your team’s approval policies enforced server-side. TAP works with any agent that can make HTTP calls (see Quickstart); the integrations here ship TAP as a first-class option in the product itself.

OpenTag (CopilotKit)

OpenTag is CopilotKit’s open-source on-call triage assistant for Slack and Microsoft Teams. Stock OpenTag holds a key per service (Linear, Notion, PostHog) in the agent process; TAP mode replaces that with one TAP_AGENT_KEY:

# .env — instead of LINEAR_API_KEY / NOTION_MCP_AUTH_TOKEN / POSTHOG_PERSONAL_API_KEY
TAP_AGENT_KEY=tap_...

What changes when it’s on:

  • No service keys in the bot’s process. TAP injects each credential server-side and pins it to that service’s own API host — a prompt-injected bot has no key to leak and nowhere else to send one.
  • Any connected service, zero code. The bot gets two generic tools (tap_discover + tap_call); anything you connect in the TAP dashboard is usable on the next Slack message — including services OpenTag has no MCP integration for.
  • Lazy setup from inside Slack. Ask the bot for a service that isn’t connected yet and it replies with a prefilled, origin-verified setup link; the secret goes into the TAP dashboard, never into chat.
  • Per-service migration. Keys you keep in .env stay direct; each key you remove moves that service behind TAP. Your Slack write-confirmation flow is unchanged, and TAP policy can additionally require dashboard or passkey approval for higher-stakes credentials.

Setup, demo, and details live in OpenTag’s docs/tap.md (currently on the integration branch while the upstream PR is in review).

Building an integration?

The whole agent-facing surface is four headers against two endpoints — /forward and GET /agent/services — so a TAP mode for your agent product is typically an afternoon, not a project. The pattern that works: gate it behind one env var, compose per service with your existing credential path, and let TAP’s missing-credential errors drive setup from inside the conversation. We’re happy to help — team@human.tech.

ExamplesCredential Setup