Skip to main content
The LangSmith tool server hosts LangChain-authored tools per provider—Gmail, Slack, Linear, Google Sheets, Tavily, and more—and publishes them over MCP, one endpoint per integration. Your workspace connects an integration once in LangSmith; declaring the matching connector is how a deployment gets those tools. The provider’s OAuth tokens never leave LangSmith’s vault: Managed Deep Agents calls LangSmith’s gateway, which resolves the credential and forwards the call upstream, so the deployment never sees, stores, or refreshes a provider token.
Managed Deep Agents is in private beta, available on LangSmith Cloud in the US region only. Join the waitlist to request access.
For other connector types, see Connectors. The GitHub connector is one of these integrations too, documented separately because it also provisions the sandbox.

Add an integration

Connect the integration for your workspace in LangSmith (Settings → Integrations), then declare the connector. Create connectors/gmail.py or connectors/gmail.ts and export a named connector:
Every integration is reached the same way, as connectors.<provider>(...): The catalog is a superset of what any one workspace can use: an integration still has to be connected in LangSmith, which the runtime reports per call.

Select tools

The config is only ever about which tools the agent gets: Tool names are not prefixed: the tool server already publishes them provider-qualified (gmail_send_email, linear_create_issue), so includeTools matches what the provider publishes rather than a name Managed Deep Agents renamed. How the deployment reaches LangSmith is a fact about the deployment, not a choice the agent’s source makes, so it comes from the environment—LANGSMITH_API_KEY, LANGSMITH_ENDPOINT / LANGCHAIN_ENDPOINT, LANGCHAIN_WORKSPACE_ID—the same way the LangSmith connector resolves those values. The schema is strict: passing apiKey or another connection option to the factory is an error, not a silently ignored key.

Whose credentials the tools use

The gateway resolves credentials for whoever the call authenticates as:
  • A deployment key resolves the workspace’s shared connection, so every thread reaches the same connected account.
  • A personal key resolves that user’s own connections, which is what makes mda dev work against your own Gmail while developing.
  • A key with no user behind it has no subject at the gateway yet. Such a deployment borrows a LangSmith agent’s shared connection by UUID through MDA_TOOLSERVER_AGENT_ID. This is temporary: it goes away once the gateway can resolve a deployment from its own API key.
For per-user credentials—each caller reaching their own Gmail—use identity credentials with a resolver for runtime.identity.user instead of this connector.

Test and deploy

Test the project locally with mda dev, then deploy it with mda deploy. Open deployment traces in LangSmith to inspect model calls, tool calls, errors, and latency. A call against an integration the workspace has not connected fails with a gateway error naming the integration. Connect it in LangSmith and retry—no redeploy needed.

Next steps

GitHub connector

GitHub tools plus sandbox checkouts, gh, and credential injection.

MCP connector

Load tools from your own remote MCP servers.

Connectors

Compare connector types.

Identity

Resolve per-user credentials for downstream calls.