How do AI agents use Convex through Open Connector?

Your user connects Convex once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Convex tools to your agent over MCP or a typed API, with credentials injected server-side on each call.

Is this a Convex MCP server?

Yes. Open Connector can serve Convex as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Convex actions with credentials injected server-side.

Where do Convex credentials live?

In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Convex integration

Convex integration for AI agents.

Convex integration for AI agents with secure authentication and server-side credential injection. Open Connector runs the OAuth, seals the token in an encrypted vault, and serves Convex tools to your agent over MCP or a typed API — credentials injected server-side, every call audited, nothing leaving your infrastructure. Open source (AGPL-3.0) and self-hostable.

View source on GitHub All integrations →

What your agents can do

Real Convex actions, managed and audited.

Your user connects Convex once; your agent can then the reactive backend platform that keeps up with you and your agents. Database, functions, workflow, sync, search, file storage, and more. All TypeScript, zero glue — scoped to the OAuth permissions you grant and the tool allowlist you configure. Every action is least-privilege and written to a tamper-evident audit trail.

1
Your user grants Convex access once (OAuth) — the token lands in the vault.
2
Your agent calls a tool over MCP or the typed API; Open Connector injects the credential server-side.
3
Every routed call appends a hash-chained audit record — nothing leaves your infra.

Tools & triggers

Supported Convex tools.

47 tools are generated from the published Convex catalog. Descriptions are plain text; each action remains subject to its configured authentication and tool allowlist.

Showing 47 tools. All published catalog entries are included in this page's server-rendered HTML.

Cancel a pending team invitation: Cancel a pending team invitation; Teams
Create custom domain: Create custom domain; Custom Domains
Create a custom role: Creates a new custom role for the team with the specified name, description, and permission statements.; Custom Roles
Create deploy key: Create a deploy key like "dev:happy-animal-123|ey..." which can be used with the Convex CLI to develop against or deploy code. When access to the deployment is granted through an OAuth token this deploy key will use the same OAuth-granted token. When access to the deployment is granted any other way a new token will be created which grants access only to this deployment.; Deploy Keys
Create deployment: Create a new deployment for a project.; Deployments
Create personal access token: Creates a new personal access token for the authenticated user.; Access Tokens
Create preview deploy key: Create a preview deploy key like "preview:team-slug:project-slug|ey..." which can be used with the Convex CLI to create and manage preview deployments within the project. When access to the project is granted through an OAuth token this preview deploy key will use the same OAuth-granted token. When access to the project is granted any other way a new token scoped to preview deployments in this project will be created.; Deploy Keys
Create project: Create a new project on a team, optionally provisioning a dev or prod deployment.; Projects
Create a team: Create a team; Teams
Create a team access token: Create a team access token; Access Tokens
Delete custom domain: Remove a custom domain from a deployment.; Custom Domains
Delete a custom role: Deletes a custom role from the team. Fails with `CustomRoleInUse` if the role is still attached to any team members; reassign those members (e.g. via `update_team_member_role`) before retrying.; Custom Roles
Delete deploy key: Deletes a deploy key for the specified deployment. The `id` in the request body can be the full deploy key (with prefix), encoded token, or the name of the deploy key.; Deploy Keys
Delete deployment: Delete a deployment. This will delete all data and files in the deployment, so we recommend creating and downloading a backup before calling this endpoint. This does not delete the project itself.; Deployments
Delete personal access token: Deletes a personal access token for the authenticated user. The `id` in the request body can be the encoded token secret or the name of the token.; Access Tokens
Delete preview deploy key: Deletes a preview deploy key for the specified project. The `id` in the request body can be the full preview deploy key (with prefix), encoded token, or the name of the preview deploy key.; Deploy Keys
Delete project: Delete a project. Deletes all deployments in the project as well.; Projects
Delete a team access token: Deletes a team access token, identified by its secret value or name.; Access Tokens
Get deployment in project by id: Get a deployment within a project by reference, default production deployment, or default dev deployment for the calling user.; Deployments
Get deployment in project by slug: Get a deployment within a project identified by team and project slug, by reference, default production deployment, or default dev deployment for the calling user.; Deployments
Get project by ID: Get a project by its ID.; Projects
Get project by slug: Get a project by its slug.; Projects
Get token details: Returns the team ID for team tokens. Especially useful after receiving a team token from an OAuth flow since most endpoints require team ID.; Access Tokens
Invite a team member: Invite a member to the given team by email. `role` is required and must be one of `admin`, `developer`, or `custom`. Pass `custom` together with a non-empty `customRoles` list to invite a member into a custom role; for `admin` and `developer`, `customRoles` must be omitted.; Teams
List audit log events: List a team's audit log events within a time range, with optional filters.; Teams
List custom domains: Get all custom domains configured for a deployment.; Custom Domains
List custom roles: Lists all custom roles for the team with cursor-based pagination.; Custom Roles
List default environment variables: Lists all default environment variables for the specified project, with optional filtering by name and deployment type.; Environment Variables
List deploy keys: Lists all deploy keys for the specified deployment.; Deploy Keys
List deployment classes: Lists the available deployment classes for a team.; Deployments
List deployment regions: Lists the available deployment regions for a team.; Deployments
List deployments: List deployments for a projects.; Deployments
List deployments for team: Lists deployments for a team with pagination, sorting, and filtering.; Deployments
List local deployments: Lists the local deployments for a team.; Deployments
List pending team invitations: List the pending invitations for the given team.; Teams
List personal access tokens: Lists all personal access tokens for the authenticated user.; Access Tokens
List preview deploy keys: Lists all preview deploy keys for the specified project.; Deploy Keys
List projects: List a page of projects for a team, ordered by descending project ID. Pass `limit` to set the page size and the `nextCursor` from the previous response as `cursor` to fetch the next page.; Projects
List team access tokens: Lists the team access tokens created by the authenticated member for the given team.; Access Tokens
List team members: List the members of the given team.; Teams
Get deployment: Get details about a cloud deployment.; Deployments
Transfer deployment: Transfer a deployment from its current project to another project within the same team. For production deployments, the caller must be a project admin on both the source and destination projects. For other deployment types, any team member can transfer deployments they created, or project admins can transfer any deployment.; Deployments
Update a custom role: Updates an existing custom role's name, description, and permission statements.; Custom Roles
Update default environment variables: Creates, updates, or deletes default environment variables for the specified project. When `value` is a string, the variable is upserted. When `value` is null, the variable is deleted.; Environment Variables
Update deployment: Updates properties of an existing deployment. Only the fields provided in the request body are modified; omitted fields are left unchanged.; Deployments
Update project: Update a project's name and/or slug. Returns the updated project.; Projects
Update a team member's role: Sets either the member's built-in `role` (admin/developer) or their `customRoles`. The two fields are mutually exclusive: setting `role` clears `customRoles`, and setting `customRoles` (must be non-empty) puts the member in the `custom` role.; Teams

FAQ

Convex integration, answered

How do AI agents use Convex through Open Connector?: Your user connects Convex once with one of its cataloged authentication methods. Open Connector stores the credential in an encrypted vault and exposes Convex tools to your agent over MCP or a typed API, with credentials injected server-side on each call.
Is this a Convex MCP server?: Yes. Open Connector can serve Convex as a named MCP server with a scoped allowlist and a per-user connection URL, so any MCP client can call Convex actions with credentials injected server-side.
Where do Convex credentials live?: In your own infrastructure. Open Connector keeps credentials in its own vault and injects them at call time, so they never leave your environment.

Give your agents Convex — keep the keys.

Open source, self-hostable, with Convex credentials that never leave your infrastructure. Run it from source today.

View source on GitHub How the MCP gateway works →