Secure Windsor.ai access for AI agents
Marketing, ad, analytics, and CRM data from 350+ sources, plus write actions, via Windsor.ai's official MCP server
Windsor.ai lets your agents query the marketing and business data your team has already connected to Windsor.ai. That covers advertising platforms such as Meta Ads, Google Ads, and TikTok Ads, analytics such as Google Analytics 4, CRM and e-commerce such as HubSpot and Shopify, and warehouses such as BigQuery and Snowflake. Agents can also run write actions on those platforms and schedule exports to a destination. Every call runs through your policies and is logged for audit.
Server URL: https://mcp.windsor.ai
Windsor.ai installs with write access
Windsor.ai installs with permission to write, not only to read. Through
execute_action, agents can change the connected platforms themselves, for
example pausing or enabling ad campaigns. Through create_destination_task,
they can schedule recurring data exports. Decide your policy before you let
people connect.
Credential modes
Windsor.ai supports per-org dynamic registration only, so there is no app to create on Windsor.ai's side and no client ID or secret to enter. See Credential modes for how it compares with Use SecureAuth's app and Bring your own app.
Before you begin
- A Windsor.ai account for each person who will connect.
- At least one data source already connected in that Windsor.ai account. Windsor.ai does not finish sign-in for an account with no data sources. See How users connect.
- Administrator access to your Agent Authority workspace.
- A decision on whether agents may write into the platforms behind Windsor.ai. See Policy examples.
- If Windsor.ai is already registered here as a custom MCP server, remove it first.
Both would claim the
windsorslug.
Setup
- In the Agent Authority console, go to Tools & Services and click Add Resource.
- Select Windsor.ai from the catalog.
- On Choose how to install Windsor.ai, click Per-org dynamic registration. Selecting it adds the resource right away, with its 19 tools pre-configured and no credentials to paste.
After you add the resource, an Admin setup required dialog appears. Its Setup guide button links to the section below.
Dynamic client registration
When you add the resource, the gateway registers its own OAuth client with Windsor.ai, the credential it uses to sign users in. Windsor.ai issues it automatically, so you configure nothing on the Windsor.ai side.
Your policies are not the only limit. An agent only reaches the data sources and accounts the user has connected in Windsor.ai, so it can never see more than that person can see in Windsor.ai itself.
How users connect
Access is per user. Each person links their own Windsor.ai account once:
- In Windsor.ai, connect at least one data source, such as Google Sheets or Google Analytics 4, and add an account for it. Do this first, outside the sign-in flow.
- In Agent Authority, open the Windsor.ai resource and click Connect.
- Approve Application Access Request, then sign in to Windsor.ai if asked.
- Windsor.ai shows the accounts it will share. Click Finish.
- Windsor.ai returns you to Agent Authority, and the connection shows Connected.
Do not pick a data source during sign-in
If the Windsor.ai account has no data sources, step 4 shows Windsor.ai's data-source picker instead of Finish. It looks like the normal dashboard. Clicking a source there leaves the sign-in, and you land on the Windsor.ai dashboard instead of back in Agent Authority. Connect a source in Windsor.ai first, then click Connect again.
Step 4 also shows a Write actions toggle. It is on by default and lets agents make changes in the user's connected platforms. Turning it off there is a per-user safeguard, but use policies to enforce it for everyone.
Go to Connections to manage linked accounts.
Verify the connection
The gateway syncs the Windsor.ai tools automatically. To check the connection end to end, ask your agent to run a request:
List my connected Windsor.ai data sourcesIf the connectors and accounts you added in Windsor.ai come back, the connection is working. If a call is refused, see Troubleshooting.
Available tools
19 tools: 14 read and 5 write.
get_connectors is the usual starting point; get_fields then get_data read a connector's data.
| Tool | Tags | Description |
|---|---|---|
get_connectors | read-only | List connected sources with their accounts, actions, and options |
get_fields | read-only | Discover valid field IDs for a connector |
get_options | read-only | Get fields, date-filter columns, and options for a connector |
get_data | read-only | Retrieve data from a connector |
get_custom_fields | read-only | List custom (formula) fields across connectors |
list_actions | read-only | List a connector's write actions with their parameter schemas |
get_destinations | read-only | List destinations that can receive scheduled exports |
get_destination_setup_info | read-only | Describe how to set up a scheduled export to a destination |
get_destination_tasks | read-only | List the scheduled export tasks the user has created |
get_connector_authorization_url | read-only | Get the URL to connect or authorize a connector |
get_connector_connect_info | read-only | Describe how the user can grant access to a connector |
get_current_user | read-only | Get the user's username, email, and plan |
get_windsor_login_url | read-only | Get a URL into the Windsor.ai dashboard |
get_subscription_url | read-only | Get a link to the Windsor.ai pricing page |
contact_windsor | write | Send feedback, a support request, or a feature request |
create_custom_field | write | Create a custom (formula) field on a connector |
upload_files | write | Upload local files to a connector action |
execute_action | destructive | Run a write action on a connected platform account |
create_destination_task | destructive | Create a scheduled export of connector data to a destination |
All tools except get_current_user, get_windsor_login_url, and get_subscription_url are also tagged external, because they reach platforms outside Windsor.ai.
Required scopes
The gateway requests these automatically, so there is nothing for you to configure.
create– read data and run create and write operations through Windsor.aidelete– run delete operations through Windsor.aioffline_access– refresh a user's access token without a new sign-in
Policy examples
Every org starts with an Allow all rule at the bottom of the policy list. Because of it, a resource you just added is reachable as soon as someone connects, write tools included. Rules are read from the top, and the first one that matches wins. Adding more allow rules changes nothing, so each example below works by adding a deny above that Allow all rule.
- Read-only reporting.
Deny
execute_action,create_destination_task,create_custom_field,upload_files, andcontact_windsor. Everyget_*andlist_*tool keeps working. - No changes to ad platforms.
Deny
execute_actionandupload_files. Agents can still read data and schedule exports. - No data leaving Windsor.ai.
Deny
create_destination_task, so agents cannot set up recurring exports to other systems.
Next steps
- Create a policy – start from the read-only pattern in Policy examples above.
- Policies – how first-match-wins rule order and the seeded Allow all rule interact.