Integrations

# Connect the systems you already use.

Maplith reads your systems to build the map, and keeps the map, not your rows. Connect each system the way that suits it: an app, an MCP server you already run, Maplith Bridge in your own network, the AI assistant you already use, or the exports your systems already produce. Every connection says what it reads, and you can switch it off.

[Build your first map](https://app.maplith.com/login) · [The GitHub integration](https://maplith.com/docs/github)

Ways to connect today

**GitHub**

Available

**Intercom**

Rolling out

**Metricool**

Rolling out

**Triple Whale**

On the roadmap

**MCP servers you already run**

Available

**Maplith Bridge**

Available

**Your own AI assistant**

Available

**Export files**

Available

**GitHub: typed signals from your repositories**

Available

**One-click integrations**

On the roadmap

The rules

## Read, built, deleted. The map stays.

### Read for the build

Files and resources are read for a scan and deleted again when it is done, successful or not. What Maplith keeps is the map: metadata about your data, which may quote example values and evidence.

### Read-only where it reads

Maplith’s own client lists and reads, and never writes. The one integration that writes is the GitHub app, and only where your policy lets its agent comment or propose a change.

### Yours to switch off

An admin removes any connection under Data sources › Systems in one click, and its token is deleted with it. Tokens are sealed when you add them and never shown again.

Available

## Connect today.

### GitHub

Available

Two GitHub apps: Maplith Agents today, for issues and pull requests in the repositories you choose and a hosted agent that answers under your policy; and a read-only Maplith app, being published as the default, for teams that want the signals and no agent that writes.

**What it reads.** Deliveries for issues, issue comments and pull requests in the repositories you grant the app: the issue or pull request, its title and text, the label or comment, and who sent it. They are kept for 12 months. The map is not built from your code.

**How it connects.** Install the Maplith Agents GitHub app from Data sources › Systems in your workspace. Once the read-only Maplith app is published, Connect GitHub installs it instead, and an admin chooses Allow agents to act to add Maplith Agents beside it. Maplith binds an installation to one workspace only after three checks: the request came from your workspace, you are an admin or builder there, and you own or administer the GitHub account or organisation.

**Access, and why.** You choose all repositories or a selected list at install. For Maplith Agents, issues, pull requests and contents are read and write, so the hosted agent can comment and open a proposal pull request; it never merges. The read-only Maplith app asks for read access only and cannot change anything in GitHub. Both lists, with the reason for each, are below.

**Signals.** A label your policy acts on (`agent-fix`, `agent-pr`) is work: it opens an `external` signal for an agent. A comment, any other label and a pull request opened or closed are news: kept with the delivery, never a signal.

**Switching it off.** An admin presses Disconnect under Data sources › Systems: Maplith uninstalls the app at GitHub and removes the binding, one app at a time. Uninstalling at GitHub does the same; Maplith removes the binding when GitHub says so.

[The GitHub integration](https://maplith.com/docs/github)

### MCP servers you already run

Available

A vendor’s official MCP server, or one your IT runs, read on your schedule.

**What it reads.** The resources the server lists, read for a scan and deleted again when the scan is done, successful or not. What Maplith keeps is the map. The generic client lists and reads resources; the Intercom and Metricool integrations also call a fixed set of read-only tools. None writes to your systems.

**How it connects.** An admin or builder adds the server’s address and, if it needs one, a bearer token under Data sources › Systems. The token is typed by a person, never pasted into a chat or handed to an agent.

**Access, and why.** Whatever the token grants, so give it read-only access to what the map should cover. The token is sealed with AES-256-GCM, its key held outside the database, and is never shown again. Addresses that resolve to a private network are refused.

**Signals.** Maplith checks each connection about every 12 hours. `link_dead` when it stops answering, with the steps to repair it, cleared when it answers again. `structure_changed` when it offers at least a quarter more or fewer resources than before. Each scan raises the map’s own signals, such as `process_deviation`; an approved fix raises `fix_approved`.

**Switching it off.** An admin presses Remove under Data sources › Systems, which deletes the token. Revoke it in the source system too.

[Connect a system instead of uploading](https://maplith.com/docs/getting-started#connectors-instead-of-uploads)

### Maplith Bridge

Available

Open source, Apache 2.0: serve a folder of exports or a PostgreSQL database from your own network.

**What it reads.** The files in one folder you choose: CSV, TSV, JSON, JSONL, Markdown and plain text, never hidden files. For PostgreSQL, the Bridge’s extractor reads the catalog and the tables you grant and writes one CSV per table into that folder.

**How it connects.** You run the Bridge, a small server on Node.js, next to your data, installed from npm as part of the package `maplith` or from the signed release. Maplith connects to it as an MCP server, with a token you create.

**Access, and why.** Read-only, one folder, a token on every request. The extractor refuses to run under a database role that can write. Maplith never holds a database password.

**Signals.** The same as any MCP server: `link_dead`, `structure_changed` and the signals each scan raises.

**Switching it off.** Stop the Bridge, or replace its token: a running Bridge refuses the old one. Then remove the connection under Data sources › Systems.

[Serve your data from your own network](https://maplith.com/docs/mcp-template)

### Your own AI assistant

Available

The assistant you already use fetches the data with the access you already gave it.

**What it reads.** The files your assistant sends with your approval, read for the build and deleted again afterwards, as with an upload. Maplith holds no credential to the system they came from.

**How it connects.** Connect your assistant to Maplith over MCP, by signing in or with an agent key. With your approval it fetches each system with the access it already has there, then sends the files to build the map.

**Access, and why.** An agent key sees only the part of the map you scope it to, and can send files only when you allow it to upload. Each system guide below names the read-only access to choose in that system.

**Signals.** Each scan raises the map’s own signals. Your assistant reads them with `list_signals` and `get_task_context`.

**Switching it off.** Revoke the agent key under Agents & access › Connections, or disconnect Maplith in your assistant.

[Connect your own agent](https://maplith.com/docs/own-agent)

### Export files

Available

The fallback that always works: the exports your systems already produce.

**What it reads.** CSV, Excel, PDF with a text layer, JSON and JSONL, mailbox archives, Slack exports, meeting transcripts and Markdown, unpacked from .zip or .gz. Read for the build and deleted from storage when it is done, successful or not.

**How it connects.** Upload a folder per system in Data sources › Scans. Up to 300 files and 1 GB per upload; a large CSV is sent in parts.

**Access, and why.** None. Maplith sees exactly the files you choose and holds no credential. Leave out what must not be processed.

**Signals.** Each scan raises the map’s own signals, such as `process_deviation`, and an approved fix raises `fix_approved`.

**Switching it off.** Nothing stays connected: the files are gone once the build is done, and the map stays with your workspace.

[Getting started](https://maplith.com/docs/getting-started)

### GitHub: typed signals from your repositories

Available

A failed workflow run, a failed deployment or a new security alert in your repositories, raised as its own kind of signal the moment GitHub reports it, and cleared when GitHub reports it fixed.

**What it reads.** What GitHub reports for the event: the alert’s number, rule or package and severity, never the secret itself; the workflow run or deployment and its status. For a run or a deployment, Maplith reads that workflow’s or environment’s newest runs from GitHub before it decides, because runs finish out of order. Never your code.

**How it connects.** Maplith Agents today, and the read-only Maplith app once it is published. GitHub sends these events once your installation holds the read permissions below: when the app asks for them, an owner of your installation accepts them at GitHub. Raised from what GitHub sends; Maplith does not poll your repositories for them.

**Access, and why.** Read-only: Actions, Deployments, Code scanning alerts and Dependabot alerts, beside the Secret scanning alerts the app already holds.

**Signals.** `security_alert` for a secret-scanning, code-scanning or Dependabot alert, one per alert. `ci_failed` when a workflow fails on the default branch, cleared by its next green run. `deploy_failed` when the newest deployment of an environment fails, cleared once the newest one is live.

**Switching it off.** Disconnect under Data sources › Systems, or uninstall the app at GitHub, as today.

Rollout

## Opening to more workspaces.

### Intercom

Rolling out

Conversations, contacts and companies, read through Intercom’s own MCP tools; rolling out to customer workspaces.

**What it reads.** A fixed set of read-only tools, used for the build. What Maplith keeps is the map, not a copy of your conversation history.

**How it connects.** When offered in your workspace, an admin or builder connects Intercom under Data sources › Systems and approves the read access in Intercom.

**Access, and why.** Read-only access to the conversations, contacts and companies covered by the connection. Maplith does not send messages or change tickets.

**Signals.** The map’s scan signals, plus support-case signals where vendor events are connected; Maplith records a close performed by your team in Intercom.

**Switching it off.** An admin disconnects Intercom under Data sources › Systems and can revoke the access in Intercom too.

[Connect a system](https://maplith.com/docs/getting-started#connectors-instead-of-uploads)

### Metricool

Rolling out

Brands, connected channels, scheduled posts and metric totals by period, read through Metricool’s hosted MCP server; rolling out to customer workspaces.

**What it reads.** A fixed set of read-only tools reads brand settings, the next 90 days of scheduled posts, the metric catalogue and metric totals by period for the last 90 days. What Maplith keeps is the map, and the totals of any metric you choose to track. Your Metricool plan decides what Metricool returns, and the scan names anything your plan does not include.

**How it connects.** When offered in your workspace, an admin or builder connects Metricool under Data sources › Systems, signs in to Metricool and approves read access there.

**Access, and why.** Metricool’s read scope only. Maplith never schedules, changes or deletes a post, and never asks for Metricool’s write scope.

**Signals.** The map’s scan signals, and `link_dead` when Metricool stops granting the access, with the steps to reconnect.

**Switching it off.** An admin removes Metricool under Data sources › Systems, which deletes Maplith’s copy of the access; revoke Maplith’s access in your Metricool account too.

[Connect a system](https://maplith.com/docs/getting-started#connectors-instead-of-uploads)

GitHub

## What the Maplith Agents app asks for, and why.

GitHub grants an app access per repository, never per folder, so choose which repositories at install. The hosted agent acts only in private repositories and only under the policy an admin sets; by default it observes and never acts.

| Permission | Access | Why |
| --- | --- | --- |
| Issues | write | Receive issue events, and post the hosted agent’s one analysis comment on an issue labelled `agent-fix`. |
| Pull requests | write | Open a proposal pull request when your policy allows it. In your repositories the app never merges. |
| Contents | write | Commit the proposal: one Markdown file under `docs/agent-proposals/` on a branch of its own, never on your default branch. |
| Metadata | read | Required by GitHub for every app: repository names, and whether a repository is private. The agent acts only in private ones. |
| Members (organisation) | read | Check, when you connect, that you own or administer the organisation you are connecting. |
| Secret scanning alerts | read | Today read only on Maplith’s own repositories, which run on the same app; Maplith does not read yours. It will feed the `security_alert` signal on the roadmap below. |

Events GitHub sends the app: Issues, Issue comment, Pull request. Every delivery is checked against its signature before anything else happens, and is kept only for the workspace its installation is bound to. Read [the GitHub integration](https://maplith.com/docs/github) for the details.

GitHub

## The read-only Maplith app, and why it asks for each read.

Being published as the default GitHub connection: it can change nothing in GitHub and does not read your code. Maplith Agents stays the separate choice for letting agents act.

| Permission | Access | Why |
| --- | --- | --- |
| Metadata | read | Required by GitHub for every app: repository names, and whether a repository is private. |
| Issues | read | Receive issue and issue comment events, which become `external` signals. |
| Pull requests | read | Receive pull request events, which become `external` signals. |
| Actions | read | Receive workflow runs and read a workflow’s newest runs, for `ci_failed`. |
| Deployments | read | Receive deployment statuses and read an environment’s newest deployment, for `deploy_failed`. |
| Secret scanning alerts | read | Receive secret-scanning alerts, for `security_alert`. Never the secret itself. |
| Code scanning alerts | read | Receive code-scanning alerts, for `security_alert`. |
| Dependabot alerts | read | Receive Dependabot alerts, for `security_alert`. |
| Members (organisation) | read | Check, when you connect, that you own or administer the organisation you are connecting. |

System guides

## Which path fits each system.

For the systems below, Maplith publishes a guide your AI assistant reads: the best path, whether the vendor runs an official MCP server, the datasets that make a good map, the read-only access to choose and the export steps that always work.

| System | Kind | Official MCP server | Recommended path | Guide |
| --- | --- | --- | --- | --- |
| [Shopify](https://maplith.com/integrations/shopify) | Web shop | None confirmed | Your agent fetches it | [Guide](https://maplith.com/docs/systems/shopify) |
| [WooCommerce](https://maplith.com/integrations/woocommerce) | Web shop | Yes, for your own agent; Maplith cannot read it | Export files | [Guide](https://maplith.com/docs/systems/woocommerce) |
| [e-conomic](https://maplith.com/integrations/e-conomic) | Accounting | None confirmed | Export files | [Guide](https://maplith.com/docs/systems/e-conomic) |
| Dinero | Accounting | Yes, for your own agent; Maplith cannot read it | Your agent fetches it | [Guide](https://maplith.com/docs/systems/dinero) |
| Billy | Accounting | None confirmed | Export files | [Guide](https://maplith.com/docs/systems/billy) |
| HubSpot | CRM | Yes, for your own agent; Maplith cannot read it | Your agent fetches it | [Guide](https://maplith.com/docs/systems/hubspot) |
| Pipedrive | CRM | Yes, for your own agent; Maplith cannot read it | Export files | [Guide](https://maplith.com/docs/systems/pipedrive) |
| [Intercom](https://maplith.com/integrations/intercom) | Helpdesk | Yes; Maplith reads it through its own integration | Your agent fetches it | [Guide](https://maplith.com/docs/systems/intercom) |
| Zendesk | Helpdesk | None confirmed | Export files | [Guide](https://maplith.com/docs/systems/zendesk) |
| [Stripe](https://maplith.com/integrations/stripe) | Payments | Yes; Maplith reads it through its own integration | Your agent fetches it | [Guide](https://maplith.com/docs/systems/stripe) |
| Meta Ads | Ads | Yes, for your own agent; Maplith cannot read it | Export files | [Guide](https://maplith.com/docs/systems/meta-ads) |
| Google Sheets | Spreadsheet | Yes, for your own agent; Maplith cannot read it | Your agent fetches it | [Guide](https://maplith.com/docs/systems/google-sheets) |
| [Recharge](https://maplith.com/integrations/recharge) | Recurring orders | Yes, for your own agent; Maplith cannot read it | Export files | [Guide](https://maplith.com/docs/systems/recharge) |
| Slack | Communication | Yes, for your own agent; Maplith cannot read it | Your agent fetches it | [Guide](https://maplith.com/docs/systems/slack) |
| GitHub | Software development | Yes, for your own agent; Maplith cannot read it | Your agent fetches it | [Guide](https://maplith.com/docs/systems/github) |
| Cloudflare | DNS | None confirmed | Maplith's own integration reads it | [Guide](https://maplith.com/docs/systems/cloudflare) |
| Google Workspace | Communication | None confirmed | Your agent fetches it | [Guide](https://maplith.com/docs/systems/google-workspace) |
| Metricool | Social media planning and analytics | Yes; Maplith reads it through its own integration | Your agent fetches it | [Guide](https://maplith.com/docs/systems/metricool) |
| Triple Whale | Ads | Yes, for your own agent; Maplith cannot read it | Export files | [Guide](https://maplith.com/docs/md/systems/triplewhale) |

A system with no guide still works: upload its exports, or let your assistant read the vendor’s documentation and ask us for a guide. All guides in one list: [System guides](https://maplith.com/docs/systems).

On the roadmap

## Coming next.

### Triple Whale

On the roadmap

Marketing totals by period and channel; connection verification is in progress.

**What it reads.** The first connection lists available tools for review. No account data is read until the aggregate read plan is verified.

**How it connects.** Customer connections are off by default. When available, connect with the hosted MCP URL and an MCP Read API key under Data sources › Systems.

**Access, and why.** The intended read plan covers period and channel totals, never individual orders or customer records.

**Signals.** Connection checks report access failures without reading account content.

**Switching it off.** Remove the connection under Data sources › Systems and revoke its API key in Triple Whale.

[Triple Whale connection](https://maplith.com/docs/md/systems/triplewhale)

### One-click integrations

On the roadmap

Sign in with the vendor and choose read-only access, for systems that offer no MCP server of their own.

**What it reads.** The same as any connection: what the read-only access covers, read for a scan and deleted again.

**How it connects.** Sign in with the vendor from Data sources › Systems and approve read-only access. Built first for the systems customers ask for.

**Access, and why.** Read-only scopes only, named before you approve them.

**Signals.** The same as an MCP server: `link_dead`, `structure_changed` and the signals each scan raises.

**Switching it off.** Remove it under Data sources › Systems, or revoke Maplith’s access at the vendor.

| Kind | On the roadmap |
| --- | --- |
| Payments and accounting | Dinero |
| Marketing | Web analytics and LinkedIn |
| Operations | Railway and Resend |

Until Maplith reads them itself, read these systems through an MCP server, your own AI assistant or their exports. Missing a system? Write to [support@maplith.com](mailto:support@maplith.com).

Read by Maplith itself and switched on workspace by workspace: Stripe, Slack, GitHub and Google Workspace.

Read by Maplith itself, built and opening to every workspace once released: Intercom and Metricool.

## Start with the systems you have.

[Build your first map](https://app.maplith.com/login) · [Read about security](https://maplith.com/security)