Skip to main content
An app is a ready-made integration. Installing one on an agent gives it that service tools, plus a skill explaining how to use them, plus wherever the credentials live. That skill belongs to the app: it is read only, in the app as much as for the agent and the API. See Skills. Apps are installed per agent, not per Box and not per workspace. Two agents sitting side by side can each have their own Gmail connection.

​
Install one

Open the Apps tab, search the library, and click the app. Rerun tells you what it needs before you commit.

​
How an app authenticates

A service can offer several ways to connect, and you pick one at install time.

​
Statuses

Every app on an agent shows one of three states:

active

Connected. Its tools are available to the agent.

needs_auth

Waiting for you to sign in.

needs_config

Waiting for a credential, or for you to pick between several ways to connect.
An agent with an app in needs_auth or needs_config will tell you so rather than silently failing.

​
Where credentials live

Credentials go to your machine and stay there. Rerun’s database keeps only a reference to the variable name, never the value. That holds everywhere:
  • The API accepts no secret at all.
  • When an agent needs a key, it opens a masked form. The value never enters the conversation, and the agent only learns which variable name was filled.
  • Capturing an agent into a template ships the variable names, never the values.
Never paste an API key, a password or a token into the chat. The conversation is stored and sent to the model. If an agent ever asks you to, refuse and use the masked form instead.

​
Missing an app

Two ways forward. Ask for it. The Apps tab has a request form. Requests go to the Rerun team and the library grows from them. Add the MCP server yourself. Switch on expert mode, open the MCP tab, and register any Model Context Protocol server: HTTP, SSE or a local command, with its own headers, OAuth or environment variables. Anything with an MCP server works with Rerun today, app or not. Reference a stored secret in an MCP config with ${VARIABLE_NAME}. It resolves on your machine at run time.