How SHAI connects to it
This one is a remote MCP server the vendor runs, and SHAI signs in to it the way the MCP specification says to: you click Connect, the vendor's own consent screen opens, and what comes back is a grant SHAI seals for this workspace alone. SHAI never sees your password, the grant is refreshed before it expires, and revoking it at the vendor's end switches it off here. A run reaches its tools through the same bridge and the same approval ladder as everything else.
What it needs
one click here, then your own sign-in at the vendor
One click on /connections, then your own sign-in at the vendor. SHAI holds the grant, never your password, and you can revoke it at the vendor at any time.