Infrastructure

Connect your CI/CD, cloud, and dev infrastructure to give the agent access to external services.

Infrastructure integrations give the agent access to your existing tools and services via MCP (Model Context Protocol). Connect cloud providers, databases, project management, monitoring, and more — so the agent can read issues, query databases, check deployments, and investigate errors as part of its workflow.

Pre-Configured Services

Connect any of these services from the agent settings page. Click Browse MCPs to see the full list.

OAuth

These services authenticate through an OAuth flow. Click Connect, then run the provided CLI command to complete authorization.

Credentials

These services connect with API keys or tokens entered directly in the dashboard.

Credentials are encrypted at rest using AES-256-GCM. They are only decrypted when passed to the agent during a session.

Connecting a Service

OAuth Services

1. Go to the Agent page and click Browse MCPs
2. Select the service you want to connect
3. Copy the CLI command shown in the modal:

   paragon mcp-auth linear --url https://mcp.linear.app/sse

4. Run it in your terminal — this opens the OAuth flow in your browser
5. After authorizing, paste the token back into the dashboard modal
6. The service appears as Connected with a checkmark

Credential Services

1. Go to the Agent page and click Browse MCPs
2. Select the service
3. Enter the required credentials (API keys, tokens, connection strings)
4. Click Save

Custom MCP Servers

Connect any MCP-compatible service that isn't in the pre-configured list.

1. Click Browse MCPs > Custom MCP
2. Enter a name for the server
3. Choose a protocol:
   • stdio — Local process communication (command + args)
   • HTTP — HTTP-based MCP endpoint
   • SSE — Server-Sent Events transport
4. Configure the server URL or command
5. Add any required environment variables or headers
6. Click Save

Example: Custom stdio Server

{
  "command": "npx",
  "args": ["-y", "@your-org/mcp-server"],
  "env": {
    "API_KEY": "your-api-key"
  }
}

Managing Connections

Connected services show a checkmark in the Browse MCPs panel. To disconnect a service, click on it and remove the configuration.

Your MCP configuration applies to all your agent sessions and automations. Each team member manages their own connections independently.

Agent Environments

Each repository can have one or more environments that configure how the agent sets up and runs your project. Environments are managed from the Agent Settings page.

Environment Variables

Add environment variables the agent needs to build and test your project (API keys, database URLs, feature flags, etc.). Variables are stored encrypted at rest using AES-256-GCM and only decrypted when injected into the agent's sandbox during a session.

You can add variables manually as key/value pairs, or sync them from an external secrets manager.

Secret Providers

Instead of manually entering environment variables, you can sync them from an external secrets manager. Provider secrets are fetched at session start and merged with any manual variables (manual variables take precedence on key conflicts).

Doppler

Sync secrets from a Doppler project config:

Infisical

Sync secrets from an Infisical workspace:

Update Script

A shell script that runs when the agent sets up your project in the sandbox. Use it for steps that go beyond environment variables — installing dependencies, running migrations, seeding databases, or starting background services.

npm install
npx prisma migrate deploy
npm run seed

Project Commands

Define the standard commands for your project so the agent knows how to build, test, and run it:

Each command can optionally include a port number (for dev servers) and a description.

Auth State

For browser-based testing, you can upload a Playwright storageState JSON file that contains cookies and local storage data. The agent uses this to start browser sessions already authenticated, skipping login flows during E2E testing.

Next Steps