What Is Corsair? A Complete Guide to the Integration Platform for Apps and AI Agents

Building an app or AI agent is one thing. Connecting it to all the tools people actually use is another.

Gmail, Slack, HubSpot, GitHub, Notion, Stripe, and hundreds of other services each come with their own APIs, authentication, permissions, and integration requirements. Corsair brings those connections into one open-source integration layer, giving developers a simpler way to connect apps and AI agents to real-world tools.

But what exactly is Corsair, and where does it fit in a modern application stack?

This guide explores the Corsair platform from end to end: what Corsair is and does, the apps, APIs, tools, and MCP integrations it supports, how the platform works, who it is built for, its pricing and plans, and what developers can build with it across real-world teams and industries.

What Is Corsair?

Corsair is an open-source integration layer for apps and AI agents. It connects to 200+ third-party services—things like Slack, Gmail, GitHub, Google Calendar, Notion, HubSpot, Stripe, and Airtable—through one consistent, typed syntax instead of a different SDK and auth flow for every provider.

Rather than asking a team to hand-build OAuth screens, token refresh logic, and rate-limit handling for each app it needs to reach, Corsair takes on that repetitive plumbing so developers can focus on the part of the integration that is actually specific to their product.

The project is Y Combinator backed and released under the Apache 2.0 license, so the full SDK, including its permission system and multi-tenant credential storage, can be self-hosted for free. A hosted version, Corsair Hub, is also available for teams that would rather not run that infrastructure themselves.

Either way, Corsair positions itself as a genuine AI agent integration platform rather than a thin wrapper around a single protocol, which is why it works equally well for an autonomous agent, a backend service, or a customer-facing dashboard.

What Does Corsair Do? From App Connections to Secure Tool Execution

At its core, Corsair does the unglamorous work that every integration needs and almost nobody wants to write twice. It manages OAuth and API key-based authentication for each connected service, encrypts stored credentials, and refreshes access tokens automatically before they expire.

It normalizes the very different auth flows, schemas, and error handling that every provider ships on its own terms into one predictable, typed interface.

It also keeps data current. Incoming updates arrive through webhooks and scheduled polling, landing in a local database partitioned per tenant, so a repeated read does not have to hit the third-party API and burn through a rate limit every single time.

Security is built into execution itself, not bolted on afterward. You can set a permission mode per integration, so a read-only lookup runs freely while a destructive or sensitive action—sending an email, deleting a record—requires explicit approval before it executes.

Credentials are resolved internally at the moment a call runs, which means an agent only ever sees the method it invoked and the result that came back, never a raw API key or token. That is what turns a list of AI agent tools into something you can actually put in front of real customers.

What Can You Connect With Corsair? Apps, APIs, Tools, and MCP

Corsair ships 200+ integrations as installable plugin packages, each covering a different category of work: communication tools like Slack and Discord, productivity apps like Notion, Google Calendar, and Google Sheets, CRM and sales tools like HubSpot, support platforms like Zendesk, payments through Stripe, operational data in Airtable, and analytics through PostHog, with new plugins added regularly.

Every plugin follows the same shape once installed: typed API calls, optional webhook support, and, where it makes sense, a locally synced database layer for that provider's data.

For AI agent tools specifically, Corsair supports MCP integrations directly, so any MCP-compatible agent, including Claude, can call these same plugins as tools without extra glue code.

It also ships adapters for popular agent frameworks, so teams already building on the Claude Agent SDK, OpenAI's Agents SDK, the Vercel AI SDK, or Mastra can wire Corsair in without switching stacks. Because the underlying layer is a REST API rather than an MCP-only implementation, the exact same integration also works from a plain backend route or a button in a customer dashboard, not only from inside an agent loop.

If a service you need is not covered yet, the open-source model means you are not stuck waiting on a roadmap. You can scaffold a new plugin, open a pull request, or fork the project and build exactly what you need, all covered in the Corsair documentation.

Key Features of Corsair

Corsair's value shows up most clearly once a product has more than one or two integrations to maintain. As a developer integration platform, it is built to keep that maintenance flat as you add more connections rather than letting it grow with every new app.

Here is what makes Corsair AI agent integrations dependable once a product is live, not just in a demo:

• Open-source core: The full SDK, including every plugin and the permission system, is released under Apache 2.0 on GitHub, so you can inspect, fork, or extend it rather than trust a closed black box.
• Self-host for free: Run Corsair on your own infrastructure at no cost, with no per-seat pricing and no markup on the API calls you are already paying for.
• Multi-tenant OAuth: Turn on multi-tenancy and every call is automatically scoped to the right tenant's credentials, built for products that serve many customers who each connect their own accounts.
• Permission modes by default: Assign a permission level per integration so sensitive or destructive actions pause for explicit approval instead of executing silently.
• Automatic token refresh and caching: Expiring tokens are renewed quietly in the background, and repeated reads come from a synced local database instead of hitting the third-party API every time.
• MCP-native, not MCP-only: A constant, small set of MCP tools covers setup, discovery, and execution no matter how many plugins are installed, keeping an agent's context lean as your integration list grows.
• Typed developer experience: Every call is a typed method with editor autocomplete, not a hand-assembled HTTP request.

How Corsair Works

Getting from zero to a working integration follows a short, repeatable pattern:

1. Install the packages you need. Add the core corsair package plus the plugin for each service, for example Slack or GitHub, through npm.
2. Configure one Corsair instance. Pass in your plugins, a database connection, and an encryption key that protects stored credentials at rest.
3. Call it directly, or hand it to an agent. Use it as a typed SDK in your own backend code, or expose it as an MCP server so an agent can call it as a tool.
4. Let the agent discover what is available. When Corsair acts as MCP for AI agents, it exposes four tools regardless of plugin count: one to check what is connected and request missing credentials, two to discover available operations and inspect their parameters, and one to actually run the call. That footprint stays the same whether five integrations are connected or two hundred.
5. Data stays fresh underneath. Webhooks and polling keep a tenant-partitioned database in sync, so reads are fast and writes still reach the live service immediately.

A minimal setup looks roughly like this:

import { createCorsair } from 'corsair';
import { slack } from '@corsair-dev/slack';
import { github } from '@corsair-dev/github';

export const corsair = createCorsair({
  plugins: [slack(), github()],
  database: db,
  kek: process.env.CORSAIR_KEK!,
});

From there, calls like corsair.slack.api.messages.post(...) or corsair.github.api.issues.create(...) behave like any other typed function in your codebase, with framework-specific guides available for Next.js, Node, Express, Hono, SvelteKit, Remix, and Astro.

Who Is Corsair For?

Corsair fits anywhere a product needs to reach outside its own walls reliably, but it tends to show up most in a few recurring situations:

• Teams building AI agents that need to act, not just answer. If an assistant is meant to actually send the email or update the ticket rather than describe what someone else should do, it needs the kind of AI agent infrastructure Corsair provides underneath it.
• SaaS companies offering their own customers a "connect your apps" experience. Multi-tenant OAuth and per-tenant credential isolation are built in, so you are not designing that system from scratch for every new integration you support.
• Internal tools and operations teams automating repetitive cross-app work such as sales call prep, order lookups, support triage, or team notifications.
• Solo developers and small teams prototyping on the free Hobby tier, scaling up to production teams on Pro, and enterprises with custom compliance or volume needs.
• Anyone maintaining hand-rolled integrations today who is tired of chasing token refreshes, provider deprecations, and schema changes across a dozen separate codebases.

What Can You Build With Corsair? Real-World Use Cases Across Teams and Industries

Because Corsair connects the same way whether it is called by an agent, a script, or a UI button, the use cases span far beyond a single team:

• Sales: An assistant that checks a rep's calendar, drafts and sends a meeting invite, and pulls together a short call brief from CRM notes before a call starts.
• Operations: Pulling every unshipped order out of Airtable or a spreadsheet, flagging exceptions, and keeping that view synced without a manual export each morning.
• Customer support: A helpdesk-connected agent that triages incoming tickets and drafts replies, with sensitive responses held for approval before they send.
• Engineering: Filing a GitHub issue, updating a Linear ticket, and posting a Slack summary automatically the moment a build fails.
• Cross-team visibility: Alerting a channel the instant a file lands in a shared drive or a deal changes stage, instead of relying on someone to notice.
• Product-led growth: A vertical SaaS company embedding its own "connect your tools" dashboard so customers can link Slack, HubSpot, or a calendar without the vendor building a bespoke integration for each request.

Across industries, the pattern repeats: wherever a team already relies on a handful of SaaS tools, there is a use case for letting an agent or a workflow reach into them safely.

Corsair for Developers: Typed Integrations, Authentication, Permissions, Triggers, and Real-Time Tool Calling

This is the section developers tend to care about most, so it is worth breaking down each piece:

• Typed integrations: Every plugin ships as a typed client, so your editor autocompletes available methods and parameters instead of you guessing at field names from someone else's API docs.
• Authentication: OAuth and API key flows are handled per plugin, credentials are encrypted with your own key, and in multi-tenant setups a call like corsair.withTenant(teamId) scopes everything to that tenant's credentials automatically, which is the backbone of doing API integrations for AI agents at scale.
• Permissions: Assign a permission mode per integration so low-risk reads run freely while destructive or sensitive actions pause for a human approval link before they execute.
• Triggers: Webhook hooks on incoming provider events let your product react the moment something changes—a new ticket, an upload, a status change—instead of polling on a fixed schedule.
• Real-time tool calling: Because reads come from a locally synced, per-tenant database and writes execute immediately against the live service, an agent can look something up and act on it inside a single reasoning step rather than waiting for the next scheduled sync.

Framework support extends beyond agents too. Adapters exist for the Claude Agent SDK, OpenAI's Agents SDK, the Vercel AI SDK, and Mastra, alongside standard web frameworks like Next.js, Node, Express, Hono, SvelteKit, Remix, and Astro, so Corsair fits into a stack you already have rather than requiring a rewrite.

Corsair Pricing: Plans, Features, and What You Get at Each Tier

Corsair pricing is built around how much of the integration layer you want Corsair to run for you, and no plan requires a credit card to start:

• Hobby — $0 per month: Built for small and side projects. Includes unlimited tool calls, up to 50 connections, 100,000 webhook events, unlimited managed permission and auth pages, up to 3 team members, a Corsair-branded consent screen, and community support through Discord.
• Pro — $200 per month: Built for teams running in production and currently the most popular plan. Includes unlimited tool calls, connections, webhooks, permission pages, and team members, a custom-branded consent screen, direct support through Slack, and custom integrations built by the Corsair team when you need one that does not exist yet.
• Enterprise — Custom pricing: Built for organizations with specific scale, compliance, or support requirements. Everything in Pro, with connections, webhooks, team size, branding, support, and custom integration work tailored to the account.

Because the core SDK is open source, self-hosting remains free at any scale for teams that would rather run Corsair on their own infrastructure than pay for the hosted option. Full details, including what counts toward each limit, are on the Corsair pricing page.

Corsair AI agent integrations exist to remove the part of building with AI that has nothing to do with your actual product: the OAuth screens, the token refresh jobs, and the permission checks that every team ends up writing anyway.

Whether you are shipping a single internal automation or a multi-tenant platform used by thousands of customers, the underlying problem is the same, and it has already been solved once, openly, so you do not have to solve it again from scratch.

The project is open source, self-hosting is free, and a hosted option is ready the moment you would rather not run that infrastructure yourself. Explore Corsair and connect your first integration in minutes.

Frequently Asked Questions

Is Corsair open source?

Yes. The core SDK and its plugins are released under the Apache 2.0 license, so you can self-host the entire platform, including the permission system and multi-tenant credential storage, on your own infrastructure at no cost. A hosted version, Corsair Hub, runs the same codebase if you would rather not manage that infrastructure yourself.

Does Corsair support MCP for AI agents?

Yes. Corsair exposes a small, constant set of MCP tools covering setup, discovery, schema inspection, and execution, no matter how many plugins are connected, so an agent's context does not grow just because more integrations are added. Adapters for popular agent frameworks are also available alongside raw MCP support.

Can I use Corsair without an AI agent?

Yes. Every integration is also a typed library you can call directly from your own backend, for example wiring a create-calendar-invite button or a scheduled sync-from-Airtable job. An AI agent is one way to use Corsair, not a requirement.

Does my agent ever see raw API keys or tokens?

No. Corsair resolves credentials internally at the moment a call executes, so an agent only ever sees the method it called and the result that came back, never the underlying token or key.

What Is the Difference Between Self-Hosting Corsair and Using Corsair Hub?

Self-hosting runs the full open-source SDK, including every plugin, the permission system, and multi-tenant storage, on your own infrastructure for free. Corsair Hub is the hosted version of that same codebase, managing OAuth callbacks, connect pages, and webhook infrastructure for you, which is useful if you would rather not run that part yourself.