Providers
The integration catalog — auth modes, capabilities, and trigger support.
Provider toolkits are reconciled once by the release step before the web service starts. Normal API reads and background-worker startup never rebuild the catalog. When a provider ships, the release step writes only changed tools, triggers, auth modes, and branding.
Exact catalog from provider-catalog.ts. Tool counts grow as operations are added; discover live
tools with STACKLINK_SEARCH_TOOLS or GET /v1/providers.
| Provider | Key | Category | Auth modes | Triggers |
|---|---|---|---|---|
| Stacklink (platform) | platform | custom | api_key | — |
| Sandbox | sandbox | compliance | api_key · portal_session · otp_session | webhook + polling |
| WhatsApp Business | whatsapp_business | communication | api_key · webhook_secret | webhook |
| Razorpay | razorpay | payment | api_key · webhook_secret | webhook + polling |
| Zoho Books | zoho_books | accounting | oauth2 | webhook + polling |
| Shopify | shopify | commerce | oauth2 | webhook + polling |
| Google Sheets | google_sheets | productivity | oauth2 | webhook + polling |
| Google Drive | google_drive | productivity | oauth2_full_drive · oauth2_file_limited | webhook + polling |
| Gmail | gmail | productivity | 7 granular modes (below) | webhook + polling |
| Google Docs | google_docs | productivity | oauth2 | — |
| Slack | slack | communication | oauth2 | webhook |
Capability highlights
- Sandbox — GST, KYC, TDS, income tax, bank virtual accounts. The reference executable provider; tools are generated from its OpenAPI specs at startup.
- Zoho Books — 40 capability modules (invoices, bills, contacts, banking, journals, fixed assets, …) from a generated manifest; financial writes are risk-classed and require explicit confirmation.
- Shopify — orders, products, inventory, customers, collections, bulk operations, and gated raw GraphQL.
- Gmail — granular auth modes so a session holds only the access it needs:
gmail.readonly,gmail.send,gmail.compose,gmail.modify,gmail.settings,gmail.contacts,gmail.full_access. - Google Drive —
oauth2_full_drivevsoauth2_file_limitedfor least-privilege file access.
Mercury staging preview
Mercury (mercury) uses Mercury's official MCP server. The staging candidate is
visible after contract and connection preflight; complete live acceptance remains
required for production promotion. The registered Stacklink OAuth application
requests read access plus the permissions for the five supported writes:
payment requests, transfer requests, category creation, category editing, and
transaction note or category changes. Every write requires Stacklink approval.
Money requests also require approval inside Mercury; this connector cannot
approve a request, send an immediate payment, or delete provider records.
Account numbers and routing numbers are masked and tax identifiers are removed. Balance-bearing reads and standalone document links are returned live without retaining the tool input or output. Provider responses must match the reviewed contract before they can be returned or saved.
Polling covers new and updated transactions, payment-request status, transfer-request status, and account balance changes. Balance events identify the changed account without including its balance. Polling starts with a baseline and does not turn existing records into new-transaction events.
Memory is opt-in for mercury.transactions and mercury.payment_requests.
Select exact bank accounts and a history window. Blank selection is rejected.
Memory records provider-owned structured state; notes, memos, attachments,
private document links, bank numbers, tax identifiers, and balances are excluded.
A payment request is not evidence that money was sent. Removing a source stops
its updates and lets you forget or erase the learned records.
Staging and production use separate OAuth clients. Disconnecting in Stacklink removes local access; remove the integration under Mercury Settings → Integrations to revoke the provider grant as well. See Mercury's MCP connection guide.
Implementation patterns
Dynamic (Sandbox)
Tools generated from OpenAPI specs fetched at startup — ideal for fast-moving, many-product APIs.
Generated manifest (Zoho Books)
A large manifest generated from the official OpenAPI archive and committed, with risk classes and approval rules baked in.
WooCommerce staging preview
WooCommerce (woocommerce) connects to each customer's exact HTTPS WordPress
store. Approve Stacklink on the store's native authorization page, or provide a
dedicated Consumer Key and Consumer Secret. A separate Stacklink WordPress plugin
and a customer-created OAuth application are not required.
The connector supports governed commerce tools and product, order, customer and coupon change triggers. Webhooks require write access; read-only connections can use polling. All writes require Stacklink approval. Manual refunds are supported; gateway refunds require separate gateway-sandbox validation and remain blocked.
Memory is off by default. Select exact products, categories or orders to remember supported structured state. Category selections include future direct members and selected products include variations. New orders require selection. Descriptions, customer contact data, addresses, notes and payment details do not enter Memory.
This is a visible staging candidate. Full live journeys, Studio, Workbench and exact cleanup must pass before production promotion.