Skip to main content
An agent connected to Radar Cloud gets the cluster: resources, events, logs, metrics, the diagnose tool. Integrations extend that to the cloud account around the cluster. An organization owner connects an account from a catalog in Settings, Radar Cloud holds the credential, and the account’s APIs show up as extra tools on the same MCP endpoint the agent is already connected to, next to the cluster tools. The agent never sees the credential. It calls a tool; Radar Cloud makes the call with the sealed credential and returns the result.
Integrations are in Preview. The catalog currently offers AWS and Google Cloud; both carry a Preview label. More vendors are built and will be enabled as their coverage settles.

​
Connect an account

Settings → Organization → Integrations. Owners connect, repair and remove; the page shows every organization role what is connected.
  • Connected - the accounts already connected, each with a status pill, its tool count and when it was last used. Recheck all tests every installation that can be tested in parallel; one that is still waiting for you to finish its setup is skipped, not counted as broken. Click a card to open its details or repair a credential.
  • Available - the catalog, with search.
Connecting walks you through the provider’s own requirements: a form for the settings it needs and an optional test before saving. For AWS, whatever the role or key is allowed to do is exactly what the agent can do; Radar does not narrow it and cannot. For Google Cloud, Radar mints tokens restricted to read-only Monitoring, Logging and Trace scopes, so the agent reads observability data regardless of what else the service account could do. See the note on read-only mode below.

​
What an agent sees

Nothing changes on the agent side. The MCP endpoint it already uses - through a personal access token or an OAuth grant - lists the integration tools next to the cluster tools. Tools are named skyhook_<type>_<tool>, or skyhook_<type>_<service>_<tool> for a provider with several services (Google Cloud), and take an integration argument that names the connected account when the organization has more than one.
The organization’s read-only MCP mode governs the tools Radar itself authorizes - the cluster tools. It does not restrict integration tools: an AWS call is authorized by the credential you connected, and Radar cannot classify read from write across that API, so grant the role or key only what agents should be able to do. Google Cloud calls are limited to read-only Monitoring, Logging and Trace scopes by the token Radar mints.
A tool call against an account whose credential has stopped working (rotated key, a sealed credential that can no longer be decrypted) returns an error naming the integration, and the card shows it as needing attention until you repair it.

​
Permissions