> ## Documentation Index
> Fetch the complete documentation index at: https://radarhq.io/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrations: cloud accounts as agent tools

> Connect an AWS or Google Cloud account from Settings and the account's APIs become tools on the MCP endpoint your agents already use. Preview.

An agent connected to Radar Cloud gets the cluster: resources, events, logs, metrics, the diagnose tool. **Integrations** extend that to the cloud account around the cluster. An organization owner connects an account from a catalog in Settings, Radar Cloud holds the credential, and the account's APIs show up as extra tools on the same MCP endpoint the agent is already connected to, next to the cluster tools.

The agent never sees the credential. It calls a tool; Radar Cloud makes the call with the sealed credential and returns the result.

<Note>
  Integrations are in **Preview**. The catalog currently offers **AWS** and **Google Cloud**; both carry a Preview label. More vendors are built and will be enabled as their coverage settles.
</Note>

## Connect an account

**Settings → Organization → Integrations**. Owners connect, repair and remove; the page shows every organization role what is connected.

* **Connected** - the accounts already connected, each with a status pill, its tool count and when it was last used. **Recheck all** tests every installation that can be tested in parallel; one that is still waiting for you to finish its setup is skipped, not counted as broken. Click a card to open its details or repair a credential.
* **Available** - the catalog, with search.

Connecting walks you through the provider's own requirements: a form for the settings it needs and an optional test before saving.

| Provider         | Credential                            | How it works                                                                                                                                                                                                                                                                         |
| ---------------- | ------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| **AWS**          | IAM role (recommended on Radar Cloud) | Two phases: Radar mints an external ID you cannot change and shows the exact trust policy for a new role; you create the role with the policy you choose and paste its ARN. Radar verifies the confused-deputy guard before accepting. Temporary credentials are issued per request. |
| **AWS**          | Access keys                           | A long-lived access key and secret, optionally a session token. Best for a self-hosted Hub, which already has an identity in your account.                                                                                                                                           |
| **Google Cloud** | Service account key                   | The project ID and a service-account JSON key.                                                                                                                                                                                                                                       |

For AWS, whatever the role or key is allowed to do is exactly what the agent can do; Radar does not narrow it and cannot. For Google Cloud, Radar mints tokens restricted to read-only Monitoring, Logging and Trace scopes, so the agent reads observability data regardless of what else the service account could do. See the note on read-only mode below.

## What an agent sees

Nothing changes on the agent side. The MCP endpoint it already uses - through a [personal access token](/docs/cloud/personal-access-tokens) or an [OAuth grant](/docs/cloud/connected-apps) - lists the integration tools next to the cluster tools. Tools are named `skyhook_<type>_<tool>`, or `skyhook_<type>_<service>_<tool>` for a provider with several services (Google Cloud), and take an `integration` argument that names the connected account when the organization has more than one.

<Warning>
  The organization's [read-only MCP mode](/docs/cloud/connected-apps#org-wide-mcp-access-mode) governs the tools Radar itself authorizes - the cluster tools. It does **not** restrict integration tools: an AWS call is authorized by the credential you connected, and Radar cannot classify read from write across that API, so grant the role or key only what agents should be able to do. Google Cloud calls are limited to read-only Monitoring, Logging and Trace scopes by the token Radar mints.
</Warning>

A tool call against an account whose credential has stopped working (rotated key, a sealed credential that can no longer be decrypted) returns an error naming the integration, and the card shows it as needing attention until you repair it.

## Permissions

| Action                                 | Owner                                                       | Member               | Viewer |
| -------------------------------------- | ----------------------------------------------------------- | -------------------- | ------ |
| See what is connected                  | yes                                                         | yes                  | yes    |
| Recheck a connection                   | yes                                                         | through the API only | no     |
| Open details, connect, repair, remove  | yes                                                         | no                   | no     |
| Use integration tools through an agent | governed by the credential you connected, not by Radar role |                      |        |

## Related

* [Connected apps & MCP access](/docs/cloud/connected-apps) - how agents authenticate to Radar Cloud, and the read-only clamp that applies to cluster tools
* [Personal access tokens](/docs/cloud/personal-access-tokens)
* [MCP server](/docs/features/mcp) - the cluster tools every agent gets