Integrations

PandaOS integrates with Supabase, Vercel, GitHub, and Gmail, each adding workspace tabs, project linking, and AI context to your workflow.

How Integrations Work

PandaOS uses a plugin architecture for integrations. Each integration can provide:

• Authentication, token-based or OAuth flows to connect your account
• Workspace tabs, additional tabs in the Workspace Dock (e.g., Database, Deployments, Inbox)
• Project linking, associate a specific resource with each project (e.g., a Supabase database or Vercel project)
• AI context, integrations inject hints into your project's CLAUDE.md so PandaOS knows what services are available

Credentials are encrypted at rest using your operating system's native keychain (macOS Keychain, Windows Credential Manager).

Opening the Apps page

Apps are connected from the Apps page in the sidebar, not from Settings.

1. Click Apps in the sidebar
2. Open the app you want and connect the account
3. For project-scoped apps such as Supabase and Vercel, link the project from that app's card

Connecting an account is global: you do it once and every project can use it. Linking says which resource a given project should use. See Connecting an Account.

GitHub

GitHub integration enables:

• Cloning repositories from the app
• Submitting feedback as GitHub issues
• Accessing private repositories

Connecting

GitHub uses the Device Flow for authentication:

1. Click "Sign in with GitHub" in the integrations settings
2. A device code is displayed and copied to your clipboard
3. Click "Open GitHub" to go to the verification page
4. Paste the code and authorize
5. PandaOS detects authorization automatically

Once authenticated, your username and avatar are displayed. Click "Disconnect" to remove the token.

---

Supabase

Supabase integration provides a Database tab in the workspace, a full database explorer with inline editing, SQL console, and RLS policy viewer.

Connecting

1. Enter your Supabase access token in the token field (password input with show/hide toggle)

2. Click "Test Connection" to verify

3. If successful, your Supabase account info is displayed

4. Enter your Supabase access token in the token field (password input with show/hide toggle)

5. Click "Test Connection" to verify

6. If successful, your Supabase account info is displayed

Linking to a Project

After connecting your account globally, open project-level settings to link a specific Supabase project:

1. Open Settings for a specific project

2. Go to Integrations

3. Search for and select the Supabase project to link

4. Open Settings for a specific project

5. Go to Integrations

6. Search for and select the Supabase project to link

Database Tab Features

Once connected and linked, the Database tab in the workspace provides:

Tables, browse all schemas and tables in your database. Click a table to explore its data in a paginated grid with:

• Column sorting (click headers)
• Filtering (add filter rules per column with operators like equals, contains, greater than, etc.)
• Inline editing, click any cell to edit its value directly. Changes are saved on blur or Enter.
• Insert rows, click the "+" button to add a new row. A form appears with fields for each column.
• Delete rows, select rows and delete them from the action bar.

SQL Console, write and execute SQL queries interactively. Results display in a table with the same sorting and filtering capabilities. Supports multi-statement queries.

RLS Policies, view all Row Level Security policies across your tables. Each policy shows its name, command type (SELECT, INSERT, UPDATE, DELETE), and the policy definition.

Auth Users, browse and search your Supabase Auth user list with email, provider, and creation date.

Disconnecting

Click "Disconnect" to remove the token and unlink the project.

---

Vercel

Vercel integration provides a Deployments tab in the workspace for monitoring deployments, managing environment variables, and viewing domains.

Connecting

1. Enter your Vercel token in the settings

2. Click "Test Connection"

3. Your account info and team list are displayed

4. Enter your Vercel token in the settings

5. Click "Test Connection"

6. Your account info and team list are displayed

Linking to a Project

1. Open project-level settings
2. Select a Vercel team (or personal account)
3. Search for and select the Vercel project to link

Deployments

The Deployments tab shows your deployment history with:

• Status badges, color-coded indicators for each deployment state
• Preview URLs, click to open the deployment preview
• Real-time build logs, when a deployment is building, logs stream in real-time via SSE (Server-Sent Events). View the full build output as it happens.
• Deployment promotion, promote any preview deployment to production directly from the tab

Tab Badge

The Deployments tab in the dock shows a colored status dot reflecting the state of your latest deployment, green for ready, amber for building, red for errors. This gives you at-a-glance deployment status without switching tabs.

Environment Variables

Manage your Vercel project's environment variables directly from PandaOS:

• View, see all environment variables with their target environments (Production, Preview, Development)
• Create, add new variables with key, value, target environments, and type (plain, secret, encrypted)
• Edit, update variable values and target environments
• Delete, remove variables you no longer need

Env Sync

PandaOS can compare your local .env file with your Vercel environment variables and show the sync status:

• Variables present in Vercel but missing locally
• Variables present locally but not in Vercel
• Variables with different values between local and remote

This helps you keep local development in sync with your deployment configuration.

Domains

View the domains configured for your Vercel project, including custom domains and the default .vercel.app domain.

Deployment with Vercel Integration

When your project has a Vercel project linked, PandaOS deploys through your Vercel integration instead of PandaOS auto-deploy:

• To deploy: Commit and push your changes to GitHub, Vercel auto-builds from the push
• To monitor: PandaOS uses vercel_list_deployments to check status, or you can open the Deployments tab
• Auto-deploy is disabled: The PandaOS managed deploy pipeline does not run for projects with Vercel linked, preventing conflicts

This means you keep full control over your deployment setup, your own GitHub repo, your own Vercel project, your own build settings. PandaOS auto-deploy is only for projects that don't have their own Vercel setup yet.

Disconnecting

Click "Disconnect" to remove the token and unlink the project.

---

Gmail

Gmail integration adds an Inbox tab to the workspace, an AI-native email client with drag-to-chat and smart actions.

Connecting

PandaOS ships with built-in Google OAuth credentials, so most users can connect with a single click:

1. Open the Apps page in the sidebar
2. Click "Connect with Google" in the Gmail section
3. Your browser opens Google's consent screen, sign in and grant permissions
4. PandaOS detects authorization automatically and shows your email address

Using Your Own OAuth Credentials

If you're running PandaOS within your own organization and want to use your own Google Cloud project (e.g. for audit logging, domain-wide consent, or branding), you can provide custom credentials:

1. Click "Use your own OAuth credentials" below the Connect button
2. Enter your Client ID and Client Secret
3. Click Connect, the same OAuth flow starts with your credentials

To create OAuth credentials, go to the Google Cloud Console, enable the Gmail API and People API, configure the OAuth consent screen (add the scopes listed below), then create an OAuth 2.0 Client ID with application type "Desktop app". Desktop apps automatically allow http://127.0.0.1 redirects, no redirect URI configuration is needed.

Required Scopes

Whether using built-in or custom credentials, PandaOS requests the following OAuth scopes:

All scopes are prefixed with https://www.googleapis.com/auth/. If you're using custom credentials, ensure these APIs are enabled in your Google Cloud project.

Email Interface

Once connected, the Inbox tab provides a three-panel email interface:

Label Sidebar (Left), navigate between system labels (Inbox, Sent, Drafts, Trash, Spam, Starred) and your custom labels. Each label shows an unread count badge.

Email List (Center), browse emails with search and category filtering (Primary, Social, Promotions, Updates). Supports pagination for large inboxes.

Email Detail (Right), read full emails with rich HTML rendering. Reply, forward, or trash directly from the view.

Compose, write new emails with a compose modal. Supports To, CC, BCC, subject, and rich text body.

AI-Powered Actions

Gmail is deeply integrated with the chat:

• Drag-to-Chat, drag an email from the list onto the Chat tab to include its full content as context for PandaOS
• Send to Chat, right-click an email and select "Send to Chat" to paste the email content into the chat
• Summarize, right-click and select "Summarize" to have PandaOS summarize the email
• Draft Reply, right-click and select "Draft Reply" to have PandaOS generate a professional response

Inbox Badge

The Inbox tab in the dock shows an unread count badge that refreshes automatically.

Disconnecting

Open the Apps page in the sidebar and click "Disconnect" in the Gmail section. This revokes the OAuth tokens and removes stored credentials.

---

Microsoft Outlook

Outlook integration adds an email tab to the workspace, an AI-native email client for Microsoft 365 / Outlook.com accounts, with folders, compose, search, and contacts.

Connecting

PandaOS ships with built-in Microsoft Entra credentials, so most users can connect with a single click:

1. Open the Apps page in the sidebar
2. Click "Connect with Microsoft" in the Outlook section
3. Your browser opens Microsoft's consent screen, sign in and grant permissions
4. PandaOS detects authorization automatically and shows your display name

Using Your Own Azure App

If you want to use your organization's own Azure app registration (e.g. for tenant restrictions, audit logging, or conditional access policies):

1. Click "Use your own Azure app registration" below the Connect button
2. Enter your Tenant ID and Client ID (Application ID)
3. Click Connect, the same OAuth flow starts with your app

Register a public client (PKCE) app in Microsoft Entra ID. Under Authentication → Add a platform, select Mobile and desktop applications and add the redirect URI http://localhost. No client secret is needed, the http://localhost redirect allows any port automatically. Add the Microsoft Graph delegated permissions listed below under API permissions.

Required Permissions

Whether using built-in or custom credentials, PandaOS requests the following Microsoft Graph delegated permissions:

Disconnecting

Open the Apps page in the sidebar and click "Disconnect" in the Outlook section.

---

Microsoft Teams

Teams integration adds a tab for team channels, messages, and threaded replies.

Connecting

PandaOS ships with built-in Microsoft Entra credentials (shared with Outlook):

1. Open the Apps page in the sidebar
2. Click "Connect with Microsoft" in the Teams section
3. Your browser opens Microsoft's consent screen, sign in and grant permissions
4. PandaOS detects authorization automatically

Using Your Own Azure App

Same as Outlook, click "Use your own Azure app registration" and enter your Tenant ID + Client ID. You can reuse the same Azure app as Outlook if you add both sets of permissions to it. The app must have a http://localhost redirect URI registered under Authentication → Mobile and desktop applications (see the Outlook section above for full setup steps).

Required Permissions

Disconnecting

Open the Apps page in the sidebar and click "Disconnect" in the Teams section.

---

Project-Level Integrations

Each integration can be configured at the project level to link specific resources. This lets you:

• Link a different Supabase database to each project
• Link a different Vercel project to each project
• Optionally link a Gmail account to a project for context

Open Settings with a project scope to see and configure project-specific integrations. If the integration isn't authenticated globally yet, you'll see a prompt to set it up in global settings first.

---

PandaOS MCP

When an integration is connected, PandaOS exposes it to PandaOS as tools via its own built-in PandaOS MCP server (pandaos-orchestrator). This is not the official Supabase MCP, Vercel MCP, or any third-party MCP, PandaOS wraps each integration's API into its own unified MCP layer. The benefit is that you don't need to install or configure separate MCP servers for each service. Everything runs through the single PandaOS MCP using the credentials you already connected in Integrations settings.

Available Tools

Each integration provides a set of tools that PandaOS can call through the PandaOS MCP:

Tools that perform destructive or sensitive actions (sending emails, deleting env vars, executing SQL) require user confirmation before executing. Read-only tools run automatically.

Disabling the PandaOS MCP per Integration

You can control which integrations expose tools through the PandaOS MCP at two levels:

Global level, disable an integration's MCP tools across all projects:

1. Open Settings (Cmd+,)
2. Go to Integrations
3. Find the connected integration (Gmail, Vercel, or Supabase)
4. Toggle "MCP Tools" off

When disabled globally, PandaOS cannot use any of that integration's tools in any project.

Project level, disable MCP tools for a specific project while keeping them active elsewhere:

1. Open Settings for the specific project
2. Go to Integrations
3. Find the linked integration (Supabase or Vercel)
4. Toggle "MCP Tools" off

This is useful when you want PandaOS to have Vercel access in your production project but not in an experimental one, for example.

1. Open Settings (Cmd+,)
2. Go to Integrations
3. Find the connected integration (Gmail, Vercel, or Supabase)
4. Toggle "MCP Tools" off
5. Open Settings for the specific project
6. Go to Integrations
7. Find the linked integration (Supabase or Vercel)
8. Toggle "MCP Tools" off

Spotlight Mode

When Spotlight is enabled, PandaOS's tool calls automatically open the relevant integration tab and navigate to the right view. For example, if PandaOS reads an email, the Inbox tab opens and selects that email. If PandaOS lists deployments, the Deployments tab opens. This works for all integrations, Gmail, Outlook, Vercel, Supabase, and custom apps.

See the Spotlight Mode documentation for the full list of supported actions per integration.

Master Toggle

There is also a master "PandaOS MCP" toggle in Settings > General (labeled "Orchestrator MCP") that disables the entire PandaOS MCP server. When off, no integration tools are available to PandaOS at all. The per-integration toggles provide more granular control without disabling the whole system.