Look closely at most “integrations” and you’ll find the same thing: a script here, an API key pasted into an env file there, a webhook someone wired two years ago and nobody dares touch. It works — until it doesn’t — and no one can say with confidence who has access to what.

Vastvic takes a different stance. Every integration is a governed tool, not glue.

A connector is a tool

Pick a connector and App Foundry provisions a real, MCP-callable connection through the unified gateway. The agent doesn’t see a raw API and a pile of credentials — it sees a typed tool with a clear schema. And every call it makes is traced in the run ledger.

The question stops being “where did we put that API key” and becomes “which tools is this app allowed to call, and who approved them.”

Credentials behind an HITL boundary

Secrets are entered behind a human-in-the-loop gate. The agent never sees a raw key until you approve the connection; from that point on it calls the tool while the credential stays in the governed store. You get autonomy without handing an agent the keys to your accounts.

The building blocks

The same model spans the integrations real apps need:

  • Payments — Stripe, Razorpay, PayPal: billing as a tool.
  • Identity — Google sign-in, Microsoft Intune device gates.
  • Messaging — SendGrid, Twilio for email, SMS and verification.
  • Models — Anthropic, OpenAI, Gemini through unified routing.

Each is a first-class, governed tool your generated app can call — provisioned the same way, audited the same way, revoked the same way.

The result is integrations you can reason about: audit them, revoke them, and see exactly what they did — instead of a pile of glue you’re afraid to touch.

Key takeaways

  • Connectors are typed, MCP-callable tools — not hand-written glue.
  • Credentials sit behind an HITL boundary; the agent never sees raw secrets.
  • Payments, identity, messaging and models all follow one governed model.
  • Every call is traced, auditable, and revocable.