@assemblyline-agents/attio

Official Assembly Line connection plugin for Attio's hosted Streamable HTTP MCP server at https://mcp.attio.com/mcp. It exposes Attio's reviewed CRM, activity-intelligence, and reporting tools through user-authorized OAuth.

Setup

Attio uses OAuth Authorization Code + PKCE and supports dynamic client registration. Register one public client for the Assembly Line deployment:

curl -X POST https://app.attio.com/oauth/register \
  -H 'content-type: application/json' \
  -d '{
    "client_name": "Assembly Line",
    "redirect_uris": ["https://YOUR-AGENT-HOST/assembly-line/connections/callback"],
    "grant_types": ["authorization_code", "refresh_token"],
    "response_types": ["code"],
    "token_endpoint_auth_method": "none"
  }'

Store the returned client_id as ATTIO_MCP_CLIENT_ID. Set ATTIO_MCP_REDIRECT_URI only when the registered callback differs from Assembly Line's normal connection callback URL. ATTIO_MCP_URL optionally overrides the hosted endpoint.

Add the connection to an agent:

assembly-line add attio agent

The default connection is user-scoped: each person authorizes their own Attio account, and Attio enforces that person's workspace permissions. Gate named write actions through plugins.attio.connections.attio.approval.

When an agent should operate as one company service identity, authorize a dedicated Attio member once through the protected operator connection flow and store the grant at workspace scope:

capabilities:
  attio:
    connections:
      attio:
        subject: workspace
        required: true

Do not let an arbitrary end user establish that shared grant. Preauthorize the dedicated account before opening the agent to users:

GET /assembly-line/connections/authorize?connection=attio

That route requires the runtime's agent-control authentication. The returned URL opens Attio's consent screen; the callback stores the access and refresh tokens in Assembly Line's host-side grant store. User-scoped connections can also authorize lazily: the invoking run parks, sends the consent link to the user, and resumes after the callback.

The reviewed MCP surface includes records and objects, lists and list entries, comments, notes, tasks, meetings, call recordings and transcripts, email search and content, workspace members and teams, basic reports, and read-only Particle SQL where the Attio plan supports it. It does not expose every REST administration operation, webhook management, file upload, or arbitrary schema mutation.

License

MIT