Skip to main content

​
What an Integration Is

Integrations connect Wolffish to external services. Each integration is a capability (a cerebellum skill with a plugin) that adds tools for interacting with a specific API — Gmail, GitHub, Notion, Brave Search, and more.

​
Design Principles

Stateless

Every integration reads credentials on-demand at tool-call time. No background daemons, no persistent connections, no polling loops.

Optional

Wolffish works fully without any integrations configured. Each one is independent — enable only what you need.

​
How Integrations Work

The integration architecture follows the standard capability pipeline: 
Settings panel ──► config.json / Variables ──► Plugin reads token ──► API call ──► Result ──► motor ──► broca ──► User
  1. You configure credentials in the Settings panel (or edit config.json directly)
  2. The credential is stored in ~/.wolffish/workspace/config.json or as a Variable
  3. When the LLM decides to use an integration tool, the plugin reads the token at call time
  4. The plugin makes the API request and returns a ToolResult
  5. The result flows through motor (execution engine) back to broca (output renderer)
Integration credentials configured in the Settings panel (Notion, GitHub, Brave, Google OAuth, etc.) are never sent to the LLM — plugins read them directly from config.json when a tool executes. The LLM only sees the tool result.
Variables are different. Any value stored in Settings → Variables is included in the system prompt in plaintext on every turn so the agent can reference and use them. If you store a secret as a Variable, the LLM will see it — that’s intentional, since it needs the value to use it in tool calls. Use Variables for credentials the agent needs to act on directly (e.g. passing an API key as a shell argument). Use the integration-specific settings pages for credentials the plugin handles itself.

​
Credential Storage

Integration tokens live in config.json under their respective integration sections: 
// Example: config.json integration section
{
  "integrations": {
    "google": {
      "accounts": [
        {
          "email": "you@gmail.com",
          "accessToken": "ya29.a0...",
          "refreshToken": "1//0e..."
        }
      ]
    }
  }
}
Like all workspace data, credentials are stored in plain text on your local machine. Wolffish is a personal, local-first app — your workspace is your own. If you version-control your workspace, add config.json to .gitignore.

​
Available Integrations

Browser Extension

Control Chrome or Brave directly — navigate, click, read, screenshot. 44 tools in the user’s real browser session.

Google Workspace

Gmail, Drive, Calendar, Contacts, Tasks, and Sheets. OAuth-based multi-account support.

GitHub

Repositories, issues, pull requests, workflows, releases, and gists via personal access token.

Notion

Pages, databases, and knowledge bases. Search, read, create, and query your Notion workspace.

Brave Search

Web search via Brave Search API. Results are returned as structured data for the LLM to summarize.

​
Integration vs. Capability

Every integration is a capability, but not every capability is an integration. The distinction:
CapabilityIntegration
Locationbrain/cerebellum/brain/cerebellum/
Has SKILL.mdYesYes
Has plugin/MaybeAlways
Needs credentialsNoYes
Calls external APIsNoYes
Examplegit, shellgoogle, github
Integrations are plugin capabilities that require external credentials and make network requests to third-party APIs. Pure capabilities like git and shell only use local system resources.

​
Activation

Integrations are selected by the ras (attention filter) just like any other capability. When your message matches an integration’s triggers, its tools are included in the LLM context. For example, saying “check my email” triggers the Google capability because “email” is in its trigger list. The LLM then decides which specific tool to call (gmail_search, gmail_read, etc.) based on your intent.
If an integration’s tools aren’t appearing, make sure the credential is configured. Capabilities with missing credentials are deprioritized by ras since their tools would fail anyway.