Business systems
Step-by-step connection and configuration for Atlassian, Stripe, Slack, Notion, Zendesk and ServiceNow.
The systems that hold the human context around a ticket: the runbook, the past conversation, the charge that was actually refunded.
Atlassian
atlassian · runs mcp-atlassian via uvx with read-only mode on, which disables
create, update and delete across both products.
Confluence and Jira are configured independently. A product is enabled only when its URL is filled in, so a Jira-only setup is a valid configuration — it simply carries fewer tools.
Cloud only
This form collects the Cloud authentication shape (account email + API token). Server and Data Center instances authenticate with a personal access token instead, which this integration does not support.
Create an API token at id.atlassian.com → Security → API tokens. One token works for both products. It acts as the Atlassian account it belongs to, so use an account whose Jira and Confluence permissions are read-only.
Fill in one or both blocks.
| Field | Required | What to put |
|---|---|---|
| Confluence URL | per product | https://your-company.atlassian.net/wiki — note the /wiki suffix. |
| Confluence email | with the URL | The Atlassian account email the token belongs to. |
| Confluence API token | with the URL | |
| Jira URL | per product | https://your-company.atlassian.net |
| Jira email | with the URL | The same account email. |
| Jira API token | with the URL | The same token is fine. |
Filling an email or token without its URL does nothing — the product stays off.
Verify. Start-checked only: every search tool requires a query, so there is no fixed call to health-check with.
| If it reports | It usually means |
|---|---|
401 / unauthorized | On Cloud, the email must be the Atlassian account email and the token an API token — a login password never works. On Server/Data Center, the auth shape itself is unsupported here. |
Stripe
stripe · runs the official @stripe/mcp via npx, pinned to a version whose
--tools flag still validates: the spawned process is restricted to read tools
(balance, coupons, customers, disputes, documentation, invoices, payment intents,
prices, products, subscriptions), so the write half is refused by the process itself
as well as by your key.
Create a restricted key. dashboard.stripe.com/apikeys → Create restricted key, granting Read on: Balance, Customers, Products, Prices, Invoices, Coupons, Payment intents, Subscriptions, Disputes. Nothing write.
Mind the mode — a test-mode key cannot see live data.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| API key | yes | rk_live_… (restricted). A full secret key works but grants far more than this needs. |
Verify. Health check retrieves the account balance.
| If it reports | It usually means |
|---|---|
Invalid API key | Truncated paste, or the wrong mode (test vs live). |
Restricted API key … insufficient permissions | Add Read on the resource named in the error. |
Slack
slack · runs slack-mcp-server via npx · posting is off by default: the
posting tool is not registered at all unless you enable it below.
Create a Slack app at api.slack.com/apps → From scratch, in the workspace you want searchable.
Add user token scopes under OAuth & Permissions → Scopes → User Token Scopes:
search:read (the reason this integration exists), plus channels:history,
channels:read, and groups:history / groups:read for private channels.
Use a user token, not a bot token
Slack's search.messages API refuses bot tokens outright. A bot token (xoxb-) works
for reading history but cannot search at all.
Install the app to the workspace and copy the User OAuth Token (xoxp-…).
Invite the token's user to any private channels you want readable.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Slack token | yes | xoxp-…. The prefix is what selects the token type — you do not restate it. |
| Allow posting messages | no, defaults off | Turn on to let Triagic post findings back to Slack, workspace-wide. |
| Limit posting to channels | no | Comma-separated channel IDs, e.g. C0123456789,C9876543210. Setting this enables posting only to those channels and overrides the toggle above. |
Verify. Health check lists one public channel. On a very large workspace the first attempt can land before the server's channel cache is warm; it fails closed and recovers on the next sync.
| If it reports | It usually means |
|---|---|
invalid_auth, token_revoked | Re-copy from OAuth & Permissions — reinstalling the app invalidates the old token. |
missing_scope, not_allowed_token_type | Searching needs a user token with search:read; history needs channels:history and channels:read. |
not_in_channel | Invite the token's user to that private channel. |
Notion
notion · runs the official @notionhq/notion-mcp-server via npx.
Read-only is the integration's capability, not a flag
The server exposes write tools and has no switch to drop them. Granting the Notion integration only "Read content" when you create it makes every write fail at Notion's side — that is the real boundary, and it is set once, at creation.
Create an internal integration at notion.so/profile/integrations. Under Capabilities, select Read content and nothing else.
Copy the Internal Integration Secret (ntn_…). The integration's own ID is not a
token.
Connect it to the pages you want readable. In Notion, open the page — or the parent of a whole space — then ••• → Connections → add the integration. Nothing is visible to it until you do this; sharing is per-page and it is the step people miss.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Integration token | yes | ntn_… |
Verify. Health check reads the integration's own bot user, so it fails exactly when the token is wrong — note that it passes even when nothing has been shared yet.
| If it reports | It usually means |
|---|---|
unauthorized, API token is invalid | Wrong string — copy the Internal Integration Secret, not the integration id. |
object_not_found | Almost always step 3: the page isn't connected to the integration. |
restricted_resource | Capabilities were set to "No content". |
Zendesk
zendesk · runs zendesk-mcp via npx.
Writes are not blocked here
The server exposes ticket and user writes and offers no read-only flag. A Zendesk API token acts as the agent whose email is paired with it, so the role of that agent is the boundary — mint the token against a read-only custom role or a Light Agent.
Enable API token access. Admin Center → Apps and integrations → Zendesk API, turn on token access, then Add API token. Copy it — it is shown once.
Note the agent email the token was created under. The two are paired; a mismatch is a 401.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Subdomain | yes | Just the subdomain — for https://acme.zendesk.com that is acme, not the URL. |
| Agent email | yes | The account the token was created under. |
| API token | yes |
Verify. Health check lists organizations, which exercises all three fields.
| If it reports | It usually means |
|---|---|
ENOTFOUND / getaddrinfo | The subdomain field has a full URL in it. |
401 / Couldn't authenticate you | Email and token don't match, or API token access is still switched off. |
403 | End users cannot use the API at all — the token must belong to an agent. |
ServiceNow
servicenow · runs servicenow-mcp-ai via npx · read-only twice over: the
server's own read-only switch refuses every create, update and delete, and its write
mode is pinned to plan, which returns a non-mutating preview instead of acting.
Create a service account on the instance with REST API access and a read-only
role. itil is enough to read incidents and changes; snc_read_only or a custom read
role is the least-privilege option.
The account must not be locked out, and must not be an interactive-only user — instances often block those from the REST API.
Fill the form.
| Field | Required | What to put |
|---|---|---|
| Instance URL | yes | The full https://acme.service-now.com form. |
| Username | yes | The service account. |
| Password | yes |
Verify. Health check lists tables, which fails on a bad URL, a bad password, or a user without table visibility.
| If it reports | It usually means |
|---|---|
401 / User Not Authenticated | Wrong credentials, a locked-out account, or one without web-service access. |
403 / ACL | Signed in, but an ACL blocked the read. Grant a role that can read the tables you need. |
ENOTFOUND, hibernating | Wrong URL — or a personal developer instance that needs waking from the developer portal. |