# Give an open-source Discord agent access to company tools

> A Discord bot replies in a channel once it has a token; reaching your company's tools takes a second design. Kortix is an open-source CompanyOS where an agent gets named connectors, credentials stay on the server, and a write can wait for a person.

URL: https://agentsindiscord.com/discord-agent-with-company-tools

## How five Discord options handle access

Access model, where credentials live and who can grant, read from each vendor's own pages in November 2026.

| | Kortix (recommended) | OoriData Discord-AI-Agent | AgentX | Beam.ai | Mava |
| --- | --- | --- | --- | --- | --- |
| Access model | Deny by default, granted per agent and per connector | MCP servers listed in one config file | Agents built in its builder, with MCP tools | Workflow steps in a hosted workspace | Knowledge-base answers in support conversations |
| Where credentials live | Brokered server-side, never enter the machine | Provider keys in environment variables on your host | Discord bot token pasted into AgentX | In the Beam workspace | In Mava's cloud workspace |
| Who can grant | Project admins, per agent and connector | Whoever edits config/main.toml | Whoever holds the AgentX account | Whoever holds the Beam workspace | Workspace seats and admins |
| Open source | Yes | Yes | No | No | No |
| Price shape | Free, credits from $50 a month, Enterprise custom | Free to self-run, you pay the model provider | Free to start, paid plans listed | No public price, request access | $0 for 30 requests, then $39 to $599 a month |

## Three layers between the bot and your tools

Each layer is a setting you choose before the agent touches an app.

### 1. One app, one connector

The agent reaches a CRM, repo or help desk through a connector that Kortix holds the login for, and the call is recorded.

`Kortix guide: connectors`

```
A connector gives agents access to one outside app, such as Gmail, Linear, Notion or Stripe. Kortix stores the login, picks the account, applies your rules and records every call. The login never enters the agent's computer.
```

Source: https://kortix.com/docs/guide#connectors

### 2. A grant, per agent

Connectors, secrets, skills, Apps and the project repository stay off an agent until a person turns them on for that agent.

`Kortix guide: agents`

```
Access is deny-by-default. An agent gets no connector, secret, skill, App or project repository until you grant it.
An agent acts as itself, not as you.
```

Source: https://kortix.com/docs/guide#agents

### 3. A write can wait

A call marked Ask pauses the agent until a named person decides, and the decision covers that one action.

`Kortix guide: connectors`

```
Ask holds the action until a person approves it.
An approval covers one exact action. A changed detail needs a new approval.
```

Source: https://kortix.com/docs/guide#connectors

## Add the app from Project admin

Connectors → Channels → Add to Discord, the step the Kortix Guide walks through.

The Kortix Guide's Channels page, Discord section: add Kortix to your server, mention the app with a task, allow the people.

## A bot that answers, and the half of the job nobody documents

Discord tutorials cover the first half well. Create an application. Turn on the Message content intent. Generate a bot token, paste it into a builder, pick a model, and the bot replies. [AgentX's Discord walkthrough](https://www.agentx.so/mcp/resources/agentx-tutorial/how-to-deploy-ai-agents-to-discord-server) stops at `/ask` in a channel.

The second half begins when someone asks the bot to do something that touches a system you care about. "Which tickets are still open from Friday" needs the help desk. "Draft the release note" needs the repository. "Refund the duplicate charge" needs Stripe, and it needs a second pair of eyes. A model key cannot reach any of them. A wide API key reaches all of them at once. That is the design question: what the agent may touch, on whose authority, and what happens before a write lands.

## Deny by default, then one grant at a time

Kortix starts from grants that are off. The [Guide](https://kortix.com/docs/guide#agents) puts the rule plainly: an agent gets no connector, secret, skill, App or project repository until a person grants it. Three pieces do the work. A connector is one outside app. An account is who a call runs as: private to you, shared with the project, or shared with named people and agents. A rule set says what this agent may do with that app.

The catalog reaches past the first-class apps: 3,000+ apps in a click, plus MCP, OpenAPI, Postman, GraphQL and raw HTTP. A help desk or an internal service without a plugin can still be reached through its API.

Credentials sit outside the grant. "Connector credentials are brokered server-side and never enter the machine," so a session on a cloud computer calls the app through Kortix and never holds the login. A self-hosted bot that keeps its Stripe key in `config/main.toml` works the other way round.

Rules live in the project's `kortix.yaml` as data, next to the agents they constrain. The [reference](https://kortix.com/docs/developers#permission-rules) documents the shape, and `default_mode: risk` is the setting that lets reads run while writes and deletes wait for approval:

```yaml
policy:
  default_mode: risk
policies:
  - match: "helpdesk.delete_*"
    action: block
approvals:
  ttl: 4h
```

Approval gates you set. Off until you set them. A project rule outranks an agent's own set, and a set can loosen a base rule for its own agent. That order is written down before the first write. Across the other four options in the table, none documents a grant per agent over a company's own accounts. Kortix is built around that grant, and around the rule that can hold a call once it is made.

## What the grant looks like from a Discord thread

The Discord side is thinner than people expect. "In a server, only a mention reaches the agent, as in Slack," and one thread is one session. A mention starts a thread on the message, and a later mention in that thread continues it.

The allowed-people list is the first gate. A mention from someone who is not on it gets a reply showing their Discord ID. The request appears under Wants access, where a project manager allows or dismisses it. Discord has no account link, so the bot never borrows the sender's Kortix role. The agent runs under its own permissions.

Then the tool gate. Take a request such as closing three stale tickets. The agent reads the help desk, proposes the three closes, and the Ask rule holds the first call. The thread is where the work was asked for; the decision happens in Kortix. The held call stays with the session the thread started, so it opens in Kortix under Review → Needs you, where the deciding person sees what the help desk will receive and chooses Approve or Deny. A project manager, or the person who started the session, decides. The approval covers that exact action and runs once. A changed argument needs a new one.

## The cost of skipping it

Without per-agent grants, every bot in a server shares one credential, and the support bot can reach billing because the credential can. Without an approval rule, a model that misreads a thread closes a live ticket, and the first sign is a customer reply. The activity record is worse: it names the person who installed the bot for everything the bot did.

None of those failures needs a dramatic story. Each follows from a credential with more scope than the job, and each is cheap to prevent before the first connector is installed.

## Questions buyers ask before connecting a tool

### Can a Discord agent read our repository?

Only after a person grants it. Grants start off, and repository access is one of them, so the agent works on a copy of the repository on the session's own branch.

### Can I limit the agent to one channel or one person?

Yes. In a server, only a mention reaches the agent, and an allowed-people list decides who can start a session. Anyone else gets a reply with their Discord ID and an access request a project manager can approve.

### What stops the agent writing to production?

Rules you set. A tool marked Ask holds the call until a person approves it, and "Nothing merges itself: work reaches `main` through a change request a person approves, unless an admin granted the merge capability."

## Start with one connector and one rule

Add the app, grant it to one agent, and approve the first held write from the session it started.

[Try Kortix](https://kortix.com) · [See approvals in Discord](https://agentsindiscord.com/approvals-in-discord)

Open source · Self-host, VPC or on-prem · Discord, Slack, Teams and Telegram channels