Knowledge and connectors for agents
An agent answers from what you give it: files uploaded to the agent, knowledge bases you link, and the MCP servers and app connections it may call. This page covers each, who the agent acts as, and how readiness and policy are shown.
Updated October 2026Agents2 of 4
Short answer
Knowledge files
- Step 1
Name the agent first
Files attach to a saved agent, so the builder asks for a name before the upload area is enabled (Add a name first). - Step 2
Upload
Drag and drop files into the Knowledge area or click to browse. Accepted formats: PDF, Word, Excel, PowerPoint, CSV, JSON, Markdown and plain text, up to 10 MB each. - Step 3
Wait for indexing
Each file shows a status. Files are indexed and searched while the agent answers, together with any knowledge bases you link.
| Status | Meaning |
|---|---|
| Not indexed | Uploaded, waiting for indexing to start. |
| Indexing | Being split and embedded; the agent cannot search it yet. |
| Indexed | Searchable while the agent answers. |
| Failed | Indexing failed; remove the file and upload it again. |
Knowledge bases
Under Knowledge bases, link the bases the agent should search. Bases are created and maintained on the Knowledge page (document uploads, URLs, reindexing, search); the builder says You have no knowledge bases yet. Create one on the Knowledge page when there are none. Passages the agent used show up in the Sources list of its answers. The assisted builder can link bases for you, and warns when a base it named does not exist. See Knowledge bases.
MCP servers and connected apps
Connected servers lists the MCP servers this agent may call. Only servers you enabled in Settings appear; Manage in Settings takes you there. Toggle Use {name} in this agent for each one.
- Servers with per-user sign-in. Each person using the agent connects their own account; anyone without one sees a connect prompt.
- Servers with an API key or no sign-in. Off, only you can use the server through this agent. Run for everyone who uses this agent makes every user call the server with your key.
- Approvals. When a tool wants to act, the chat asks Approve this action?; Approve for this chat covers the rest of that conversation. Tools can also be limited per server under Settings.
Connected accounts (Google Workspace, Microsoft Graph, Slack, Microsoft Teams) and the connector catalog are described in Apps and connectors.
Own credentials and identity
Credential kinds
The Identity & credentials panel lets an agent hold credentials in its own name, so a scheduled or event-driven run does not depend on whoever started it. This is a plan feature (agents.own_credentials); without it the panel is read-only.
| Kind | What it is |
|---|---|
| Model provider key | A provider key the agent uses in its own name on scheduled and event-driven runs. |
| App connection | A connection the agent holds in its own name: app-only with admin consent, or a workspace account signed in for it (Google Workspace or Microsoft Graph). |
| MCP credential | The agent's own credential for an MCP server, instead of the platform rule. |
| Agent token | A short-lived token the agent signs itself for each run; nothing is stored. |
Give this agent its own app connection chooses App-only (admin consent) or Workspace account sign-in and, for Google, the scopes the agent may use (sign-in and email address are always included). Akili warns when the account you sign in with is also your personal account. Runs as previews what each step will use before you save. Credentials can be rotated, revoked and, for organizations that require it, recertified; an organization table lists every credential an agent holds.
Identity
Every agent has a stable address and its own signing key. The Identity section shows the address, the key's age, Rotate key (the previous key stays published so tokens it signed keep verifying) and the Agent Card, which is public once the agent is visible to anyone, listed, or enabled for webchat. Revoking an agent's identity stops its card, receipts, token exchange and run tokens.
Capability readiness
Each capability in the builder carries a pill. Checking while Akili asks the platform; then Ready, Setup required or Restricted. The reason is written out so you know who can fix it:
- A platform administrator must enable this capability. (platform policy)
- Your organization has disabled Maps. Contact an organization administrator. (organization policy on Places)
- A platform administrator must check Maps configuration in Platform Health. (Places not configured)
- A platform administrator must bind an enabled image model to the image role. or The configured image model or provider credentials are unavailable. (Image Generation)
Skills attached to the agent show the same three states (Ready, Setup required, Blocked), since a skill cannot grant a capability the agent lacks.
The fetch allowlist
With Fetch web pages on, Fetch: allowed domains limits where the agent may read. Leave it empty to allow any public site. Add hostnames such as example.com or *.example.com (the wildcard covers subdomains), up to 50 entries. A URL outside the list is refused.
What your organization controls
- Connector policy. Servers the organization denies show {name} isn't allowed by your organization; a paused server shows Paused by your organization in the chat and in the composer indicator.
- Maps, web search and memory are organization policies; a capability they cover reads Restricted with the reason.
- Agent credentials need the Agent credentials permission to grant or revoke; others see View only.
Good to know
- If an upload sits at Not indexed: indexing is queued; give it a moment. If it turns Failed, remove and re-upload.
- If the agent cites nothing: check that the files are Indexed and that a linked base shows documents ready; in the webchat inbox, Needs review runs a knowledge check that tells you whether anything matched.
- If you export the agent: the zip includes the knowledge files but not credentials, connected servers or mandates.
- If you deploy the agent on a website: webchat visitors are anonymous unless the channel verifies their identity, and they never connect accounts of their own; see Share and publish an agent.
Frequently asked questions
Should I upload files to the agent or link a knowledge base?
Upload when the documents belong to this agent alone. Link a knowledge base when several agents or chats should share the same documents, or when you need the Knowledge page's tools: URL ingestion, reindexing and search. An agent can do both at once.
Whose account does the agent use when it calls an app?
By default the person chatting: a server with per-user OAuth asks each user to connect their own account, and anyone without one sees a connect prompt. Run for everyone who uses this agent makes every user call the server with your key instead. With a plan that includes own credentials, the agent can hold a credential in its own name.
Why does a server I connected not appear in the agent?
Only servers you enabled under Settings appear under Connected servers; add or enable it there first, then link it. A server your organization's connector policy denies shows that it is not allowed, and a paused one shows Paused by your organization.
What happens when the agent fetches a URL outside the allowlist?
The fetch is refused and the model is told so; it answers without the page. Leave the allowlist empty to allow any public site, or add hostnames (a wildcard such as *.example.com covers subdomains).