How StackTether works
An AI app sends StackTether a tool request on behalf of a signed-in tech. StackTether checks who the tech is and what they may use, reads your vendor system with your own API credentials, filters the result, logs the call and returns a short answer. StackTether does not keep the records it reads.
MCP in plain language
MCP (Model Context Protocol) is an open standard that lets AI apps call outside tools. A tool is a small, named action with a fixed set of inputs, such as "search tickets for this client". When you add StackTether to an AI app as a connector, the app learns the list of StackTether tools and decides when to call them while answering a question.
StackTether is a remote MCP server: it runs in the cloud at one address, so nobody installs anything on their computer, and every call goes through the same checks.
What happens when a tech asks a question
- The tech asks their AI app a question, such as "what's open for this client?".
- The AI app calls a StackTether tool, such as
psa_search_tickets, with a short-lived access token for that tech. - StackTether verifies the token (signature, issuer, audience, age under 15 minutes) and looks up the tech's MSP, role and allowed apps in the database. The MSP is never taken from the request itself.
- StackTether checks the safeguards: the app is allowed, the tech has access to that system, call budgets are not used up, the network is allowed and no kill switch is on.
- StackTether reads the MSP's API credentials from the vault and calls the vendor's API (read-only).
- The result is filtered by the data policy (sensitive fields never leave the vendor's answer), shortened, and marked as data rather than instructions.
- One audit entry is written with the tool, person, app, time, outcome and record IDs. If it cannot be written, no answer is returned.
- The AI app receives the answer and writes its reply to the tech.
Connecting an AI app: OAuth consent
StackTether uses OAuth 2.1, the same sign-in standard used by large software platforms, so no password or API key is ever pasted into an AI app. The tech pastes StackTether's connector address into the AI app, the app opens StackTether's approval page, and the tech signs in with password and 2FA and approves that app by name. The app then gets tokens that work only for that tech, last 15 minutes each and are renewed in the background until the approval ends.
StackTether only accepts AI apps on its approved list, and only those an admin of the MSP has switched on. Every approval can be revoked by the tech or an admin at any time.
Tenant isolation
Each business on StackTether is a tenant. Every table that holds tenant data has Row Level Security in the database, so a query can only ever return the signed-in user's own tenant rows, and the database also requires a 2FA-verified session. Tests run on every change prove that one tenant cannot read another's data. No tool accepts a tenant, account or credential as an input, so an AI app cannot ask for another business's data even if it tries.
What StackTether stores, and what it never stores
| Stored | Never stored |
|---|---|
| Your team's accounts, roles and 2FA enrolment | Ticket text, notes or other record content read from your systems |
| Vendor API credentials, encrypted in a vault | Credentials in logs, error messages or AI answers |
| Which systems each member may use and which AI apps are allowed | The questions techs type into their AI app or the AI's replies |
| Audit entries: tool, person, app, time, network address, outcome, record IDs | Copies of your PSA's data |
The AI app you choose does receive the answers StackTether returns, and its own data rules apply to your conversations. Pick the AI app and plan that match your clients' requirements.
Where it runs
The portal and MCP server run on Vercel and the database on Supabase, both in the United States (US East). Email notices are sent through a transactional email service. The full list is on the subprocessors page.
Questions about how it works
- Do my techs need an API key for the PSA?
- No. An admin connects one API user for the MSP in the portal. Techs only sign in to StackTether with their own account and 2FA.
- What is the connector address?
- It is the web address of StackTether's MCP server. The portal shows it with a copy button and step-by-step instructions for each AI app.
- Does StackTether use my data to train AI models?
- No. StackTether does not train models. What the AI app does with conversations is set by that app's plan and settings.
Next: security in detail or supported AI apps.