Connect a Warehouse (Optional)

Complete the tutorial with sample data first. When you have a warehouse with an MCP server, you can connect it to the analytics assistant and let each user sign in through their browser. That's what a connection is for. It's an MCP server the model reaches through tools, with auth that eve drives for you.

Vercel Connect is generally available. You can complete the tutorial with the sample dataset; Connect is only needed for the OAuth integration shown on this page.

Before you start

This integration needs:

• A warehouse account and a working MCP server for that warehouse, with its full endpoint URL. Connect manages credentials; it does not create a warehouse or turn a SQL database into an MCP server.
• Permission to authorize that server, with read-only access to the data you want the agent to query.
• A Vercel account and a linked project for Connect.
• An authenticated user on the eve session. Complete the route-auth setup in Ship it before trying per-user OAuth from a web app.

If you are working through the tutorial for the first time, keep run_sql and continue to Run analysis. You can add this integration later.

Register the connector

Run these commands from analytics-assistant/. Replace the example URL with your MCP server's actual endpoint, including its path:

npm install @vercel/connect
npx vercel@latest link
npx vercel@latest connect create "https://your-warehouse.example/mcp" --name warehouse

Follow the provider-specific registration prompts. Copy the connector UID returned by the CLI. The display name warehouse is not the connector UID. Attach the returned connector to this project, then pull the local environment:

npx vercel@latest connect attach "<returned-connector-uid>" --yes
npx vercel@latest env pull

vercel env pull provides VERCEL_OIDC_TOKEN for local requests to Connect. That token identifies your Vercel project; it does not sign an end user into the app. The steps below use the authenticated deployment from Ship it. The Connect reference covers service-specific setup and project attachments.

Declare the connection

Create agent/connections/warehouse.ts. Replace both the endpoint URL and connector UID below with the values you just configured:

import { connect } from "@vercel/connect/eve";
import { defineMcpClientConnection } from "eve/connections";

export default defineMcpClientConnection({
  url: "https://your-warehouse.example/mcp",
  description: "The team's data warehouse: run read-only SQL and list tables and columns.",
  auth: connect("<returned-connector-uid>"),
});

The filename registers the eve connection as "warehouse", with tools named warehouse__<tool>. This eve name is independent of the Connect connector UID. The remote server determines which tools exist; check its tool inventory and read-only permissions before using it.

connect("...") is user-scoped by default. Each end-user authorizes in their own browser, and eve resolves that user's token before a tool call. The eve channel's route auth must map the signed-in app user to principalType: "user". localDev(), a runtime token, or a placeholder guard cannot supply that identity; those sessions fail with reason: "principal_required" before OAuth starts. For a shared app credential, see app vs. user auth.

Deploy and try it

Deploy the updated app so the authenticated web app includes the new connection:

npx vercel@latest deploy

Open the new HTTPS preview URL, sign in with the credentials configured in Ship it, and create a new session. The tutorial's development server bypasses the browser login and uses localDev(); restarting npm run dev alone does not provide the user identity this connection requires.

From your authenticated web app, ask the agent to inspect the warehouse's available tables and then query a table you have access to. Use the server's schema rather than assuming it has the tutorial's orders and customers tables.

If the user has not authorized the connector, the turn parks and the channel shows a sign-in link. Complete authorization in the browser; after the callback succeeds, the turn resumes and retries the tool call. Later calls use the existing grant while it remains valid. See MCP connection troubleshooting if registration succeeds but the tool cannot connect.

The token never reaches the model

Right before each request to the MCP server, eve resolves the bearer and sends it as Authorization: Bearer <token>. The model sees tool names, descriptions, and results. The credential stays in the app runtime.

Gate the connection behind approval (approval: once()) or narrow which tools the model sees (tools.allow) when needed. See MCP connections.

→ Return to the tutorial: Run analysis

Learn more: MCP connections · Authentication