Add native MCP tabs alongside API tabs for 10 more vendors

docs.json

@@ -124,6 +124,7 @@
                   "product/admin/mcp-server/google-analytics-admin",
                   "product/admin/mcp-server/google-analytics",
                   "product/admin/mcp-server/google-drive",
+                  "product/admin/mcp-server/granola",
                   "product/admin/mcp-server/hubspot",
                   "product/admin/mcp-server/jira",
                   "product/admin/mcp-server/jira-service-management",
@@ -133,11 +134,13 @@
                   "product/admin/mcp-server/lucid",
                   "product/admin/mcp-server/metabase",
                   "product/admin/mcp-server/metronome",
+                  "product/admin/mcp-server/monday",
                   "product/admin/mcp-server/n8n",
                   "product/admin/mcp-server/notion",
                   "product/admin/mcp-server/okta",
                   "product/admin/mcp-server/opsgenie",
                   "product/admin/mcp-server/pagerduty",
+                  "product/admin/mcp-server/pylon",
                   "product/admin/mcp-server/ramp",
                   "product/admin/mcp-server/rapid7",
                   "product/admin/mcp-server/salesforce",

product/admin/mcp-server/granola.mdx

@@ -0,0 +1,158 @@
+---
+title: Set up the Granola MCP server
+description: Connect Granola to C1 through Granola's own hosted MCP server or the Granola API, then register the server and govern its tools.
+og:title: Set up the Granola MCP server
+og:description: Connect Granola to C1 through Granola's own hosted MCP server or the Granola API, then register the server and govern its tools.
+sidebarTitle: Granola
+---
+
+{/* Editor Refresh: 2026-07-24 */}
+
+<Note>
+**Activation required.** AI access management must be enabled for your tenant before you can use it. To get started, [contact the C1 support team](mailto:support@c1.ai) for a walkthrough.
+</Note>
+
+C1 can govern [Granola](https://www.granola.ai) — an AI meeting-notes app — access two ways. Both let your AI clients read from Granola through governed MCP tools, but they come from different places and appear as two separate entries in your MCP server catalog:
+
+- **Granola MCP** — listed as plain **Granola** in your catalog. C1 registers Granola's own hosted MCP server (`mcp.granola.ai`) as a downstream server C1 governs. Authentication is always per-user OAuth using dynamic client registration (DCR) — Granola's hosted MCP server doesn't support a bearer token or API key, so there's no integration to create in Granola first. Tool calls run with the connected user's own Granola access, scoped to their active workspace.
+- **Granola API** — C1 hosts its own MCP server that translates Granola's REST API into tools. Authentication is a single shared bearer token (a Granola API key), so every tool call reaches Granola as one identity.
+
+| | Granola MCP | Granola API |
+| :--- | :--- | :--- |
+| **Who hosts the MCP server** | Granola | C1 |
+| **Authentication** | Per-user OAuth with dynamic client registration (DCR) only — no bearer token or API key option | Bearer token (a Granola API key) only — no OAuth option |
+| **Access scoping** | The connected user's own Granola access, for their active workspace | Whatever notes the API key's access scope (personal and/or public notes) covers |
+| **Tool surface** | Granola's own meeting-notes tools: searching meeting history, browsing folders, listing meetings, and reading full notes | Granola's meeting-data REST endpoints, mapped to tools |
+| **Setup effort** | Register in C1 and authorize — nothing to create in Granola first | Generate a Granola API key first, then register it in C1 |
+
+Use the native **Granola MCP** option (listed as plain **Granola** in your catalog) if per-user OAuth is acceptable for your tenant and you want each user's tool calls attributed to them individually. Use **Granola API** if you need a single shared credential instead.
+
+<Tabs>
+
+<Tab title="Granola MCP">
+
+C1 registers as a client of Granola's own hosted MCP server ([Granola MCP](https://docs.granola.ai/help-center/sharing/integrations/mcp)) rather than translating Granola's REST API itself. Your users' AI clients still only ever see C1-governed MCP tools, but C1 proxies each tool call straight through to `mcp.granola.ai` under the connected user's authorized session, then returns the result. The tools available are exactly the ones Granola's own MCP server exposes — C1 doesn't reshape or add to them.
+
+## Before you begin
+
+- AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management).
+- Nothing to create in Granola ahead of time. This option only supports per-user OAuth with dynamic client registration — Granola's hosted MCP server doesn't offer a bearer token or API key mode, so there's no client ID, secret, or integration to register. Each user just needs a Granola account with access to the workspace whose notes they want tools to reach.
+
+<Note>
+In your MCP server catalog, this option is listed as **Granola** — distinct from the **Granola API** entry, which connects through C1's own MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant.
+</Note>
+
+## Set up per-user OAuth
+
+Per-user OAuth with dynamic client registration (DCR) is the only authentication method this option supports — there's no bearer token or API key fallback. Each user authorizes individually through their browser, signing in with the Granola account tied to their workspace, and C1 registers itself with Granola's authorization server automatically, so there's no app to create in Granola first (see Granola's [Granola MCP](https://docs.granola.ai/help-center/sharing/integrations/mcp#do-i-need-a-client-id-or-client-secret) documentation).
+
+<Steps>
+<Step>
+Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Granola** from the catalog.
+</Step>
+<Step>
+When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **OAuth2 — per-user passthrough** and enable **Use dynamic client registration**. There's no client ID or secret to enter.
+</Step>
+<Step>
+Save your changes. The first time a user calls a Granola tool from their AI client, they're redirected to sign in with their Granola account (if they aren't already) and approve the connection, then returned to C1.
+</Step>
+</Steps>
+
+## What access is granted
+
+Unlike the Granola API option, there are no separate capability toggles to configure. Once a user authorizes, tool calls run with that user's own Granola access, scoped to their active workspace and the note categories (personal and shared/public) they can already reach in Granola ([Granola MCP](https://docs.granola.ai/help-center/sharing/integrations/mcp#what-mcp-can-access)).
+
+## How Granola MCP credentials are shared
+
+This option only supports per-user OAuth — there's no shared, service-account, or bearer-token mode. Every tool call runs under the calling user's own Granola identity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage).
+
+## Discover and govern tools
+
+After you register the server, C1 runs tool discovery against Granola's MCP server. Discovered tools appear on the server's **Tools** tab and include Granola's meeting-notes search, folder browsing, meeting listing, and note-reading tools.
+
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+
+Before anyone can call a Granola tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
+
+<Note>
+Tool discovery runs even if authentication isn't complete yet, so seeing discovered tools doesn't confirm a user has authorized. You confirm access when an approved user successfully calls a Granola tool from their AI client.
+</Note>
+
+## Manage access to Granola MCP
+
+Because this option uses per-user OAuth, there's no shared secret in C1 to rotate. Granola's own published documentation ([Granola MCP](https://docs.granola.ai/help-center/sharing/integrations/mcp#claude-shows-no-tools-available)) doesn't describe a centralized, self-service page in Granola for listing or revoking individual MCP connections — the documented way to disconnect is from the connected AI client itself (for example, in Claude, opening the Granola connector's settings and choosing to disconnect it, then reconnecting to re-authorize). If your tenant needs a connection revoked and you can't do it from the AI client side, contact Granola support to confirm the current process, since this is an area where Granola's own controls may change.
+
+</Tab>
+
+<Tab title="Granola API">
+
+C1 hosts the Granola MCP server, so your users' AI clients only ever see MCP tools — they never call Granola directly. When an AI client calls one of these tools, C1 makes the matching request to Granola's REST API using the credentials you configure here, then returns the result to the AI client.
+
+Granola supports one authentication method for its API: a bearer token (a Granola API key). Every tool call reaches Granola as the same identity, so there's no per-user attribution on the Granola side.
+
+## Before you begin
+
+- AI access management must be enabled for your tenant. See [Enable AI access management](/product/admin/enable-ai-access-management).
+- You need access to generate a Granola API key. On Granola's Business plan, any workspace member can create a personal API key; on Granola's Enterprise plan, a workspace admin must first enable API key access for members before a key can be created. See Granola's [API documentation](https://docs.granola.ai/introduction#api-key-access-scopes).
+
+<Note>
+In your MCP server catalog, this option is listed as **Granola API** — distinct from the **Granola** entry, which connects to Granola's own hosted MCP server. If you don't see either, [contact the C1 support team](mailto:support@c1.ai) to enable it for your tenant.
+</Note>
+
+## Generate a Granola API key
+
+<Steps>
+<Step>
+In the Granola app, go to **Settings** > **Connectors** > **API keys**, then select **Create new key**.
+</Step>
+<Step>
+Choose the note access scope for the key — **personal notes**, **public notes** (workspace-visible and Team space content), or both — depending on what C1 should be able to read.
+</Step>
+<Step>
+Select **Generate API Key**, then copy the key. Treat it as a high-value credential; Granola API keys are bearer tokens and Granola won't show the full value again after you leave the page.
+</Step>
+</Steps>
+
+For a shared production setup, generate the key from a dedicated service-account workspace member so activity is attributable to C1 rather than a person.
+
+With your API key ready, register the server and provide it to C1:
+
+<Steps>
+<Step>
+Follow [Register an MCP server](/product/admin/mcp-servers#register-an-mcp-server) and select **Granola API** from the catalog.
+</Step>
+<Step>
+When you [configure authentication](/product/admin/mcp-servers#configure-authentication), choose **Bearer token** and paste your Granola API key.
+</Step>
+<Step>
+Save your changes. C1 starts a sync that discovers the tools the Granola API exposes.
+</Step>
+</Steps>
+
+## How Granola API credentials are shared
+
+Every user's tool calls use the one API key you provided, so Granola sees a single shared identity for all activity. C1 still attributes each call to the individual user in the [AI tool usage audit log](/product/admin/audit-ai-tool-usage).
+
+For how shared and per-user credentials work across MCP servers, see [Configure authentication](/product/admin/mcp-servers#configure-authentication).
+
+## Discover and govern tools
+
+After you register the server, C1 runs tool discovery against Granola. Discovered tools appear on the server's **Tools** tab.
+
+Each tool starts as either **Pending review** or automatically **Approved**, depending on the option chosen when the server was set up or your tenant's default tool settings in **AI** > **MCP** > **Settings**. See [Require tool approval](/product/admin/enable-ai-access-management#require-tool-approval) and [Default tool classification](/product/admin/enable-ai-access-management#default-tool-classification).
+
+Before anyone can call a Granola tool, it must be approved, added to a toolset, and bound to an access profile. Continue to [Govern tools and toolsets](/product/admin/tools-and-toolsets) to set this up.
+
+<Note>
+Tool discovery runs even if your credentials are incorrect, so seeing discovered tools doesn't confirm that authentication is working. You confirm your Granola API key when an approved user successfully calls a Granola tool from their AI client.
+</Note>
+
+## Manage your Granola API credentials
+
+- **Rotate the API key** by generating a new key in Granola (**Settings** > **Connectors** > **API keys**) and updating it on the server's authentication settings in C1.
+- **Revoke a key** from the same page in Granola. Once revoked, a key is permanently disabled and cannot be restored — generate a new one and update it in C1 to keep the integration working.
+- **Adjust access** by generating a new key with a different note access scope, since a key's scope is set when it's created.
+
+</Tab>
+
+</Tabs>