The useful idea is control, not connector count
Corsair sits between an AI agent and the services it wants to use. Instead of handing an agent a Slack token, GitHub credential, or OAuth refresh token, an application registers typed plugins and exposes Corsair's operations. Credentials are resolved inside the service when a call runs. An MCP adapter gives an agent a small discovery and execution surface rather than flooding its context with every endpoint.
That boundary solves a real problem. Agents are useful precisely because they can read data and take action, but the same ability makes a misunderstood instruction dangerous. Corsair assigns each plugin one of four modes. Open allows everything, cautious allows reads and writes but asks approval for destructive calls, strict asks approval for writes and blocks destructive calls, and readonly blocks all mutations. Individual endpoint overrides can tighten the defaults.
The approval design is more substantial than a confirmation dialog. Arguments are frozen in a database record, requests expire, duplicate pending calls are deduplicated, and approval is single-use. A denied action is discarded. Multi-tenant mode scopes credentials, stored entities, and permission handling to a tenant ID. Those are sensible foundations for a SaaS product where one agent service acts for many customers.
A quick start that still owns infrastructure
The main README explains the product well but does not tell users how to install it. The documentation site supplies the missing detail. A basic GitHub integration installs corsair and @corsair-dev/github, creates a project in Corsair Hub, generates a key-encryption key, and stores Hub's API key and signing secret. The application then creates four Corsair tables, configures a database, mounts a handler, creates a connection link, and sends the user through authorization.
SQLite makes the evaluation path manageable. The guide includes migration SQL and alternatives for Postgres, Drizzle, and Prisma. Production setup is a different commitment. Teams must back up the encryption key because losing it makes stored credentials unreadable, separate development and production Hub keys, register delivery URLs, provision tenant accounts, configure each provider, and operate their own database. New plugins are code additions followed by deployment and provisioning. Removing one from code does not remove its stored rows.
Hub hosts OAuth connect, callback, and approval surfaces but does not store credentials. That is a useful compromise for teams willing to add Corsair's service to their authentication path. Manual mode is available when everything must remain on the team's domain, but it requires a connect page, OAuth callback route, and approval review page. This is genuinely self-hostable, not a one-switch local clone of Hub.
The plugin model is both the product and the risk
Corsair's repository contains 98 generated plugin overview pages and 110 package directories. Each service is installed as its own package, which keeps application dependencies and agent tools selective. Plugins can expose typed API operations, database entities, credentials, and signature-verified webhooks. The contribution guide asks authors to consider token refresh, account scope, schemas, persistence, and webhook tests rather than treating an integration as a thin HTTP wrapper.
That ambition creates a large review burden. The August queue is full of new integrations, registration fixes, webhook changes, and pull requests marked as needing a maintainer or failing a gate. A recently closed issue found a completed You.com plugin absent from three central registration points, so the package existed but core discovery did not know about it. Another open fix says the dedicated subscribe command omitted Google webhook plugins that another CLI route already supported. These are understandable problems in a fast-growing catalog, but they mean catalog presence is not enough evidence that every path works.
More important, open pull request 613 says the Notion webhook verification handler could overwrite an existing signing secret and printed that secret to logs. Pull request 629 says Telegram accepted webhook requests when no secret was configured, allowing a caller who knew the URL to insert or overwrite stored messages. Both proposed fixes add tests and fail-closed behavior. Until such changes are merged and released, security-conscious teams should audit the exact plugin source they plan to enable, especially webhook handlers.
MCP support is restrained in the right way
The Claude Code guide installs @corsair-dev/mcp, starts a local standard-input server, and registers it in .mcp.json. The agent checks setup, discovers operations, then executes a script. This avoids listing every integration method as a permanent MCP tool. Corsair also documents adapters for other agent SDKs and offers a CLI path.
The design reduces credential exposure, but it cannot make an agent safe by itself. Cautious mode still allows ordinary writes immediately, while strict mode blocks destructive actions rather than offering approval for them. Teams must classify endpoint risk correctly, choose overrides, secure the approval link and database, and ensure the agent cannot bypass Corsair through a separate direct SDK credential. Permission policy is useful defense in depth, not a substitute for application authorization.
Exceptional activity, limited stability evidence
The last push was August 11, 2026, and issues and pull requests were updated throughout the same day. GitHub's count of 117 open items combines both, and much of the visible traffic is contributor work on integrations. Adoption is strong for a repository created in October 2025, and maintainers are merging fixes and documentation improvements.
There is no latest GitHub release. The core package declares version 0.1.114, while an open pull request is flattening chat, workflow, and run APIs. That combination signals a project shipping frequently without the stable milestones many production buyers use to assess changes. Corsair is promising infrastructure with unusually good conceptual documentation, but infrastructure that governs credentials and writes deserves a slower trust decision. Use it first with a small plugin set, strict permissions, isolated test tenants, pinned versions, and direct review of every enabled authentication and webhook path.