Connections, MCP & Platform API

Critique v4.1 adds a connections layer on top of the model and agent keys you already save in Settings. This page is the user-facing guide; operators also need CRITIQUE_SECRETS_ENCRYPTION_KEY on the server before anyone can save connections or API keys.

Zapier vs MCP vs native (read this first)

Zapier (recommended)

For Slack, Jira, Sentry, Vercel, and most of your stack, use Zapier instead of pasting keys for each app in Critique. Combine Webhooks by Zapier with Critique crt_ API keys and MCP when agents need passport data.

Optional native Linear and Slack keys below are only for deep Critique Chat features (issue search, confirmed Slack posts).

Three ways to “connect” Critique

BYOK and BYOA stay on Settings. Linear and future integrations live under Connections so agents and chat can reuse the same encrypted credential store.

flowchart TB
  subgraph settings [Settings]
    BYOK[OpenRouter / Crof BYOK]
    BYOA[Cursor / Anthropic / OpenAI BYOA]
  end
  subgraph connections [Connections]
    Apps[Linear Slack Sentry …]
    CRT[crt_ API keys]
  end
  Chat[Critique Chat] --> BYOK
  Review[PR review] --> BYOK
  Fix[Queue fix agents] --> BYOA
  Chat --> Apps
  Agent[External agent MCP client] --> CRT
  CRT --> MCP["POST /api/mcp"]
  CRT --> REST["GET /api/v1/…"]

App connections (Linear and catalog)

Open Settings → Connections.

Linear (available now)

1. Create a Personal API key in Linear → Settings → API.
2. In Critique, open Linear → paste the key → Save.
3. Use Test connection to confirm Critique can reach Linear.
4. Toggle Enable for Chat (and other surfaces when they ship) so agents may call Linear-backed tools.

When Linear is connected and enabled for chat, Critique Chat can call searchIssuesAndRoadmap — search issues, see assignee context, and relate PR work to your roadmap without leaving the thread. See Chat tools.

Legacy Settings → Linear API key redirects to the same Linear card on the Connections page.

Slack (available now)

Connect with either:

1. Bot token (xoxb-…) from Slack API apps — needs chat:write (and channel access). Optional default channel (for example #eng-reviews).
2. Incoming webhook URL (https://hooks.slack.com/services/…) — fastest setup; posts to one channel only.

Use Test connection after save. When Slack is connected and Chat is enabled, Critique Chat can postToSlack — a confirmation card appears before anything is posted.

Other apps

Sentry, Jira, and Vercel are not configured as separate Connections cards — use Zapier or Control Board incident webhooks (Change control). See the connections roadmap.

Critique API keys

API keys authenticate as your Critique user to automation endpoints. They are not OpenRouter keys and not Linear keys.

1. Go to Settings → Connections → Critique API keys.
2. Name the key (for example Cursor MCP or CI bot) → Create.
3. Copy the full key once — it starts with crt_ and is only shown at creation.
4. Store it in your agent or secret manager; Critique stores only a hash and a short prefix.

Default scopes on new keys:

Browser session cookies also work on REST v1 routes when you are signed in (scopes are not enforced for session auth).

MCP server (v0)

Critique exposes an MCP-compatible JSON-RPC endpoint for external clients (Cursor, Claude Desktop, custom agents).

Tools

Example tools/call body (JSON-RPC):

{
  "jsonrpc": "2.0",
  "id": 1,
  "method": "tools/call",
  "params": {
    "name": "list_passports",
    "arguments": { "limit": 10 }
  }
}

Configure your MCP client with the Critique URL and a crt_ key. MCP does not replace GitHub App install — the repository must already be on an installation you control.

REST API v1 (read)

Read-only HTTP JSON for the same account. Use a crt_ key or an authenticated browser session.

Example:

curl -sS \
  -H "Authorization: Bearer crt_YOUR_KEY" \
  "https://critique.sh/api/v1/passports?limit=5"

Responses are no-store and scoped to installations linked to your user.

Dashboard integration hub

Dashboard → Overview includes an integrations section when you have GitHub connected: connection status, Linear issue previews, passport queue snippets, and a Manage connections link to /settings/connections. Use it as a control-room view alongside review runs and usage.

Security practices

• Treat crt_ keys like passwords — revoke in Connections if leaked.
• Use separate keys per agent or environment so revocation is surgical.
• Linear and other connection secrets are encrypted at rest; Critique never returns full secrets to the browser after save.
• MCP and REST act only within your Critique permissions — they cannot access another user’s repositories.

Related

• BYOK — OpenRouter / Crof model keys (Settings)
• BYOA — Cursor, Claude, Codex fix agents (Settings)
• Chat tools — including searchIssuesAndRoadmap
• Environment variables — v4.0 flags and v4.1 CRITIQUE_SECRETS_ENCRYPTION_KEY
• Change control — passports, incident webhooks