LLM Connectors

▶ Watch the setup — recorded in ChatGPT on the web, 1:40

1. Turn on Developer mode.

   Settings → Security and login — web only, hidden by default. On Business/Enterprise/Edu a workspace admin may need to enable it org-wide first.

2. Add Workerbee as a connector.

   Plugins page → + → name it Workerbee → paste https://mcp.workerbee.ai/api/v1/mcp. Leave authentication on OAuth — no API key/client secret to enter.

3. Connect your account.

   Click Connect, sign in/create account, approve access. One-time, lives in settings.

4. Ask your first question.

   Start a new conversation, enable Workerbee from the tools menu, and ask the same “who am I connected as?” question.

   Runs in ChatGPT web only, Pro/Plus/Business/Enterprise/Edu — not mobile, not the IDE extension (OpenAI’s limits, not Workerbee’s).

▶ Watch the setup — recorded in Gemini Enterprise, by a Google admin, 3:35

Admin-driven setup, then a per-user connect. Runs only in Gemini Enterprise, not the consumer Gemini app. Want custom HR agents and workflows with governance instead? See Gemini Enterprise for HR.

1. Allow custom MCP connectors.

   Google blocks them by default, so this comes first. Google Cloud console → Organization Policies → select your project → filter for “Disable custom MCP server connector for Gemini Enterprise” → Manage Policy → Override parent’s policy → add a rule with enforcement Off → Set Policy. Scope it to the one project; your organization’s default stays in place.

   Requires roles/orgpolicy.policyAdmin — not Project Owner, and not roles/recommender.orgPolicyAdmin, which looks similar but can’t change a policy. Skip this and step 3 fails with “Operation denied by org policy” quoting constraints/discoveryengine.managed.disableCustomMcpServerConnector. Google’s override guide

   Check it worked: the policy reads Not enforced.

2. Configure an identity provider.

   Gemini Enterprise → Settings → Authentication → Add identity provider for your location → Google Identity, mapped to lowercase email → Save changes. It is set per location, so pick the one your data store will live in. If you reach step 3 first, the banner “You must configure your access control settings before you continue” links to this same screen.

   Google Identity is right for almost everyone. Use Workforce Identity Federation (Entra ID, Okta, AD FS) only if you connect solely non-Google sources through an existing OIDC or SAML provider — changing providers later loses users’ chat history. Google’s identity provider guide

   Check it worked: Settings → Authentication lists Google Identity against the location you chose.

3. Add Workerbee as a custom MCP data store.

   Data stores → Create data store → Custom MCP Server → Add MCP server, leave authentication on OAuth 2.0, and fill in:

   MCP Server URL

   https://mcp.workerbee.ai/api/v1/mcpCopy

   Authorization URL

   https://mcp.workerbee.ai/api/v1/oauth/authorizeCopy

   Token URL

   https://mcp.workerbee.ai/api/v1/oauth/tokenCopy

   Client ID

   mcp_-dY3c0kGE8Mh1EYFSLtTz8ELXf-2Pwv8Copy

   Scopes

   mcpCopy

   Client Secret

   Leave empty

   Authorization URL Parameters

   Leave empty

   Enable PKCE Support

   Turn on — the form calls it optional; Workerbee requires it

   Use HTTP Basic Authentication

   Turn off — it is on by default

   Paste the server URL exactly, including /api/v1 and the trailing /mcp — the field’s hint suggests a bare host, which is wrong here. Then click Verify Auth, sign in to Workerbee and approve access.

   Three choices on this screen are permanent — changing one later means creating another store. Leave document-level access control off (Workerbee enforces its own per-user permissions), pick the Location of your data connector from the Multi-region list, and leave encryption on Google default encryption. If policy mandates customer-managed keys, register them under Settings → CMEK before creating the store, and pick us or eu rather than global. Google’s custom MCP guide

   Check it worked: Verify Auth succeeded, and the store’s status moves from Creating to Active.

4. Turn Workerbee’s tools on.

   Open the data store → Actions tab → Reload custom actions → select the tools → Enable actions. Every action is off by default, so a correct setup exposes no tools and reports no error. Reload again after Workerbee ships new tools.

   Check it worked: the Actions tab lists Workerbee’s tools (38 today) and shows them enabled.

5. Connect the data store to your app.

   In the app, open Connected data stores → Add existing data stores and select Workerbee. Until it is connected, the store is invisible to users.

   Check it worked: the data store’s Details tab lists your app under Connected apps, and Connector state shows Active.

6. Share the web app link.

   The app’s Overview dashboard has a Your Gemini Enterprise webapp is ready card — click Copy URL. The same card links to the Gemini Enterprise mobile app; send that too. No card? Integration → Enable the Web App → Copy.

   There is no general Gemini address that reaches your app, so send the link to everyone who needs Workerbee. Each person also needs roles/discoveryengine.agentspaceUser and a Gemini Enterprise seat.

   Check it worked: the link opens your app’s Gemini Enterprise chat, not the ordinary Gemini app.

7. Each user connects their own account.

   Open the web app link. In the prompt box, click the connectors button — the third icon in the toolbar, next to + and the tools icon; it has no label. Click Authorize next to Workerbee and approve access. Once connected, a toggle replaces the Authorize link — make sure the Workerbee toggle is on. Then ask:

   Copy

   Using Workerbee, who am I connected as?

   Check who you are connected as

   If you’re already signed in to Workerbee in this browser, Authorize connects that account without asking. Check the name the who-am-I prompt returns. If it’s wrong, open the connector menu, click the unlink icon next to Workerbee, sign out at workerbee.ai, and authorize again.

   Before each call Gemini shows an approval card like “Custom Mcp … Agent Whoami”, with Send and Cancel. That’s Workerbee — the number is your data store’s ID and the last words name the tool. Click Send.

   

   Nothing prompts you to connect, and the connection is per person, even after your admin has finished. Name Workerbee in your prompts: Gemini decides for itself which tools a question needs. Enabled actions are capped at 100 per data store.

If something doesn’t work

• A Workerbee call fails. Open the data store’s Details page: View logs shows the failing request, and Re-authenticate renews the connector’s authorization. Try those first.
• Gemini answers without Workerbee. Check the Workerbee toggle is on in the connectors menu (step 7), and that the Actions tab has tools enabled (step 4).
• Workerbee shows the wrong person. Unlink Workerbee in the connectors menu, sign out at workerbee.ai, and authorize again (step 7).
• You changed a setting and nothing happened. Google applies feature-control changes with a delay — the console says they “may take a few minutes to take effect”. Wait a few minutes before testing again.