Kindo MCP — Integrations Pipeline (Master Overview)
Last updated: 2026-07-08 · Ora · Living doc — reconciled against Kindo Linear (Teka team) + UsableMachines/mcp open PRs. 161 tickets, all accounted for. Merge = instant prod (catalog reconciler); catalog/** is CODEOWNERS-gated → Kindo core-eng merges.
Independently audited 2026-07-08 by two verification agents — completeness vs Linear (161/161 tickets, states reconciled) and PR states + collisions vs GitHub (merge-readiness verified live, duplicates confirmed). Corrections applied.
The pipeline
In Progress → In Review → Confirming (pre-merge) → PR merges → Ready for production → Kindo deploys → Test production (Teka prod-verifies) → Done
Definition of Done: a merge or local pass is not Done. Done = Kindo deploys to prod → Teka functionally tests → Teka flips it. The verified catalog flag is the skip-verification / Early-Access marker.
At a glance
State | Count | Meaning |
|---|---|---|
Done | 83 | ✅ shipped + prod-verified |
Test production | 6 | 🧪 deployed — awaiting Teka prod-verify |
Ready for production | 7 | 🚀 merged — awaiting Kindo deploy |
Confirming | 3 | ⚪ pre-merge |
In Review | 23 | 🔵 active PRs |
In Progress | 2 | 🛠️ active build |
Todo | 13 | 📋 queued |
Triage | 2 | 🔎 triage |
Backlog | 8 | 🗄️ backlog |
Blocked | 4 | 🚧 baton-gated |
Canceled | 7 | ⛔ closed |
Duplicate | 3 | ♻️ duplicate |
Total | 161 |
🔵 In Review — the merge lane
Ticket | Title | Pri | PR | Waiting on / next |
|---|---|---|---|---|
Integration: Cyera | 🟠 High | 🔑 Cyera API creds (~1mo in account-gathering) | ||
Integration: Yardi Revolve | 🟠 High | clearing review — 4 unresolved | ||
Integration: Splunk SOAR | 🟠 High | 🔑 Splunk SOAR creds | ||
Integration: Linksquares | 🔴 Urgent | ✅ ready — Kindo core-eng merge · Sonesta | ||
Secureframe | ⚪ Low | ✅ ready — Kindo core-eng merge | ||
Integration: Axonius | 🔴 Urgent | ✅ ready — Kindo core-eng merge | ||
Oracle integration development | 🟠 High | dedupe (close #570) → clear review; revived from Damien #203; Deloitte #1 | ||
Integration: Workday Financial Management | 🟠 High | 🔑 Deloitte Workday sandbox creds | ||
Box MCP: Node→Python port | 🟠 High | clearing review — 1 unresolved | ||
Dropbox MCP: Node→Python port | 🟠 High | rebase + core-eng merge (teja PR) | ||
Grafana MCP: Node→Python port | 🟠 High | ✅ ready — core-eng merge · self-hostable → we can verify | ||
Neo4j MCP: Node→Python port | 🟠 High | ✅ ready — core-eng merge · self-hostable → we can verify | ||
SailPoint MCP: Node→Python port | 🟠 High | ✅ ready — Kindo core-eng merge | ||
Tenable VM MCP: Node→Python port | 🟠 High | ✅ ready — Kindo core-eng merge | ||
Check Point Quantum/Smart-1 | 🟠 High | 🔑 Check Point Smart-1 creds · Deloitte | ||
Proofpoint Email Protection | 🔴 Urgent | 🏷️ skip-verify → ✅ core-eng merge, customer prod-validates · Wynn | ||
GitHub Dependabot/security alert tools | 🟠 High | 🔑 GitHub app | ||
Aikido Security connector | 🟡 Med | clearing review — 4 unresolved | ||
Salesforce off | 🟡 Med | 🏷️ skip-verify · rebase (#447 merged; #551 follow-up conflicting) | ||
Mirror Nango gate into create-remote-proxy | 🟡 Med | ⚠️ stale vs main — likely re-do, not merge | ||
Vanta compliance integration | 🟡 Med | ✅ ready — Kindo core-eng merge | ||
MS Teams getmeetingtranscript | 🟡 Med | 🔑 Teams admin-consent + license — OR merge-to-test (Aashman) | ||
Zendesk → per-customer API token | 🟠 High | ✅ ready — Kindo core-eng merge · verified · Arkose |
🛠️ In Progress
Ticket | Title | Pri | PR | Waiting on / next |
|---|---|---|---|---|
GitHub branch conflict-detection | 🟡 Med | dedupe (close #566) → clear review; #420 shipped editability | ||
Obsidian native-endpoint 401 | 🟠 High | dedupe (close #568) → clear review; fixed today; live E2E cred baton |
⚪ Confirming (pre-merge)
Ticket | Title | Pri | Waiting on / next |
|---|---|---|---|
Integration: Amazon S3 | 🟠 High | AWS migration stack (#330 unlanded) | |
Integration: AWS CloudWatch | 🟠 High | AWS migration stack (#330 unlanded) | |
Mattermost API research spike | 🟡 Med | Teka — spike in progress (agent) |
🚀 Ready for production — merged, awaiting Kindo deploy → Teka prod-verify
Ticket | Title | Pri | Waiting on / next |
|---|---|---|---|
Okta write/create actions | 🟠 High | Kindo deploy → Teka prod-verify | |
Saviynt EIC connector | 🟡 Med | Kindo deploy → Teka prod-verify | |
Swimlane 0-records fix | 🔴 Urgent | Kindo deploy → Teka prod-verify | |
SailPoint tool policies | 🔴 Urgent | Kindo deploy → Teka prod-verify | |
Azure DevOps WIQL | ⚪ Low | Kindo deploy → Teka prod-verify | |
SailPoint task polling | 🔴 Urgent | Kindo deploy → Teka prod-verify | |
Swimlane Reference fields | 🟠 High | Kindo deploy → Teka prod-verify |
🧪 Test production — deployed, awaiting Teka prod-verify → Done
Ticket | Title | Pri | Waiting on / next |
|---|---|---|---|
Integration: CyberArk | 🟠 High | 🔑 CyberArk creds | |
SailPoint ISC tool coverage | 🔴 Urgent | Teka prod-verify (creds) | |
MS hybrid app-permission auth | 🟡 Med | prod-test — needs registered Azure app (Teka has tenant) | |
Wiz schema fix | 🟡 Med | 🔑 Wiz tenant creds | |
Snyk | 🟠 High | 🔑 Enterprise Snyk org (REST API is Enterprise-only) | |
AWS Shield Advanced | 🟠 High | 🔑 AWS w/ Shield Advanced (~$3k/mo — impractical) |
🚧 Blocked — baton-gated
Ticket | Title | Pri | Waiting on / next |
|---|---|---|---|
Integration: MS Active Directory | 🔴 Urgent | 🔑 auth scope decision | |
Okta write-enable (Deloitte) | 🔴 Urgent | 🔑 Deloitte Okta admin grants | |
Outlook / O365 email send | 🟠 High | 🏷️ skip-verify · 🔑 Kindo mailbox upgrade | |
Veza | 🟠 High | paused — Veza public API portal-walled (#424) |
📋 Todo
Ticket | Title | Pri |
|---|---|---|
Mattermost suite (channel · admin UI · bot auth · ingestion · delivery) | 🟡 Med | |
Integration: Oracle Cloud (OCI) | 🟡 Med | |
MS app registration: publisher verification + progressive consent | 🟡 Med | |
GitHub OAuth fails on SMK deployments | 🟠 High | |
MS Fabric per-user token passthrough | 🟡 Med | |
GitHub OAuth missing | 🟡 Med | |
Public Kindo docs — Microsoft MCP + SharePoint | 🟡 Med | |
Linear MCP requires admin access to add | ⚪ Low | |
Armis MCP — add VIPR Pro (vuln prioritization/remediation) tools; extends TEK-109 | 🟡 Med |
🔎 Triage
Ticket | Title | Pri |
|---|---|---|
Upgrade fastmcp 3.2.4 → 3.4.2 monorepo-wide — building, [#572](https://github.com/UsableMachines/mcp/pull/572) | — | |
Outlook Email — Read/Search Inbox — scoping (agent) | 🟡 Med |
🗄️ Backlog
Ticket | Title | Pri |
|---|---|---|
Azure Infrastructure | 🟠 High | |
Microsoft 365 | 🟠 High | |
AWS Infrastructure | 🟠 High | |
Cofense Triage binary download → file library | ⚪ Low | |
Entra ID session revocation + password reset | 🟠 High | |
Large-file GitHub writes (content-by-reference) | 🟡 Med | |
Microsoft auth housekeeping (PR #339 follow-ups) | ⚪ Low | |
Entra sign-ins polish (PR #343 follow-ups) | ⚪ Low |
⭐ This session — 2026-07-08
Zendesk → switched to per-customer API-token (BASIC), validated E2E, verified. #564 (TEK-180); superseded the premature #563.
Doppler → validated E2E (full CRUD, self-cleaning), verified, Done. #573 (TEK-25).
Snyk → connect validated, but tools require Enterprise-tier REST API (Free/Team have none) — held Early-Access, documented (TEK-150).
Built today: Obsidian 401 fix (#569/TEK-177) · GitHub conflict-detection (#567/TEK-123) · Oracle HCM revived (#571/TEK-67) · fastmcp 3.4.2 upgrade (#572/TEK-169).
⚠️ Collision — confirmed byte-identical duplicates: fleet + doink-kindo opened the same PRs on TEK-123/177/67. Keep the Teka set [#567](https://github.com/UsableMachines/mcp/pull/567)/[#569](https://github.com/UsableMachines/mcp/pull/569)/[#571](https://github.com/UsableMachines/mcp/pull/571); close doink-kindo's [#566](https://github.com/UsableMachines/mcp/pull/566)/[#568](https://github.com/UsableMachines/mcp/pull/568)/[#570](https://github.com/UsableMachines/mcp/pull/570).
🛑 Batons — what we need from Kindo
1 · Core-eng merge clicks — ready NOW (tested / skip-verify / clean): #564 Zendesk (verified) · #573 Doppler (verified) · #514 Proofpoint (skip-verify) — plus the read-only ports/new-integrations verified-clean below (decision in §2).
2 · Merge decision — read-only integrations, clean + mergeable, Early-Access `verified:false`, not yet cred-tested: Secureframe #437 · Axonius #439 · LinkSquares #441 · Vanta #434 · SailPoint #446 · Tenable #445 · Grafana #449 · Neo4j #450. Ship as Early-Access now, or hold for cred-backed prod test? (Grafana/Neo4j self-hostable → Teka can verify.) (Yardi #440, Aikido #432, Box #443 still clearing review — not ready this moment.)
3 · Credentials to validate: Cyera #438 · Splunk-SOAR #534 · Workday #444 · Check Point #516 · Wiz (TEK-138) · CyberArk (TEK-16) · AWS Shield (TEK-152) · Enterprise Snyk org (TEK-150).
4 · Scope / consent grants: GitHub app security_events (#419) · Okta .manage for Deloitte (TEK-91) · Teams admin-consent + license (#549).
5 · Deploy + verify window: the 7 Ready-for-production tickets (Kindo prod deploy → Teka prod-test).
6 · Access: 1Password write access for Ora (guest-only today) · Kindo mailbox upgrade for Outlook send (TEK-97).
⭐ Up to us (Teka)
Dedupe the collision PRs — close doink-kindo's #566/#568/#570, keep the Teka set.
Finish clearing review on #440 Yardi, #432 Aikido, #443 Box.
Prod-verify Test-production items where testable (Doppler ✅ done); batch remaining as cred batons.
Rebase/redo the conflicting #551 salesforce follow-up + #404 skill-gate.
Mattermost spike (TEK-72) + Outlook-read scope (TEK-174) — agents running.
✅ Done — 83 completed
Snowflake · Rapid7 InsightVM (·Cloud) · Wazuh · Obsidian · Cyberhaven · FireHydrant · Freshservice · Confluence · GitHub Actions · Doppler · Dynatrace · Traceable (full suite, ~35 tickets) · Linear list_projects · Okta data · Guardicore (auth · toolset · refresh-token) · MS Graph risk-reset · Qualys · Monday.com · Google Docs/Drive ports · GitHub file-commit · Cofense E2E · PagerDuty · Slack ports · VirusTotal · Splunk error · ThreatConnect (·TQL) · MS cred passthrough · Armis · GDrive error-wrap · Outlook list-email · Entra sign-ins/orderby/tool-calls · Zabbix · Zendesk build (·polish) · Nagios · Cyble · SailPoint IAC · Doppler schema · Swimlane record-not-found · MS Fabric · Wiz headers/vuln · health-SHA · validator · Nango-rule revert · MS docs · Cyberhaven housekeeping.
(Full list with links: [Linear — Teka team](https://linear.app/kindo/team/TEK/active).)
⛔ Canceled (7) · ♻️ Duplicate (3)
Canceled: TEK-20 Vectra · TEK-22 Proofpoint(old) · TEK-34/TEK-48 Traceable · TEK-78 port-review · TEK-96 large-file · TEK-119 Armis. Duplicate: TEK-105 · TEK-115 · TEK-149.
Legend: 🔑 = credential/access baton · 🏷️ skip-verify = merge-without-full-test label · ✅ ready = mergeable + 0 unresolved + review-clean (verified live) · Pri 🔴 Urgent · 🟠 High · 🟡 Med · ⚪ Low. Every ticket + PR is a live link. Reconcile each session; bump the status-chip date.