Docs · Connect your tools
Connect your tools to StackWeaver
Before you connect anything, you should be able to see exactly what StackWeaver reads, what access it asks for, and what you control. These pages say that in plain words, one tool at a time. A check result is evidence of what the tool returned at a certain time, nothing more.
Last reviewed: 6 November 2026 · Describes what is live in production on that date. A result is evidence of what the provider returned at a time, nothing more.
Connectors live today
Only connectors that are live in production are documented here (status as of 16 October 2026; Microsoft Entra ID: confirmed 20 October 2026; Google Workspace: confirmed 31 October 2026; Cloudflare: confirmed 1 November 2026; GitLab: confirmed 1 November 2026; Jira Cloud and Linear: confirmed 1 November 2026; Slack: confirmed 1 November 2026; Youverify: confirmed 6 November 2026; Smile ID: confirmed 6 November 2026; Prembly: confirmed 6 November 2026; Deel: confirmed 6 November 2026; Snyk: confirmed 6 November 2026; PagerDuty: confirmed 6 November 2026; Opsgenie: confirmed 6 November 2026; Bitwarden: confirmed 6 November 2026; Supabase: confirmed 6 November 2026; Confluence: confirmed 6 November 2026).
| Connector | What it reads | Guide |
|---|---|---|
| GitHub | Branch protection, required reviews, required status checks, force-push and deletion blocking, secret scanning status and Dependabot alerts, per repository you choose. | Connect GitHub |
| Okta | Whether every active user has an MFA factor, whether password policies meet a basic bar, and whether single sign-on apps are set up. | Connect Okta |
| Microsoft Entra ID | MFA registration, Conditional Access, legacy sign-in, privileged roles, just-in-time access, stale accounts and sign-in log retention, read through Microsoft Graph after an administrator of your tenant approves StackWeaver's read-only app. | Connect Microsoft Entra ID |
| Microsoft Azure | One subscription's storage, Defender for Cloud plans, network rules, Key Vault and activity log, read through the Azure management API after an administrator approves StackWeaver's app and gives it the built-in Reader role. | Connect Microsoft Azure |
| Google Workspace | 2-step verification enrolment and enforcement, the number of super administrators, suspended and archived accounts, and accounts with no recent sign-in, read through the Admin SDK Directory API. Two ways to connect: a super administrator approves one read-only permission on Google's own page, or pastes a service account key with domain-wide delegation. | Connect Google Workspace |
| Jamf Pro | Computer inventory — disk encryption, macOS version, last contact and managed status — read with a single read-only API privilege you create. | Connect Jamf Pro |
| Cloudflare | WAF managed rules, minimum TLS version, Always Use HTTPS, DNSSEC, whether admin hostnames sit behind Cloudflare Access, audit-log availability, and account members' two-factor status, read through a read-only API token you create. | Connect Cloudflare |
| GitLab | Default-branch protection, required merge approvals, whether merges are blocked unless the pipeline succeeds, force-push blocking, and open critical/high vulnerability counts, read through a pasted Project or Personal Access Token. Works against gitlab.com or a self-hosted instance. | Connect GitLab |
| Jira Cloud | Issues in one project labelled with a control id: which controls have linked issues, whether open issues are within their deadline, and whether they have an owner. | Connect Jira Cloud |
| Linear | Issues in one team labelled with a control id: which controls have linked issues, whether open issues are within their deadline, and whether they have an owner. | Connect Linear |
| Slack | How many members have two-factor authentication on, how many are owners or admins, how many guest accounts exist, and how many accounts are deactivated, read through a one-click, read-only approval. | Connect Slack |
| Amazon Web Services | Root account MFA, console-user MFA, multi-region CloudTrail logging, and S3 default encryption, read through a read-only IAM credential you create: access keys, or a role StackWeaver assumes. | Connect Amazon Web Services |
| Google Cloud Platform | IAM policy bindings open to the public internet, open firewall rules, public Cloud Storage buckets, and audit logging configuration for one project you choose, read through a read-only service account you create. | Connect Google Cloud Platform |
| Youverify | Confirms your secret key is valid and reachable by listing the verification document types available on your account, read through a read-only API key you create. Does not yet perform or evidence a real identity verification. | Connect Youverify |
| Smile ID | Confirms your partner id and secret key are valid and reachable by listing the document types your account supports, read through a read-only credential you create. Does not yet perform or evidence a real identity verification. | Connect Smile ID |
| Prembly | Confirms your secret key is valid and reachable by reading your organisation's wallet, through a read-only credential you create. Does not yet perform or evidence a real identity verification. | Connect Prembly |
| Deel | Confirms your API token is valid and reachable by reading your organisation's contracts list — only the count is read, never a worker's name, pay or contract detail — through a token you create, for either Deel's sandbox or production environment. | Connect Deel |
| Snyk | Confirms your API token is valid and reachable by reading your own account information, through a token you create. Never touches project, scan or vulnerability data. | Connect Snyk |
| PagerDuty | Confirms your API key is valid and reachable by reading your account's plan features, through a key you create. Never touches an incident, schedule or person. | Connect PagerDuty |
| Opsgenie | Confirms your API key is valid and reachable by reading your account's own info, through a key you create, for either the default or the EU instance. Never touches an alert, incident or schedule. | Connect Opsgenie |
| Bitwarden | Confirms your organisation API credential is valid and reachable by reading the names of your collections, through an organisation API key you create (Teams or Enterprise plan required). Never reads an individual vault item. | Connect Bitwarden |
| Supabase | Confirms your project's secret API key is valid and reachable by reading the project's Data API root, through a key you already have. Never reads a table's rows or any application data. | Connect Supabase |
| Confluence | Confirms the approval is still valid by reading the list of spaces on your Confluence site, through a one-click, read-only approval that reuses the same app as Jira. Never reads a page's title or content. | Connect Confluence |
How StackWeaver connects
- Read-only. The collectors read settings; they do not change them. The GitHub collector only sends GET requests (source).
- On the provider's own page. For GitHub you approve and choose repositories on GitHub's own page; nothing is typed into StackWeaver (how it works). Okta connects with a read-only API token that you create in Okta; the Okta guide explains why and how.
- Disconnect at any time. Each guide says how to disconnect in StackWeaver and how to revoke access at the provider.
- Evidence, kept as returned. Every result is kept as an Evidence Object with a SHA-256 fingerprint, including results that fail (platform). GitHub results keep the exact GitHub response. Okta results keep counts and Okta ids only, never logins, e-mail addresses or names (Okta guide).
- Credentials stay in an encrypted vault, never in browser code (platform).
What this is not
StackWeaver does not issue certifications, and does not say a company has passed an audit; a named reviewer decides (editorial policy). A result such as Pass means only that the provider returned a matching setting when StackWeaver looked.
Need help?
Write to us through the contact page. For how StackWeaver handles data, see the privacy policy and security page.
Sources and method
Statements about GitHub and Okta link to their own documentation. Statements about StackWeaver link to the page that says them, or are recorded in a claims ledger with the file in StackWeaver's repository that they come from. See oureditorial policy. Spotted an error? Use the contact page.