Every AI connector pitch says the same thing: ask your tools anything. Almost none of them answer the question a buyer with a finance system or a customer database actually has, which is what the connector is allowed to touch and what it can never change.
So we published the answer for our own product. Below is the read scope and the write exclusion for every live connector, generated from the catalog that ships inside CorpusIQ on 2 November 2026.
What the matrix contains
Four numbers, all countable rather than described:
- 42 live connectors.
- 193 named read scopes across them: specific object classes such as invoices, payouts, campaigns, or tables.
- 122 explicit exclusions, the operations each connector is blocked from performing.
- Zero source connectors with a write scope. Each of the 42 reads from a connected system, none of them can change it, and each carries at least one named exclusion. The only tools in CorpusIQ that accept writes are its own control-plane tools, which manage your CorpusIQ configuration and never write to a connected system.
Authentication splits two ways. 34 connectors use OAuth, so access is granted on the provider's own consent screen and revoked there. 8 use a read-only API key where the vendor does not offer a scoped OAuth grant.
Twelve of them, in full
| Connector | Access | What it reads | What it cannot do | |---|---|---|---| | QuickBooks | OAuth | Customers, vendors, and employees | Create or modify invoices in QuickBooks | | Shopify | OAuth | Orders, fulfillments, and refunds | Create, cancel, or fulfill orders | | Stripe | API key | Charges and payment status | Create charges or issue refunds | | HubSpot | OAuth | Contacts, companies, and deals | Create, update, or delete contacts, companies, or deals | | Gmail | OAuth | Email message bodies and thread history | Send, forward, or reply to emails | | Google Ads | OAuth | Ad accounts, campaigns, ad groups, and ads | Create, pause, or modify campaigns | | Klaviyo | OAuth | Email and SMS campaign metrics (sends, opens, clicks, conversions) | Send campaigns, schedule, or modify automations | | Airtable | OAuth | Bases the user has authorized via Airtable OAuth | Create, edit, or delete records | | PostgreSQL | OAuth | Tables, views, and columns the connection role is authorized for | INSERT, UPDATE, DELETE, or any write SQL | | Calendly | OAuth | Event types, durations, and availability rules | Create, modify, or cancel scheduled events | | Monday.com | API key | Boards and board structure | Create, move, or delete items | | eBay | OAuth | Active listings, item specifics, and inventory | Create, revise, or end listings |
The pattern holds across all 42. The read scope is narrow and named (orders, invoices, boards, campaigns), and the exclusion is the verb a buyer would worry about (send, refund, delete, modify, pause, fulfil).
Why the read scope is the number that matters
An assistant is only as safe as the surface it can reach. Three properties decide that surface:
- Breadth. How many object classes the connector can pull. A connector that reads invoices and payouts is a different risk from one that reads a single table.
- Direction. Whether it can change anything. Access limited to reads removes the whole class of failure where an agent acts on a stale instruction.
- Scope of grant. Whether access is limited to the account, store, or database the operator authorized, or to the entire tenant.
A connector that offers a write path is not automatically wrong. It is a different product decision, and the buyer deserves to see which one they are getting before connecting a ledger.
What this matrix does not measure
Access data is easy to overclaim, so the limits belong in the same document as the numbers.
- It does not measure answer quality, latency, or how well a connector survives an API change.
- It does not compare CorpusIQ against a competitor's coverage. Other vendors publish different scopes and different exclusions, and those should be read from their own documentation rather than inferred from ours.
- It is our catalog, which makes it a description of our implementation on one date, not an audit by a third party. That is exactly why the raw table is published as a file instead of asserted as a claim.
Reproduce it
The full table is at connector-read-scope-matrix.csv: one row per connector with its category, authentication method, every read scope joined, and every exclusion joined. It is plain CSV so a later version can be diffed against this one.
For the wider access model, the security page covers hosting, retention, and certification, and the connector directory lists each integration with its own permission block. The read-only MCP explainer covers why the architecture is built this way.
FAQ
Can an AI assistant write to my business tools through CorpusIQ?
No source connector can. The published matrix lists, per connector, the scopes it can read and the operations it cannot perform, and every entry carries at least one explicit exclusion. The only tools in CorpusIQ that accept writes are its own control-plane tools, which manage your CorpusIQ configuration and never write to a connected system. Write actions on your business data stay in the source tool.
How was this matrix produced?
It is generated from the connector catalog that ships with the product, not written by hand from memory. Each row names the read scopes the connector uses and the operations it is blocked from. The full table is published as a CSV next to this article.
Does the matrix prove answer quality or coverage versus other tools?
No, and it is not meant to. It measures access, meaning what a connector can reach and what it can never change. Coverage versus another product, answer accuracy, and latency are separate questions this table does not answer.
Does CorpusIQ store the data it reads?
Direct MCP does not retain raw customer files or full connector response payloads. Local AUDIT logs record raw query text and tool parameters plus bounded result summaries; the Azure Log Analytics workspace retains those logs for 30 days. Optional indexed search has a separate lifecycle. Authorized source context is sent to the selected AI client, whose plan and settings govern conversation handling.