---
title: 'flexkit plugins'
description: "Browse, install and connect a project's plugins, and list their tools, from the terminal."
---

# `flexkit plugins`

Manages the [plugins](/docs/integrations/plugins) of a project: browse the catalog, install a plugin, connect accounts and list the tools the agent can use with them. It does what Studio → AI → Plugins does.

Most subcommands need a user session: sign in with [`flexkit login`](/docs/cli/login). A project API token can run `ls` and `inspect`; the other subcommands, `tools` included, answer `A user session is required.` See [Roles](#roles).

## Synopsis

```bash
flexkit plugins <subcommand> [arguments] [options]
```

Without a subcommand, `flexkit plugins` runs `flexkit plugins ls`.

## `plugins ls`

Lists the plugins in use in the project: installed, or with at least one connected account. `--available` lists the catalog plugins you can add, and `--all` lists both.

```bash
flexkit plugins ls [--available | --all] [--json] [--project <id>]
```

The **STATUS** column shows `connected`, `needs_auth` (every account needs a new sign-in), `installed` (no account yet), `available` or `disabled`. **CONNECTS WITH** tells how an account is added: `sign-in` (OAuth in Studio), `token` or `credentials`.

### Examples

```bash
# List the plugins in use
flexkit plugins ls

# Browse the catalog
flexkit plugins ls --available

# Print the ids of plugins with a connected account
flexkit plugins ls --json | jq -r '.[] | select(.connections | length > 0) | .id'
```

## `plugins inspect`

Shows a plugin: version, how it connects, the scopes it supports, the accounts you can see, its skills and MCP servers, and the automations that use it. Alias: `get`.

```bash
flexkit plugins inspect <pluginId> [--json] [--project <id>]
```

### Examples

```bash
# Show the Gmail plugin
flexkit plugins inspect gmail

# Print the connected accounts as JSON
flexkit plugins inspect slack --json | jq '.plugin.connections'
```

## `plugins add`

Installs a catalog plugin in the project. When an owner disabled the plugin earlier, `add` enables it again. Aliases: `install`, `enable`.

```bash
flexkit plugins add <pluginId> [--json] [--project <id>]
```

Connecting an account also installs the plugin, so `add` is only needed to install one before anyone connects it.

### Examples

```bash
# Install the Shopify plugin
flexkit plugins add shopify

# Install it in another project
flexkit plugins add google-calendar --project abcdefghij
```

## `plugins rm`

Disables a plugin in the project. The agent, automations and MCP clients stop using it. Its accounts stay connected, so `flexkit plugins add` turns it back on; remove accounts with `flexkit plugins disconnect`. Aliases: `remove`, `disable`.

```bash
flexkit plugins rm <pluginId> [--yes] [--json] [--project <id>]
```

The command asks for confirmation. Pass `--yes` to skip the question; without a terminal it refuses to run unless you pass `--yes`.

### Examples

```bash
# Disable the Slack plugin
flexkit plugins rm slack

# Disable it from a script
flexkit plugins rm slack --yes
```

## `plugins connect`

Connects an account to a plugin. A **project** account is shared by everyone in the project; a **personal** account is yours, and the agent prefers it when it acts for you. `--scope` picks one; by default the CLI connects a project account when your role allows it, and a personal one otherwise.

```bash
flexkit plugins connect <pluginId> [--scope project|personal] [--api-token <value|@file|->] [--method <key>] [--set <key=value>]... [--reconnect <connectionId>] [--no-browser] [--no-wait] [--json] [--project <id>]
```

How an account is connected depends on the plugin:

- **Sign-in plugins** (Gmail, Google Calendar, Slack, HubSpot…) finish the provider's OAuth sign-in in Studio. The CLI opens the plugin's page in Studio; choose **Connect**, sign in, and the CLI prints the new account as soon as it appears. With `--no-browser`, or without a terminal, it prints the link instead of opening it. `--no-wait` returns right away.
- **Token plugins** take a token from the provider. Pass it with `--api-token` (inline, `@file`, or `-` to read stdin) or type it at the prompt; the input is masked.
- **Credentials plugins** (Shopify) take several fields. Pass them with `--set key=value`; missing required fields are prompted for. When the plugin offers several ways to connect, `--method` chooses one. `--set` values can also be `@file` or `-`. Run `flexkit plugins inspect <pluginId> --json` to see the fields (`.plugin.connect`).

Flexkit checks a token or credentials with the provider before saving them, and never returns them. `--reconnect <connectionId>` replaces the token or credentials of an existing account instead of adding one; reconnect a sign-in account from Studio.

### Examples

```bash
# Connect your own Gmail account (opens Studio)
flexkit plugins connect gmail --scope personal

# Connect a Shopify store with a Dev Dashboard app
flexkit plugins connect shopify --method client \
  --set shop=acme.myshopify.com --set clientId=4f1c0d7e9a2b --set clientSecret=@secret.txt

# Connect a legacy Shopify custom app token
flexkit plugins connect shopify --method token --set shop=acme.myshopify.com --set accessToken=-

# Pipe a token in from an environment variable
echo "$TINYBIRD_TOKEN" | flexkit plugins connect tinybird --api-token -
```

## `plugins disconnect`

Disconnects an account and revokes its stored credentials. Pass the plugin id, with `--connection` when it has several accounts (in a terminal the CLI asks which one), or pass the connection id itself.

```bash
flexkit plugins disconnect <pluginId|connectionId> [--connection <id>] [--yes] [--json] [--project <id>]
```

You can disconnect your personal accounts; project accounts need the owner or developer role.

### Examples

```bash
# Disconnect your Gmail account
flexkit plugins disconnect gmail

# Disconnect one of several Slack workspaces without a prompt
flexkit plugins disconnect slack --connection 6c2f1b0e-3d4a-4f7b-9a8e-1c2d3e4f5a6b --yes
```

## `plugins tools`

Lists the tools a plugin offers through one of your accounts, the same list the agent sees. **ACCESS** is `read` for tools the plugin marks read-only (they run without approval and on read-only MCP connections), `destructive` for tools marked destructive, and `write` otherwise.

```bash
flexkit plugins tools <pluginId> [--connection <id>] [--refresh] [--json] [--project <id>]
```

By default the CLI uses the account the agent would use: your primary personal account, else the primary project account. The list is cached; `--refresh` asks the provider again, for example after you changed the scopes of the provider app.

### Examples

```bash
# List the Gmail tools
flexkit plugins tools gmail

# Print the names of read-only tools
flexkit plugins tools hubspot --json | jq -r '.servers[].tools[] | select(.annotations.readOnlyHint) | .name'

# Refresh the list after changing app scopes
flexkit plugins tools shopify --refresh
```

## Options

| Option                          | Description                                                       |
| ------------------------------- | ----------------------------------------------------------------- |
| `--available`                   | `ls`: list catalog plugins that are not in use yet.               |
| `--all`                         | `ls`: list every catalog plugin.                                  |
| `--scope <project\|personal>`   | `connect`: connect a project or a personal account.               |
| `--api-token <value\|@file\|->` | `connect`: the token of a token plugin.                           |
| `--method <key>`                | `connect`: the credentials method when the plugin offers several. |
| `--set <key=value>`             | `connect`: one credentials field. Repeatable.                     |
| `--reconnect <connectionId>`    | `connect`: replace the token or credentials of this account.      |
| `--no-browser`                  | `connect`: print the Studio link instead of opening it.           |
| `--no-wait`                     | `connect`: don't wait for a sign-in to finish.                    |
| `--connection <id>`             | `disconnect`, `tools`: the account to use.                        |
| `--refresh`                     | `tools`: fetch the tool list from the provider.                   |
| `-y`, `--yes`                   | `rm`, `disconnect`: skip the confirmation.                        |
| `--json`                        | Print the result as JSON on stdout.                               |
| `-p`, `--project <id>`          | Project to use. Defaults to the [linked project](/docs/cli/link). |

You can also use all [global options](/docs/cli/global-options).

## Roles

| Action                                                          | Who can do it                                            |
| --------------------------------------------------------------- | -------------------------------------------------------- |
| `ls`, `inspect`, `tools`                                        | Every project member (`tools` with a user session only). |
| `add`, `rm`                                                     | Owners and developers.                                   |
| `connect --scope project`, disconnecting a project account      | Owners and developers.                                   |
| `connect --scope personal`, disconnecting your personal account | Every member, when the project allows personal accounts. |

With a project API token, `ls` and `inspect` work with the token's role but never as the member who created it: they show project accounts only. `tools` needs a user session, since listing an account's tools can renew its credentials and calls the provider. Installing, removing, connecting and disconnecting need a user session too.

## Common workflows

```bash
# Set up Shopify for the whole project from a CI job
flexkit plugins connect shopify --scope project --method client \
  --set shop="$SHOP_DOMAIN" --set clientId="$SHOPIFY_CLIENT_ID" --set clientSecret=- <<< "$SHOPIFY_CLIENT_SECRET"

# Check which plugins need a new sign-in
flexkit plugins ls --json | jq -r '.[] | select(.connections | any(.status == "needs_auth")) | .id'
```

The tools are also available to MCP clients through `list_plugin_tools` and `call_plugin_tool`; see [`flexkit mcp`](/docs/cli/mcp).


---

[View full sitemap](/docs/sitemap.md)