App — Marketplace

Field	Value
Status	GA
Owner	@aphaiboon
Sidekick-accessible	—

What it is

The control panel for “which apps and integrations does my workspace use?” Two functions:

1. App toggles — turn CMMD apps on/off
2. Integration installs — connect external tools (Slack, Gmail, GitHub, Stripe, etc.) via Composio v3 sessions

App toggles

Some apps are built-in / always on (isFixed: true):

• Sidekick (the AI is the product)
• Brain
• Threads (under Sidekick section)
• Dashboard
• Feedback

All other apps can be toggled per workspace.

Integrations via Composio

Composio v3 sessions provide ~250 connectors. CMMD surfaces the top 20 for one-click install.

Integration	Status
Slack	GA
Google Workspace (Gmail, Calendar, Drive)	GA
GitHub	GA
Mercury	GA (internal)
Stripe	Beta
Microsoft 365	Planned
Notion (import)	Planned

Permissions / hardening

• Each integration requires explicit user auth (OAuth/SSO flow)
• Never authorize on user’s behalf — they must complete the auth themselves
• Forge security rules apply: npm run check:forge-security

Sidekick integration

• Sidekick can suggest installing an integration when relevant
• Cannot trigger install — user has to confirm
• Tool: suggest_integration (read-only)

Data model

Table	Purpose
marketplace_apps	App definitions
workspace_app_toggles	Per-workspace on/off state
composio_connections	OAuth tokens (encrypted)

Related incidents

• FM-015 — Admin cache invalidation gap (Marketplace toggle didn’t update sidebar)
• FM-016 — Non-deterministic app ordering (admin marketplace reorder bug)
• FM-017 — Composio webhook signature
• FM-034 — Composio appNames silently ignored

Related

• GTM → Partnerships — customer-facing integration narrative
• App — Sidekick — uses integration data as context
• App — Settings — Admin → Feature Flags