Connector or browser? How to pick the right route for every Grok Bot task

Pick a connector when one exists and it can perform the exact action your task needs. Use the browser on the Bot's computer only for services without a connector, visual checks, or screens the connector does not expose. The official docs say a connector is usually the more reliable route. Clicking through a website is the fallback.

At a glance#

Table reflects the docs and Cursor's help as of October 25, 2026. We have not verified any individual connector's current action coverage.

Where connectors come from#

You install plugins from Connect Apps, the in-app section that replaced Marketplace in version 0.67.0, or straight from a Connect card that appears in chat. On desktop you can attach a plugin to a single request by typing @.

Custom MCP servers and the known plugin issues live in our plugins, connectors and MCP guide. If you are wiring up mail or calendar specifically, start with the Gmail and Google Workspace guide.

October releases tilted the default toward connectors#

Three releases this month make the connector route easier to choose and harder to miss.

• 0.71.2 (October 14): connector calls wait up to two minutes instead of timing out after one, and longer while the connector reports progress.
• 0.75.2 (October 22): name a service and the Bot shows that connector's connect card in its first reply. A connector that signs you out or rejects a sign-in now explains why and how to fix it.
• 0.75.5 (October 23): when the Bot hands you its computer to sign in to a site that has a connector, it also offers that connector's card.

The browser route moved too. Vault, also new in 0.75.5, lets a Bot sign in with a login you saved under Settings → Vault. Cursor's help says the Bot never sees the saved password. But every Bot on your account can use every saved login, so a Vault entry widens the shared browser exactly as a manual sign-in does.

If you run with Route traffic through this computer turned on, Settings now counts sites blocked because they resolve to a private or VPN address.

Our take: when a site offers a connector, use it. A connector keeps your sign-in as a token on Cursor's backend instead of a live session on a computer every Bot shares. See the shared computer guide for why that matters.

Decide by the operation, not the app#

An app having a connector does not mean the connector does your job. It may expose search but not the export, filter or historical records you need. Write the operation down first, in a full sentence, then test it.

Decision checklist#

1. State one read operation and its fields. Example: "List this account's open tickets with latest reply and timestamp."
2. Check the connector's listed actions and requested access. If the action is missing, the connector is the wrong tool for this step.
3. Authorize the smallest account and scope that covers a pilot run.
4. Run a small read and compare it record-by-record with the source app.
5. Only then consider the browser, and only for the gap. Specify account, filters, date range and a stopping point before any write.

The browser adds page state to every result: which account is selected, active filters, open dialogs, and which page of results is showing. Put those details in the task. Never assume the default screen is the right one.

A probe brief you can paste#

Authentication succeeding tells you little. The real test is whether the records and fields you need come back. Run this read-only probe before building anything on top of a connection.

Service and account: [service] / [account]

Goal: confirm you can read [records] with fields [field list] via the connector.

Scope: read only [small sample, e.g. 10 most recent].

Return: source links or IDs, filters applied, retrieval time, any missing fields.

Rules: do not create, edit, send or delete anything.

If the connector cannot do this, name the exact gap and propose the

smallest browser-based check that would cover it.

If a sign-in is needed, stop and ask me to complete it securely.

Pair it with our workflow brief template once the probe passes.

Keep an access note next to every workflow#

Write a four-line note beside the workflow: connection used, permitted action, account, last successful sample and its date. When someone later reports "it stopped working," you can narrow it to three questions. Did access expire? Did the connector's action coverage change? Did the source data move?

The note describes access. It never holds passwords or secret values.

Acceptance checks before you trust the workflow#

• The sample matches the source application.
• Every required field is present, or the gap is stated explicitly.
• It goes past the first page of results whenever completeness matters.
• There is a defined stop when sign-in or access is missing.

Common mistakes#

• Raising privileges to make a task pass. Find the missing action or record first. The permissions guide covers scoping.
• Treating "added" as "connected." Check the status before you schedule anything.
• Forgetting that browser sessions are shared. One sign-in on the Bot's computer is reachable by every Bot you own.

When a connection will not come up#

Symptom → Fix

• Plugin shows Needs auth or Disconnected → choose Authenticate (Authorize on mobile).
• Sign-in page was left half-finished → Reconnect on the plugin, or Reopen on the chat card.
• Need a second Gmail inbox → Gmail connects one mailbox at a time. Disconnect the current one, then authorize the next. Some plugins, Notion among them, support several accounts.
• Google sign-in refused → a Google Workspace admin must mark Grok as trusted. Nothing on the Grok Bot side fixes this.
• Plugin shows Disabled by team admin → your Cursor team admin switched it off; ask them.
• Work app behind Okta or other SSO → it signs in through a takeover on the Bot's computer, which makes it a browser session every Bot can reach.
• Zoom authorization error from the desktop app → a known issue in Cursor's help with no workaround yet.

Our take#

Treat the connector as the default and the browser as a scoped exception you justify per task. Probe with a read-only sample, write the access note, and never widen access to paper over a missing action. The October releases make connectors the path of least resistance; Vault is convenient, but remember it puts the login in reach of every Bot you own.

Frequently asked questions#

Should Grok Bot use a connector or the browser?#

Use a connector when one exists and it exposes the action your task needs, such as searching mail or posting to Slack. The official docs describe connectors as usually more reliable than clicking through a website. Switch to the browser on the Bot's computer for services with no connector, for visual checks like layouts and charts, or for screens the connector does not expose.

Can every Bot on my account use a plugin I install?#

Yes. An installed plugin and a browser sign-in are both available to every Bot on your account. Browser sessions persist on the shared computer, so any Bot can reach a site you signed in to. A teammate's Shared Bot, formerly called a Team Bot, asks before using your plugin.

What does Needs auth or Disconnected mean on a Grok Bot plugin?#

It means the plugin is added but not signed in. Choose Authenticate on desktop, or Authorize on mobile. If a sign-in page was left unfinished, retry with Reconnect on the plugin or Reopen on the chat card. Added does not mean signed in, so check the status before running a workflow.

Does the Bot see my password when it signs in with Vault?#

Cursor's help says the Bot never sees the saved password when it uses a login from Settings, Vault. The catch is scope: every Bot on your account can use every saved login. Since 0.75.5 the Bot tries Vault first, then a connected password manager, then asks you through a Secure Form.

Why can't Grok Bot connect to my Google Workspace account?#

If your Google Workspace admin has not marked Grok as trusted, Google sign-in can be refused until they do. This block comes from Google, not Grok Bot. Separately, if your Cursor team admin has turned a plugin off, it shows Disabled by team admin and you cannot enable it yourself.