The Swif connector for Grok connects Grok to your Swif tenant. Once it's connected, you can ask Grok about your organization's devices, employees, teams, and the apps and browser extensions installed across your fleet, in plain language. Grok answers with live data from Swif.
It works in Grok on the web and the Grok app for Mac, with the Macs, Windows, Linux, iOS, and Android devices you manage in Swif.
Grok Build, xAI's coding tool, uses a separate Swif plugin. It isn't available yet. This article covers Grok on the web and in the Mac app.
This connector is designed for IT and security teams that manage their devices with Swif.
Important: The connector can't change, lock, or wipe devices, or delete employees. For your organization's safety, the connector can only read device data, and its only changes are adding an employee or moving one to another team. Grok makes those changes only when you ask, and only after confirming the details with you. Only your organization's data is visible.
What you can do
Devices
List your devices, and filter them by team, operating system, or status
See the apps and browser extensions installed on a device
Find every device that has a given app installed
See whether each device is compliant, why it isn't, and how to fix it
Employees and teams
List your teams, and the employees on a team
Add an employee, after Grok confirms the details with you
Move an employee to another team, after Grok confirms the details with you. Their devices stay assigned to them.
What you can't do
Change device settings, or lock or wipe devices
Delete employees
Change policies or compliance settings. Grok shows how to fix a device, but you make the change in the Swif console.
Device compliance
Grok answers compliance questions with Swif's official verdict, the same one the Swif console shows. It doesn't guess from other details, such as whether a device is encrypted.
For each non-compliant device, Grok lists every reason, and Swif's steps to fix it. Reasons can be:
A built-in policy check failed, such as a missing screensaver lock policy
A compliance control isn't met, such as ENC-1 Full-Disk Encryption
A required app is missing, such as antivirus or a password manager. This applies only if your organization has turned on these checks, and only to computers.
No compliance status yet
A device can be non-compliant even when every policy check passes, for example if it fails a compliance control. It can also be compliant while an encryption policy shows as failing, if the device reports that it's encrypted. Either way, the verdict matches the Swif console.
Requirements
Requirement | Details |
Swif | A Swif UEM account |
Swif API key | Created in the Swif admin console. See Public APIs: your API key. |
Grok | Any Grok plan, on the web or in the Grok app for Mac |
Keep your API key secure. Anyone with it can read your organization's Swif data, and add or move employees.
Connect Swif to Grok
In Grok, click Connect apps, at the bottom of the sidebar.
Scroll to the bottom of the list, and click Add a custom connector.
Fill in:
Name: Swif
Type: Remote HTTPS
Server URL:
https://mcp.swifteam.com/mcp. For a Swif workspace in the EU region, usehttps://mcp.eu.swifteam.com/mcp.HTTP headers: Leave empty
Client ID: Leave empty
Click Add plugin.
Sign in when Grok asks. On the Swif connection page, enter your Swif API key, accept the agreement, and approve the connection. It's the same page Claude and ChatGPT use.
Swif appears in Grok's sidebar. Open it, and ask a question about your devices.
You only enter your API key once. The connection stays signed in, even after a long break.
Use the right server URL. The Server URL must match your Swif region. A workspace in the EU region can't connect through mcp.swifteam.com.
Example questions
Devices
"Which devices aren't compliant, and why?"
"How do I fix Alex's laptop so it's compliant?"
"List my Swif devices."
"How many devices are in the team named exactly 'Engineering'?"
"Break down the devices in the Sales team by operating system."
Apps and extensions
"Which devices have Microsoft Teams installed?"
"What apps are installed on WIN-ABC123?"
"What browser extensions are on Alex's laptop?"
Employees and teams
"List all teams in my Swif organization."
"List all employees in the team named exactly 'Engineering'."
"Add Jordan Lee, jordan@example.com, to the Sales team."
"Move Alex to the Marketing team."
Tips for better answers
Use exact team names. For example, "the team named exactly 'QA'". If several teams share a name, Grok lists them, and asks which one you mean.
Ask for a summary first. For large fleets, Grok gives a short summary, and offers the full list.
What data Grok can see
Data | Details |
Devices | Name, operating system, owner, team, and status |
Compliance | Each device's compliance verdict, the reasons it isn't compliant, and how to fix them |
Apps | Apps and versions installed on each device |
Browser extensions | Extensions installed in Chrome, Edge, Firefox, and Safari |
Employees | Name, email, status, and team |
Teams | Team names and IDs |
How Grok handles results
Active, enrolled devices: device lists include only active, enrolled devices, unless you ask for all of them. So Grok's count can be lower than the Swif console's, which also includes unenrolled and archived devices.
Large results: Grok reads results in pages, so it can cover your whole fleet.
Missing data: if a device hasn't reported its installed apps, app searches can't find apps on it.
Built-in safeguards
Safeguard | What happens |
Confirms before changes | Grok confirms the details before it adds or moves an employee |
Asks when a name matches several teams | Grok lists the matching teams, and asks which one you mean, instead of guessing |
No duplicate employees | If an employee with that email already exists, Grok doesn't add them again |
No made-up data | Grok won't invent employees. For example, if you ask for "5 random test employees", it asks for real names, emails, and teams. |
Secure sign-in | The connection uses OAuth with PKCE. Grok never sees your API key. It uses a sign-in token from Swif instead. |
Switch to another Swif tenant
If you manage more than one Swif tenant, such as an MSP:
In Grok, remove the Swif connector.
Add it again, and enter the other tenant's API key.
Grok then shows only the new tenant's data.
Disconnect Swif
In Grok, open Connect apps, and remove the Swif connector. Grok can no longer access your Swif data.
To stop all access immediately, you can also revoke the API key in the Swif admin console.
Troubleshooting
The connection page rejects my API key
Check that you copied the whole key, and that it hasn't been revoked in the Swif admin console. Create a new key if needed.
Grok can't connect to Swif
Check the Server URL:
https://mcp.swifteam.com/mcp, orhttps://mcp.eu.swifteam.com/mcpfor the EU region.Check that Type is Remote HTTPS, and that HTTP headers and Client ID are empty.
Grok shows fewer devices than the Swif console
This is expected. Grok counts active, enrolled devices, unless you ask for all of them. The console also counts unenrolled and archived devices.
Grok asks which team I mean
Several teams share that name. Choose one from Grok's list, or use the exact team name.
A device is non-compliant, but every policy check passes
The device doesn't meet one of your organization's compliance controls, such as ENC-1 Full-Disk Encryption. Ask Grok why the device isn't compliant. It lists the control, and how to fix it.
Missing antivirus or a password manager isn't listed as a reason
These count only if your organization has turned on the antivirus or password manager checks, and only on computers.
Grok asked me to confirm before adding an employee
This is expected. Grok confirms the details before it makes any change in Swif.
An app search misses a device
The device hasn't reported its installed apps to Swif yet. Check the device's Apps tab in the Swif console.
A device setting or lock request doesn't work
This is expected. For your organization's safety, the connector can't change, lock, or wipe devices. Use the Swif console instead.
Related resources
Swif