)
Last updated: November 9, 2026
What are Claude connectors? Claude connectors are links between Claude and your apps and services, built on the Model Context Protocol (MCP). They let Claude search your data and take actions in tools like Slack, Google Drive or Linear. You add them from the Connectors Directory or as custom connectors, and each one runs with the permissions of the person who connected it.
TL;DR: Key Takeaways
- Claude connectors are open to all users on web, desktop and mobile, and custom connectors work on 6 plan tiers, with Free limited to 1 (Claude Help Center, 2026).
- Claude inherits each person's permissions in the source app, but a custom connector with a shared credential reaches whatever that credential can access (Claude Help Center, 2026).
- Custom connectors are reached from Anthropic's cloud, not from your device, so your remote MCP server must be reachable over the public internet (Claude Help Center, 2026).
- Team and Enterprise owners can set each connector tool to 1 of 3 states: Always allow, Needs approval or Blocked, and that applies org-wide (Claude Help Center, 2026).
- Anthropic lists 8 interactive connectors today, including Asana, Figma, Slack and Canva, that render live apps inside the chat (Claude Help Center, 2026).
- A November 2, 2026 study ran 9,720 tool-poisoning tests across 12 agent frameworks. Attack success was 22.9%, and none of the 12 had an intentional defense (Shaikh and Montaruli, 2026).
At a glance: Claude connectors in one table
Quick Answer
How do you add a connector to Claude?
Open Customize, then Connectors, and click the plus button. Pick a connector from the directory, review what it can read and change, then sign in to the service. For your own server, choose Add, then Custom, then Web, and paste its remote MCP URL. Team and Enterprise owners must enable connectors first.
| Connector type | What it is | Who can use it | Main control |
|---|---|---|---|
| Directory connector | Pre-built remote MCP server listed in the Connectors Directory | All users, on Claude, Cowork, Claude Desktop and mobile | Per-connector tool permissions |
| Interactive connector | Directory connector that renders a live app in the chat | All users, marked with an Interactive badge | Owners can disable the rendering tool calls |
| Custom connector | Your own remote MCP server added by URL | Free (1 only), Pro, Max, Ultra, Team, Enterprise | Authentication settings and shared-credential risk |
How we researched
On November 9, 2026 we read the Claude Help Center articles on connectors and interactive connectors, the Claude Code MCP documentation and the MCP authorization specification (version 2026-07-28). For security we used a November 2026 study and a June 2026 Microsoft post. We found no named 2026 incident tied to a directory connector. We did not test connectors ourselves.
What are Claude connectors and how do they work?
Claude connectors let Claude reach your apps and services, retrieve data and act inside them. Each connector is an MCP server that Claude calls through tools. According to the Claude Help Center (2026), Claude inherits each person's permissions from the connected service. A connector cannot reach a file, channel or record that you cannot open yourself.
The exception: the same Help Center article says custom connectors that use a shared credential reach whatever that credential can access. An API key pasted into a connector gives every user the key's full access.
Connectors work across Claude, Claude Desktop, Claude Code and the API through the MCP Connector. Once an app is connected, Claude can also bring it into a chat on its own when it fits. If you are new to the protocol underneath, start with our guide to what an MCP server is.
Each directory entry shows its use cases, read and write capabilities and availability before you connect. Read it as your permission review.
)
Best Claude connectors to start with
The best Claude connectors are the ones that match work you already do daily and keep write access narrow. Anthropic names Slack, Google Drive, Gmail, Google Calendar, GitHub, Microsoft 365 and Linear in its connector documentation. Start with read-heavy ones, then add write tools one at a time.
We only list connectors that Anthropic documents on its own pages. We found no popularity ranking on Anthropic's pages, so this is a shortlist by use case, not a top 10.
| Connector | What Anthropic documents it for | Interactive? | Start with |
|---|---|---|---|
| Slack | Sending messages, and drafting and sending them in the chat | Yes | Drafting, with approval before sending |
| Google Drive | Searching your files | No | Read-only, block creating and editing |
| Gmail | Searching and summarizing email | No | Read-only, block sending |
| Linear | Creating and viewing issues | No | View issues, then allow creating |
| Asana | Managing tasks and project boards | Yes | Board views |
| Figma | Reviewing and annotating designs | Yes | Review before edits |
| Google Calendar, GitHub, Microsoft 365 | Documented in Claude Docs with their own requirements | Not listed | Read the connector page first |
The same Help Center article gives three restriction examples: Gmail search without sending, Google Drive reading without editing, and Linear viewing without creating issues. Use them as a first policy.
Interactive connectors (Amplitude, Asana, Box, Canva, Clay, Figma, Hex and Slack) render dashboards, task boards or design tools in the conversation. According to the Claude Help Center (2026), they run in sandboxed iframes with strict Content Security Policies, use auditable JSON-RPC messaging and cannot make purchases.
How to add Claude connectors on web, desktop, mobile and Claude Code
You add Claude connectors from the Connectors Directory in Customize, or from the plus menu in a chat under Manage connectors. Choose a connector, review its capabilities, click Connect and follow the sign-in prompts. Installing connectors on mobile is in beta, so use web or Claude Desktop for custom ones.
| Where | How to add | Notes |
|---|---|---|
| Claude on the web and Claude Desktop | Customize, Connectors, plus button, or Manage connectors in a chat | The main path for directory and custom connectors |
| Claude for iOS and Android | Same directory, installing is in beta | A service connected on web is available when you log in on mobile |
| Claude Code | claude mcp add --transport http <name> <url> | Any remote server in the directory can be added this way |
| Team and Enterprise | An Owner enables the connector first | Each person still authenticates |
After connecting, switch on the services you want per conversation from the plus menu. The Help Center says Auto tool loading is the default and suggests On demand if you have 10 or more connectors active.
For Claude Code, the documentation warns to verify that you trust each server before connecting it. It adds that servers fetching external content can expose you to prompt injection risk. Our guide to Claude Code and Cursor MCP security covers the developer side.
Custom connectors: add your own remote MCP server
A custom connector is a remote MCP server you register by URL. Go to Customize, Connectors, Add, Custom, Web, enter a name and the server URL, then review the authentication settings Claude detected. Because Anthropic's cloud makes the connection, the server must be publicly reachable, or you must allowlist Anthropic's IP ranges.
The setup screen asks three questions that decide your security posture:
- Authentication: Sign in now, Sign in when needed, or No sign in.
- OAuth client: Claude's published identity (recommended), Register automatically, or your own OAuth client.
- Request headers: fixed credentials such as API keys that Claude sends on every request.
Prefer OAuth over request headers. A fixed header is one credential for everyone, which is exactly the shared-credential case that bypasses per-user permissions.
The MCP specification (version 2026-07-28) sets the OAuth rules your server should follow. Authorization is optional in the protocol, but when it is used, servers must publish Protected Resource Metadata (RFC 9728). Clients must send the resource parameter (RFC 8707) and servers must validate the token audience. Tokens must not travel in the URL query string, and scopes should follow least privilege with step-up when more access is needed.
The specification also deprecates Dynamic Client Registration and prefers Client ID Metadata Documents. Our MCP authentication guide explains these flows in detail.
According to the Claude Help Center (2026), custom connectors connect Claude to services that Anthropic has not verified. Only connect servers from trusted organizations, and review the authentication permissions carefully.
Claude connectors for Team and Enterprise: admin controls
Team and Enterprise owners decide which Claude connectors exist in the organization and what they may do. An Owner or Primary Owner must enable a connector first, which makes it available but grants nobody access. Each person still authenticates, unless Enterprise-managed auth (beta) is used to authorize once for everyone.
| Control | Where | Default or limit |
|---|---|---|
| Enable a connector for the org | Organization settings, Connectors, Browse connectors | Owner or Primary Owner only |
| Tool permissions per connector | Customize, Connectors, Tool permissions | Always allow, Needs approval or Blocked, org-wide |
| Member connector requests | Organization settings, Connectors | On by default on Team, off by default on Enterprise |
| Verified-domain restriction | Enterprise plans | Blocks services on your domains from connecting to outside Claude accounts |
| Interactive rendering | Organization settings, Connectors | Owners can disable the tool calls that render the UI |
| Sharing chats that use connectors | Organization setting | Can be turned off |
| Enterprise-managed auth | Team and Enterprise, beta | Authorize once for the whole organization |
Tool permissions matter most. They are grouped by type, such as read-only tools and write or delete tools. Allow the read group, set writes to Needs approval and block deletes you do not need.
Two limits apply. Restricting an action in Claude only narrows access, because a person still needs the permission in the source system. And connected services process data under their own terms, possibly outside the United States.
Claude connectors security: what can go wrong
The main Claude connectors security risks are prompt injection through data a connector returns, poisoned tool descriptions, over-broad shared credentials and silent changes to an approved server. They are risks of MCP in general, and a connector is only as safe as the server behind it and the permissions you gave it.
| Risk | How it shows up with connectors | Control |
|---|---|---|
| Prompt injection via data | An email, ticket or document contains hidden instructions that Claude reads through a connector | Block write and send tools, require approval |
| Tool poisoning | A tool description tells the model to leak data or call another tool | Review servers, pin and re-approve on change |
| Silent definition change | An approved server updates a description after review | Re-approval and monitoring of tool lists |
| Shared credentials | A custom connector uses one API key for every user | Use OAuth, scope the key |
| Excess permissions | Write and delete tools allowed by default | Needs approval or Blocked per tool |
| Unreviewed custom servers | Anyone adds an unverified URL | Restrict who can add, use an allowlist |
The 2026 evidence is about MCP agents broadly, not about Claude connectors in particular. According to Shaikh and Montaruli (2026), a study of 9,720 tests found a 22.9% overall attack success rate across 12 frameworks and 18 models. In 12.1% of vulnerable cases a secret was verifiably leaked, and no framework had an intentional defense.
According to Microsoft (2026), a silent description update to an approved MCP server can make a finance agent forward invoice data. The company says it saw the pattern in 2026 against enterprise agents and names no victims. We found no named 2026 incident involving a Claude directory connector, so treat the risk as plausible but unproven for any single product.
Anthropic's guidance agrees: connect only trusted services, review requested access and disconnect what you no longer use. Our guides to MCP tool poisoning and the OWASP MCP Top 10 go deeper.
Security and governance: one control point for every connector
Native Claude controls stop at the Claude organization. They do not cover other agents, other clients or the MCP servers you run yourself. A gateway adds one policy point between agents and tools, so access, approvals and logs follow the same rules whichever client calls the server.
A custom connector is just a URL, so it can point at a gateway you control instead of straight at the server. That is where per-tool policy, identity and audit logs can live. NeuralTrust approaches it as a Runtime Security Mesh.
The Agent Gateway (TrustGate) forwards end-user identity through every hop and applies per-agent and per-tool RBAC. Its MCP Gateway lets you decide which tools each LLM or agent can access, restrict read and write operations and track which LLM accessed which tool. NeuralTrust offers 200+ pre-built MCP servers.
Agent Posture Management (TrustLens) helps inventory which agents and servers exist, and AI Red Teaming (TrustTest) tests whether the controls hold. On plans, the Free plan keeps logs for 7 days and Standard for 30, while OTel and SIEM integrations are Enterprise features.
For the audit side, read our MCP audit logging guide, and for approved servers see the MCP registry and allowlist guide.
Where should you start?
Start with read access on two or three Claude connectors, then widen. Decide who may connect services, set tool permissions before rollout, keep custom connectors on OAuth and review everything after the first month. Each stage is small enough to undo, which is the point of staging a rollout.
| Stage | Goal | Key actions |
|---|---|---|
| 1. Pilot | Learn the real usage | Enable 2 or 3 directory connectors, allow reads, set writes to Needs approval |
| 2. Policy | Make the rules explicit | Decide who can add custom connectors, require OAuth, ban shared keys, keep requests off or reviewed |
| 3. Extend | Add your own servers | Register custom connectors, scope them, route them through a gateway |
| 4. Review | Keep the inventory honest | Check connected services, disconnect unused ones, review logs and tool changes |
Connectors pair with skills and memory: see our guides to Claude Code skills and the MCP memory server. For hardening beyond Claude, use the MCP security best practices.
Conclusion
Claude connectors give Claude real reach into your tools, and that reach inherits your permissions, which is both the benefit and the risk. Add them from the directory, keep write tools on Needs approval and prefer OAuth to shared keys for custom connectors. Treat every server as a production dependency, and put a gateway in front of the ones you run so access and logs stay consistent.
Secure Claude Connectors in Production with NeuralTrust
Control which agents and users reach which MCP servers, with per-tool permissions and audit trails across every client, and stream them to your SIEM on the Enterprise plan.
)
Related Comparisons
- What Is an MCP Server?
- MCP Authentication
- MCP Security Best Practices
- Claude Code and Cursor MCP Security
FAQs about Claude Connectors
1. What are Claude connectors?
Claude connectors link Claude to your apps and services through MCP so it can retrieve data and take actions, such as creating a Linear issue or searching Google Drive. They run with the permissions of the person who connected them. You add them from the Connectors Directory or as custom connectors using a remote MCP server URL.
2. Are Claude connectors free?
Web connectors are available to all users on Claude, Cowork, Claude Desktop and mobile. Custom connectors are available on Free, Pro, Max, Ultra, Team and Enterprise plans, and Free users can add one. Each service also needs an active account of its own, so check each connector page for availability and requirements.
3. How do I add a custom connector to Claude?
Go to Customize, then Connectors, click Add, choose Custom and then Web. Enter a name and your remote MCP server URL, review the authentication Claude detected, and click Add. The server must be reachable over the public internet because Anthropic's cloud connects to it, or you must allowlist Anthropic's IP ranges.
4. Are Claude connectors safe?
Connectors encrypt data in transit and inherit your permissions, but they also let a model read data and act on it. Risks include prompt injection through returned data, poisoned tool descriptions and shared credentials. Limit write tools with Needs approval or Blocked, prefer OAuth, connect only trusted servers and monitor tool changes.
5. Can admins control which connectors Claude uses?
Yes. On Team and Enterprise plans, an Owner or Primary Owner enables connectors for the organization and can set each tool to Always allow, Needs approval or Blocked. Enterprise owners can also restrict verified-domain services to their own accounts and turn on member requests, which are off by default.
6. What is the difference between connectors and MCP servers?
An MCP server is the program that exposes tools through the Model Context Protocol. A connector is how Claude connects to one: pre-built in the directory, or custom with your URL. In Claude Code you add the same remote servers with the claude mcp add command.
About the Author
Roger Howroyd is Head of Global SEO and AI at NeuralTrust, where he leads the company's search strategy across SEO, AEO, GEO, and LLM optimization. He specializes in AI-powered search, content strategy, and SEM. Connect on LinkedIn.
NeuralTrust is the leading platform for securing and scaling AI agents. Named a Pioneer in the Gartner Emerging Market Quadrant for AI Application Security 2026, recognized across four Gartner Hype Cycle reports in 2026, and featured in the Gartner Market Guide for Guardian Agents 2026, the Gartner Market Guide for AI Gateways 2025 and the KuppingerCole Leadership Compass for Generative AI Defense 2025. Headquartered in Barcelona with offices in London and New York. ISO 27001 certified.
Sources
Accessed on November 9, 2026.
- Claude Help Center, "Use connectors to extend Claude's capabilities", 2026.
- Claude Help Center, "Use interactive connectors in Claude", 2026.
- Claude Code Docs, "Connect Claude Code to tools via MCP", 2026.
- Model Context Protocol, "Authorization" (spec version 2026-07-28), 2026.
- Shaikh and Montaruli, "MCP Tool Poisoning in Agentic AI Frameworks: A Cross-Framework Measurement Study", arXiv, November 2, 2026.
- Microsoft Defender Experts, Incident Response, "Securing AI agents: When AI tools move from reading to acting", Microsoft Security Blog, June 30, 2026.
)
)
)
)