Claude connectors: setup, types, permissions, and safe use

Key takeaways

Remote connector

connects Claude to a cloud or SaaS service over the internet and works across supported Claude surfaces.

Desktop extension

runs locally for files, localhost services, desktop apps, clipboard access, or local processes. It is limited to Claude Desktop and Claude Code.

Directory connector

reviewed by Anthropic for directory inclusion and easier to discover. Its source service still has its own terms and data handling.

Custom connector

a remote MCP server added by URL without Anthropic directory review. Trust and permission checks matter more.

Plugin

can package MCP connections with skills, commands, and subagents for Claude Code or Cowork.

Permission rule

a connector inherits the person's source-system access. Claude-side controls can narrow actions but cannot grant missing source access.

Safe default

start with one trusted connector, one low-risk task, read-only tools, focused context, explicit review, and a removal plan.

What do Claude connectors do?

Connectors expose defined tools and information to Claude. A read tool might search files, fetch an issue, or retrieve a calendar event. A write tool might create a task, update a record, or send a message. Some MCP Apps can render charts, maps, forms, task boards, or other interactive elements inside the conversation. The exact capability comes from the connector's server and the access you approve.

Search and retrieve

find source records without copying every file into a prompt.

Create and update

act on an approved service when its connector exposes write tools.

Use source context

ground a response in current project, customer, code, or communication data.

Display interaction

let an MCP App show a structured visual result inside Claude.

Support workflows

combine the connector with a skill, command, agent, or human review step.

What a connection does not guarantee

• The data is correct, complete, current, licensed, or suitable for the decision.
• Claude will select the intended tool, object, workspace, project, channel, or account every time.
• A write is reversible or that the source service has usable version history.
• Directory review replaces your security, privacy, legal, and vendor assessment.
• A local extension is automatically safer than a remote connector.
• The integration is available on every plan, region, account type, organization, or Claude surface.

Choose remote or local access

Start with where the system runs. Anthropic describes remote connectors as the default for cloud services. They work across Claude web, mobile, Cowork, Desktop, and Claude Code after connection. Desktop extensions fit tools that run on the computer or require operating-system access. They work only in Claude Desktop and Claude Code.

Cloud application

select a remote directory connector when an approved one exists.

Private cloud service with a public MCP endpoint

assess a custom remote connector and its authentication.

Local folder or desktop application

select a Desktop extension with the minimum allowed paths and capabilities.

Local database or development server

use a local MCP path only in a controlled environment.

Reusable Claude Code workflow

assess a plugin that bundles the connector with owned skills and commands.

Interactive result inside chat

confirm that the connector is an MCP App and supports the surface you use.

Compare remote connectors and Desktop extensions in Anthropic's current surface guide.

Directory and custom connectors are not the same

Both paths use the same remote MCP infrastructure, but review and distribution differ. Anthropic reviews directory connectors for its catalog. They can appear in search and in-chat suggestions. A custom connector is added by URL and receives no Anthropic directory review. The user or organization must establish the server owner, domain, authentication, tools, data use, support, and incident process.

• Check the named publisher and service domain, not only the connector display name.
• Read the capability page, tool list, help documentation, privacy policy, terms, and support route.
• Distinguish read, write, delete, external-link, and interactive capabilities.
• Confirm OAuth redirects and requested scopes on the service's own domain.
• Avoid credentials in a connector URL. Anthropic's connector documentation does not support tokens or API keys in query strings.
• Treat an externally shared custom-install link as a prefilled form that still needs review.

Review how Anthropic separates directory-listed and custom connectors.

How do you connect an app to Claude?

• Define one task first. Name the source data, needed action, responsible account, and acceptable result.
• Open Customize and then Connectors, or use the connector menu inside a conversation.
• Find the service in the directory. For a custom server, use Add custom connector only after checking its owner and URL.
• Read the connector page and requested capabilities. Note which tools can create, change, delete, send, or share data.
• Select Connect or Install, then authenticate on the expected service domain with the intended account.
• Grant the narrowest source-system role and scopes that support the task.
• Enable the connector for one conversation and begin with a read-only request against non-sensitive data.
• Ask Claude to name the source objects it found and propose any write before executing it.
• Verify the result in the source service, including workspace, owner, access, links, history, and side effects.
• Disconnect the service or reduce access when the task or pilot ends.

Follow Anthropic's current connector setup and management steps.

Check current availability before promising access

Anthropic's current Help Center says web connectors and Desktop extensions are available to all users. Its connector tutorial still says most connectors need Pro, Max, Team, or Enterprise. Individual listings can also require a particular source account, workspace role, plan, region, or administrator approval. Treat the directory listing and the account's visible connection flow as the current source for that connector.

Free accounts

verify the connector listing and current limits. Anthropic currently documents one custom connector for free users.

Organization plans

an Owner or Primary Owner must enable connectors before Team and Enterprise members use them.

Enterprise-managed authentication

currently documented as beta and can change the individual sign-in flow.

Mobile installation

currently documented as beta, with web and Desktop as the primary custom-connector setup paths.

Local access

Desktop extensions remain limited to Claude Desktop and Claude Code.

Control source access and Claude actions separately

A connector inherits the signed-in person's access in the source service. Claude cannot retrieve a file that account cannot view. Claude-side tool controls form another layer. Anthropic says Team and Enterprise owners can allow an action automatically, require approval, or block it. Those settings can remove an action, but they do not create source-system permission.

Source identity

use a named account with the correct team, tenant, workspace, and role.

Data scope

limit folders, repositories, channels, calendars, projects, tables, and records where the service supports it.

Tool scope

allow search and read first. Block create, update, delete, send, publish, invite, export, and external-link actions until tested.

Approval

require a person to review the exact target and payload for consequential writes.

Separation

do not use one broad administrator account for unrelated personal, client, and company work.

Revocation

remove both the Claude connection and the source-service OAuth grant when access is no longer needed.

Trace the connector data path

Connector data can pass through Claude, the connector operator, and the source service. Anthropic says transfers are encrypted, but third-party services process data on their own infrastructure and terms. Their location can differ from Claude inference settings. A US-only inference choice does not relocate a third-party connector's systems.

• Map which content leaves the source, which service processes it, where it is stored, and how long it remains.
• Review model-improvement, retention, logging, subprocessors, regional, deletion, and incident terms for each party.
• Keep secrets, credentials, regulated records, private keys, and unnecessary personal data out of a pilot.
• Account for Claude memory and prior conversation context when automatic connector suggestions are enabled.
• Use private projects and follow sharing limits for synced connector content on Team and Enterprise.
• Test disconnection and deletion before relying on the connector for sensitive work.

Keep connector context focused

Adding connectors can reduce focus when the task does not need them. They add tools, similar names, accounts, permissions, and retrieved content. Anthropic recommends considering On demand tool access when ten or more connectors are active. A smaller active set also makes review and failure diagnosis easier.

• Enable only the service needed for the current conversation.
• Name the account, workspace, project, channel, repository, folder, date range, and record type.
• Ask for a source list before synthesis and a change preview before any write.
• Separate found facts from Claude's interpretation and from your own assumptions.
• Require stable identifiers or direct source links for records that affect a decision.
• Start a clean conversation when old tools or context could influence a different task.

Pilot connectors with a team

• Select one bounded use case, one connector, one source tenant, and a small group of accountable users.
• Record the publisher, directory status, server URL, authentication, tools, scopes, data classes, subprocessors, support, and owner.
• Set source roles and Claude tool permissions. Keep write and delete tools blocked for the first read-only test.
• Build tests for correct record selection, missing access, ambiguous names, stale data, prompt injection, failed authentication, and partial writes.
• Observe source audit history, Claude results, connector errors, user corrections, latency, and unexpected tool selection.
• Approve only the workflows that pass. Publish instructions, prohibited data, escalation, disconnection, and incident steps.
• Review access on a schedule and after role, vendor, connector, directory, security, or policy changes.

Troubleshoot a connector that does not work

Not listed

confirm the product surface, plan, region, organization policy, and directory availability.

Authentication fails

verify the service account, OAuth domain, source permissions, cookies, and administrator approval. Then reconnect through settings.

Data is missing

check source access, object location, sync time, selected account, filters, and whether the connector supports that object type.

Write is blocked

inspect Claude tool permissions and source-system permission. Either layer can deny the action.

Custom server times out

a remote custom connector is reached from Anthropic's cloud, even when Claude Desktop runs locally. Check public reachability and firewall policy.

Local data is unavailable

confirm that you installed a Desktop extension rather than a remote connector and that its local paths are allowed.

Wrong tool runs

reduce the active connector set, switch tool access mode, and name the intended service and action explicitly.

Persistent failure

capture the reference ID, time, connector name, account, surface, and minimal reproduction for support.

A practical connector decision

Connect when a defined task needs current source data or a controlled action. This can help when manual copy-paste creates more risk or delay. Prefer a reviewed directory connector for a supported cloud service. A trusted proprietary service can use a custom remote server. Choose a Desktop extension for local access. Decline or delay the connection when the owner, permissions, actions, data path, rollback, or support cannot be established.

Review our Figma MCP workflow for a concrete design-tool connector example.

Frequently asked questions