Claude Connectors Explained: What They Can Access, and Whether They Are Safe

A connector lets Claude read from and act in another application. What it can actually reach depends on two things, neither of which is Claude. Here is how to judge one before you switch it on, and how a company connects its own software.

Hugo Matthaey

Hugo Matthaey

Oct 16, 2026

A central assistant hub linked by cables to a folder, a chat bubble, a database and an office building, each cable passing through a locked gate, one of which is closed

Claude connectors link Claude to the applications your work lives in, so it can read from them and act in them during a conversation. Each connector is a remote MCP server run by whoever built it, not by Anthropic. That is the whole key to the questions people actually ask about them. What Claude can access through a connector is decided by the tools that server exposes and by the permissions of the account you connected with. Whether a connector is safe is decided by how that server was built. This guide covers both, then how a company connects its own software.

What are Claude connectors?

A connector is how Claude reaches another application. The application publishes a remote MCP server: a list of tools such as "search files", "read a ticket" or "update a deal", each with a description Claude reads. When your request needs one, Claude calls it and works with the result.

There are two kinds:

  • Directory connectors are listed by Anthropic and cover common tools: file storage, email and calendar, chat, code hosting, CRMs. You enable them under Customize, then Connectors. Anthropic's help article on using connectors is the reference for the current list.
  • Custom connectors are any other remote MCP server, added by pasting its URL. This is how a company connects its own software, or a vendor that is not in the directory. The steps are in how to add a custom connector in Claude.

The best connectors are not the longest list. They are the two or three that reach the systems your work actually happens in.

What data can Claude access through connectors?

Two limits apply at the same time, and Claude gets whichever is narrower.

1. The tools the server exposes. A connector can only do what its server has built a tool for. If there is no tool that deletes records, Claude cannot delete records through it, whatever you type. If the only tool is a search over invoices, Claude sees invoices and nothing else.

2. The permissions of your account. With a well-built connector you sign in through the application's own login, and Claude then acts as you. It cannot open a record your account cannot open. When your account is disabled, the connector stops working.

One consequence is easy to miss: whatever a tool returns becomes part of the conversation, like a document you pasted. Your Claude plan's retention and training settings then apply to it, the same as anything else you type.

Is it safe to use connectors in Claude?

The safety of a connector is the safety of the server behind it. Before switching one on, check four things:

  1. Who runs it. The application's own vendor, or a third party sitting between you and your data? A third-party server sees everything that passes through it.
  2. How you sign in. A login through the application itself, followed by a consent screen, is the right shape. A form asking you to paste a long-lived API key is not: that key usually has far more access than you, and it does not end when you leave.
  3. What it asks for. The consent screen should name the permissions. Read-only access for a reporting use case is a good sign.
  4. Whether writes are separate from reads, so you can let Claude look things up without letting it change them.

There is one risk the server cannot fully remove: anything a tool returns, such as an email body or a web page, can carry text written to steer the model. Connect tools that read untrusted content separately from tools that write, and keep a person in the loop for changes that matter. We go through each attack and what stops it in MCP security in 2026.

On Team and Enterprise, only an Owner can add a custom connector, then each member connects with their own account. That gives a company one place to decide which connectors are allowed at all.

Connecting Claude to your own software

If your product, ERP or internal tool has no MCP server, Claude cannot reach it, and someone has to build one. Building it is where all the answers above are decided: which tools exist, what each one may read or write, and how a user's role in your system becomes their limit in Claude.

This is what our servers do in production:

  • Users sign in with their existing account through OAuth, so nobody pastes a key, and access ends when their account does.
  • Each tool declares whether it reads or writes. A tool that declares nothing is treated as a write, and a read-only token calling a write tool is refused before the tool runs.
  • Roles are re-read on every call from the application's database, not stored in the token. Someone removed from an organization loses access on their next request.

If your software runs on Salesforce, there is a shorter path, covered on our Salesforce MCP page, and Salesforce now ships its own plugin for sellers, covered in Claudeforce explained.

Related: how to add a custom connector in Claude, what MCP is, and what MCP OAuth is.

Read next: Agentforce pricing and when Claude on Salesforce is cheaper, Microsoft 365 Copilot pricing.

Also: MCP gateways and registries.