What an MCP connector can and cannot do to your data
What the sign-in grants, what the tool list allows, what you approve, and the risk no permission screen shows. Five questions to ask before you press Allow.
·7 min read·Prashant Shaw
Every connector starts with the same screen: an app "wants to access" your account, a short list of permissions, and a big button. Most of us read that screen the way we read cookie banners, which is to say for exactly as long as it takes to find the button.
I build one of these connectors, so I have spent an unreasonable number of evenings on the other side of that screen. This post is what I would want someone to tell me before I pressed Allow on anybody's, mine included. It applies to any connector you add to Claude.ai, ChatGPT or a coding agent. At the end I answer the same questions for mine, including the answer I like least.
🧛 It can only come in if you invite it
A connector is a remote MCP server: a program on someone else's computer that offers your AI a short list of tools, and does something when one of them is called. That list is the whole of its power. If there is no delete tool, nothing you or the model types can make it delete. If there is one, "please be careful" is not a permission system.
Like a vampire, a connector cannot come in unless it is invited. Also like a vampire, once invited it can go anywhere the invitation covers, at any hour, and it does not get tired.
So the first thing to read is not the consent screen. It is the tool list. Claude.ai shows it in the connector's settings once you have added it, and the MCP specification asks every client to "provide UI that makes clear which tools are being exposed to the AI model". Read it the way you would read a lease: slowly, looking for the word delete.
🔑 Layer one: what the sign-in grants
When you press Connect, you sign in on the connector's own site and approve a list of scopes. The authorization part of the spec builds on OAuth 2.1, the same machinery behind "Log in with Google", and three useful things follow from that:
Your password goes to the connector's site, never to the AI app. The AI app gets a token.
The token carries scopes, and a scope is a ceiling. A token that says read cannot write, however nicely the model asks.
The spec requires the server to check that a token was issued for it, so a token handed to one connector is no good at another.
What scopes cannot tell you is how wide each one is. "Read your pages" might mean one folder or every page you have written since 2019. The consent screen describes categories. The tool list describes actions. You need both.
🧰 Layer two: what the tools say about themselves
Each tool can carry hints: whether it only reads, whether it can destroy something, whether calling it twice is safe, and whether it reaches the outside world. Claude.ai uses them to sort a connector's tools into a read-only group and a write group, and each tool can be set to always run, ask first, or never run.
Here is the catch. The connector writes those hints about itself. The spec is blunt about it: clients "MUST consider tool annotations to be untrusted unless they come from trusted servers." A hint is a label on the box, written by whoever packed the box. An honest connector labels honestly. A careless or hostile one can label a shredder "read-only".
🙋 Layer three: what you approve, one call at a time
The last gate is you. The spec says there "SHOULD always be a human in the loop with the ability to deny tool invocations", and Anthropic's own guidance says to "only click 'Allow always' when using a server and tool that you trust to run unsupervised." When I added mine, Claude.ai set every tool, the reading ones included, to ask first.
My rule is boring, and it works: leave every write tool on ask for the first week. Watch what the model actually calls, and with what. Promote a tool to always allow once you are bored of approving it, and not before. Boredom is the sign that you have seen enough of what it does.
🕳️ The part no permission screen shows
Everything above is about what a connector can do. The harder problem is what the model can be talked into doing with it.
A connector that reads things puts their text in front of the model, and the model cannot reliably tell your instructions from instructions that happen to be written inside a page, an email or a search result. Anthropic's help centre warns that "malicious MCP servers may include hidden instructions that try to make Claude perform unintended actions", and the same trick works through content that a perfectly honest connector fetches for you.
Simon Willison named the dangerous combination the lethal trifecta: access to your private data, exposure to untrusted content, and the ability to send data out. Any one of them is fine. All three in the same conversation is how data leaves. His point about MCP is the uncomfortable one: once you mix tools from different vendors yourself, "there's nothing those vendors can do to protect you." Each connector can be safe on its own and the combination still is not.
⚠️WARNING
A read-only connector is still a way in for text. What it reads can steer what the model does with every other tool in the same conversation.
One more thing worth saying plainly: when the model reads a page through a connector, that page becomes part of your conversation, handled like anything you pasted in yourself.
📝 Five questions before you press Allow
1️⃣ Who runs the server? A connector is someone else's computer holding a token to your data. Would you give this company your password? The token is the next best thing.
2️⃣ What is on the tool list, and which tools write? Read the names. Look for delete, send, share and publish.
3️⃣ Can it destroy anything, and is there a way back? Ideally there is no delete tool, or there is history you can restore from. Both is better.
4️⃣ What else is connected in the same chat? Private data plus untrusted content plus a way out is the trifecta, even when it is spread across three well-behaved connectors.
5️⃣ How do you disconnect it, from both ends? Removing it in the AI app stops the app calling it. Revoking it on the service's side stops the token working at all.
🧪 My answers, for my own connector
Sumibako's connector has six tools. Three read: read a page, search pages, and show the plan and what is used of it. Three write: write a page, edit part of a page, and publish or unpublish a page. Here is how it answers the five questions:
It can read and search every page in your vault, not only the ones it wrote. Pages in the trash are out of its reach.
It can overwrite or edit any page, and before it does, it keeps the previous version. The last twenty versions of each page are kept for two weeks and can be restored from the page's menu.
There is no delete tool. Not a hidden one, not a scope, not a flag.
It can publish only pages it created, and it cannot make any page findable by a search engine. That switch has no path through the connector at all.
It makes at most sixty requests a minute. Revoke it in Settings, Connected apps, and it stops on its next request. It stays refused even if you reconnect it from the AI app's side, until you choose Allow again.
And the answer I like least. It cannot publish a page you wrote. It can, however, read that page, write a new page with the same words in it, and publish the new one. The rule protects pages, not sentences. That is the trifecta in miniature: your private data, whatever text the model has read today, and a way out.
What stands in the way is layer three. Two tools can publish: the publish tool, and the write tool when it is asked to publish in the same call. Both are write tools, and both ask first unless you tell Claude otherwise. Keep them that way, and read what it is about to publish before you say yes.
🤷 The short version
A connector can do what its tool list says, as far as its token allows, whenever you let it. The list is the ceiling, the token is the wall, and you are the door. Read the list once, keep writes on ask until you are bored, and be careful about which connectors share a conversation. That is most of it, and it is more than the Allow button will ever tell you.
If you want to try all this on a connector whose limits you now know by heart, the Claude.ai setup takes about a minute, and the connector post has the rest. No vampires were harmed in the writing of this post, though one was invited in.
