A custom connector lets Claude reach an external tool through a remote MCP server. You enter a name and server URL under Customize, Connectors, then configure authentication. It works on Free, Pro, Max, Team and Enterprise, with free users limited to one custom connector. Anthropic does not verify custom connectors.
What remote MCP means
Anthropic's help article describes MCP as an open standard created by Anthropic. Remote servers run on the internet, so Claude can reach them without a local install. Custom connectors work in Claude, Cowork and Claude Desktop.
Adding a connector
- Team and Enterprise: an Owner or Primary Owner adds it under Organization settings, Connectors. Members then connect individually.
- Pro and Max: go to Customize, Connectors, choose Add, then Add custom connector.
You enter a name and server URL, then set authentication (sign in now, sign in when needed, or no sign in), the OAuth client, and any request headers for API keys or tokens. Turn the connector on per conversation from the plus button. To edit one you must remove and re-add it.
The network catch
Connections come from Anthropic's cloud, not your device. A server on a private network or behind a VPN or firewall will not connect unless you allowlist Anthropic's published IP ranges.
Security cautions from the page
- Custom connectors are not verified by Anthropic, and Claude can act in connected services based on your granted permissions.
- OAuth avoids sharing your password. API keys are stored encrypted, but on Team and Enterprise all users share that credential's access.
- Malicious MCP servers may include hidden instructions meant to trigger unintended actions.
- Server developers can change tool behavior without notice.
- Review tool approval requests and disable tools you do not need.
- Research can invoke connector tools automatically without approval, so disable write-capable tools first.
A pre-flight routine
Read the tool list before connecting. Prefer read-only scopes. Check who runs the server and how you would hear about changes. The wider threat model is in Anthropic MCP security model deep dive.
Click through it at your own pace, or open it full screen.
Safeguard supports MCP setup and an MCP Guardrail, and offers a free scan at gold.safeguard.sh/scan.
A short pre-approval checklist
- Who operates the server, and can you reach them if it misbehaves?
- Does the tool list match what you expected? Remove anything with write access you do not need.
- Is authentication OAuth, so no shared password is stored?
- On a team plan, are you comfortable with everyone sharing an API key's access?
- Will the first conversation use approval prompts, so you see each call?
Re-check the tool list from time to time. The help page says server developers can change tool behavior without notice, so a connector that was safe in March can differ in October.
Quick check
Can Claude reach an MCP server on my VPN?
Not by default. Connections come from Anthropic's cloud, so you must allowlist Anthropic's published IP ranges.
How many custom connectors can free users add?
One, according to the help article.
Sources
Last reviewed: 19 October 2026.
