Admin guide
Nightschool AI: approve and control Claude connectors and MCP servers
Owners add the connector, each user connects it, and you decide which credentials it carries.
In Anthropic's Claude, only Owners and Primary Owners can add custom connectors to a Team plan; on Enterprise, people with a custom role that includes Manage access to Libraries can too. Members then connect individually. Team and Enterprise plan owners can disable specific tool calls that render interactive connectors in Organization settings, Connectors.
Published
Key Takeaways
- Team: only Owners and Primary Owners add custom connectors. Enterprise adds custom roles with Manage access to Libraries.
- Adding a connector does not switch it on for everyone; each user connects and enables it.
- A shared credential such as an API key gives every user the same access, so scope it tightly.
- Claude Code MCP servers are governed separately, through managed settings.
The full guide
Tap any section to open it.
About this guide
Connectors let Anthropic's Claude reach other systems through remote MCP servers, so they are the setting IT and security ask about first. This page sets out who can add a connector, what each member still has to do, and the separate controls for MCP in Claude Code.
Who can addWho can add a custom connector to the organization
Anthropic says anyone can build and host connectors using remote MCP, but only Owners and Primary Owners can add them to Team plans. On Enterprise plans, Owners, Primary Owners, and people with a custom role that includes Manage access to Libraries can add them.
Custom roles are part of role-based access, which Anthropic's pricing page lists for Enterprise and not for Team. On a Team plan, the list of people who can add connectors is therefore your Owners and your Primary Owner.
Anthropic also warns that custom connectors let Claude connect to services that have not been verified by Anthropic, and that Claude can then take action in them. Treat each new connector as a new third-party integration in your review process.
How to addThe steps an Owner follows
Go to Organization settings, Connectors, and click Add. Hover over Custom, select Web, enter the name users will see, add the remote MCP server URL, and click Continue. Then review the authentication settings Claude detected and change them if your server needs something different.
To remove a connector for the organization, Owners use the same Organization settings, Connectors page. Anthropic notes that you cannot edit a custom connector in place: remove it and add it again with the new details.
What members seeAdding a connector is not the same as turning it on
Once a connector is added to a Team or Enterprise organization, Anthropic says users individually connect to and enable it. That way Claude can only reach the tools and data the individual user already has access to.
The exception is a connector that uses a shared credential such as an API key. Anthropic says everyone who uses that connector reaches the service with the same credential, so use one limited to what members should access.
So for each connector, record which kind of sign-in it uses. A per-user sign-in follows each person's existing permissions; a shared key needs its own access review.
Tool callsDisabling specific tool calls
Anthropic's article says Team and Enterprise plan owners can disable specific tool calls that render interactive connectors within Organization settings, Connectors. That is the control to use when a connector is approved but one of its actions is not.
Read that sentence narrowly. It describes tool calls that render interactive connectors, so check in your own console which tools your connector lists before you promise the security team a per-action block.
Claude CodeMCP servers in Claude Code are a separate control
Developers can also add MCP servers to Claude Code on their own machines. Those are governed through Claude Code managed settings rather than the Connectors page.
Anthropic's Claude Code docs say server-managed settings cannot distribute a managed-mcp.json file. Deliver the allowedMcpServers and deniedMcpServers policy keys there instead, or provide remote http and sse servers with managedMcpServers on Claude Code v2.1.259 or later.
Our page on managing Claude Code with managed settings covers where those settings live and how to check a laptop received them.
ChecklistConnector register you can copy
Keep one row per connector. Each column comes from a control Anthropic documents.
1. Name and server URL
The name users see and the remote MCP server URL you entered.
2. Who added it
The Owner, Primary Owner or, on Enterprise, the custom-role holder who added it, and the date.
3. Credential type
Per-user sign-in, or a shared credential such as an API key, with the scope that key allows.
4. Disabled tool calls
Any tool calls you turned off in Organization settings, Connectors, and why.
5. Claude Code policy
Whether the server is allowed or denied in Claude Code managed settings.
6. Review date
When you next check the connector, its credential, and who still uses it.
SourcesWhere each fact comes from
Anthropic, "Get started with custom connectors using remote MCP": support.claude.com/en/articles/11175166. Anthropic, "Configure server-managed settings (Claude Code docs)": code.claude.com/docs/en/server-managed-settings.
Anthropic, "Plans and pricing": claude.com/pricing.
Each fact on this page was read on that vendor page on 2026-11-08. Settings pages move and plans change, so open the source and your own admin console before you rely on a detail here.
Train the admins, then the people they support
This page covers one admin task. The Nightschool AI admin and governance course walks the whole Team and Enterprise setup in order: sign-in, provisioning, connectors, data, and Claude Code, with every step checked against Anthropic's own documentation.
Frequently Asked Questions
Who can add a custom connector on Claude Team?
Only Owners and Primary Owners. Anthropic's connector article says anyone can build and host a connector using remote MCP, but only those two roles can add one to a Team plan.
Who can add connectors on Claude Enterprise?
Owners, Primary Owners, and people with a custom role that includes Manage access to Libraries. Custom roles come with role-based access, which the pricing page lists for Enterprise.
Does adding a connector turn it on for every member?
No. Anthropic says that once a connector is added to the organization, users individually connect to and enable it, so Claude reaches only what each user can already access.
Can admins block one action inside a connector?
Anthropic says Team and Enterprise plan owners can disable specific tool calls that render interactive connectors within Organization settings, Connectors. Check which tools your connector shows there before relying on it.
What is the risk of a shared API key on a connector?
Everyone who uses the connector reaches the service with that same credential. Anthropic advises using a credential limited to what members should access.
How do I edit a custom connector?
You cannot edit it in place. Anthropic says to remove the connector and then add it again with the updated details.
How do I control MCP servers in Claude Code?
Through Claude Code managed settings. Server-managed settings accept the allowedMcpServers and deniedMcpServers keys, and on v2.1.259 or later managedMcpServers for remote http and sse servers. A managed-mcp.json file must be deployed to devices instead.
Set it up once, write it down, then teach it
A connector register with one row per server answers most of the questions security will ask.
Nightschool AI is independent and not affiliated with, sponsored by or endorsed by Anthropic. Claude is Anthropic's product, named here only to describe it. Facts checked against Anthropic's public pages on 2026-11-08; confirm in your own admin console before you change a setting.