Three Claude MCP surfaces, and the open-source rule behind each call
Claude reaches an MCP server through a custom connector, a local Claude Desktop config, or a Claude Code command, and only the first has a documented answer to whose account a call runs as. Kortix is the open-source AI Operating System. Your agents, skills, company memory, and connectors live in one git repo you own.
Claude calls a remote server from Anthropic's cloud
Claude connects to a remote MCP server from Anthropic's own network. The device in front of the person typing plays no part in the call. "When you add a custom connector, Claude connects to your remote MCP server from Anthropic's cloud infrastructure, rather than from your local device." A Claude account gets one server's tools inside the chat. Claude chooses among them as it reads the prompt.
Adding a connector is a permission of its own. On a Team plan "only Owners and Primary Owners can add them to Team plans", and on Enterprise the right extends to Owners, Primary Owners and people with a custom role that includes Manage access to Libraries. Custom connectors using remote MCP are available on Claude, Cowork and Claude Desktop on Free, Pro, Max, Team and Enterprise plans. A Free plan is limited to one custom connector (Claude Help Center).
Whose account carries each call is the second question, and the custom connector is the surface with a written answer to it.
Three things the phrase names
Three objects share the phrase, each with its own configuration home. One of them comes with a stated account rule.
A custom connector lives in the Claude account. It is added once for an organization, or once for a person on Pro or Max. It works on claude.ai, Claude Desktop and Cowork. A conversation switches it on with the "+" button on the lower left of the chat, then "Connectors". Nothing about the connector sits on the machine that opens the chat, because each session starts at Anthropic's infrastructure.
A local server in Claude Desktop is a separate mechanism. "Local MCP servers configured in Claude Desktop via claude_desktop_config.json are a separate mechanism and do use your local network, but those aren't available in Cowork or claude.ai." Its whole configuration is that file on the machine. The server it points at is reachable only from that machine's network.
Claude Code has an entry point of its own. Servers are added with claude mcp add or claude mcp add-json and configured in .mcp.json, ~/.claude.json or settings. The type field takes http (streamable-http is an alias), sse, stdio or ws (Claude Code docs).
Which servers a Claude connector reaches
The surface decides what is reachable. A custom connector starts at Anthropic's cloud, so the server must be reachable from the public internet. A server on a private network, VPN or firewall has to allowlist Anthropic's IP ranges. An internal server with no allowlist entry stays out of reach.
A local server keeps the reach of the machine it runs on, and the same configuration never appears in Cowork or claude.ai. Claude Code covers both shapes, stdio for a process on the machine and http or sse for a remote server.
Teams usually run several servers at once. Each one adds a tool list to read, and how several MCP servers fit together is a different question from which Claude surface holds the entry.
Where the account comes from
With a custom connector on a team plan, the person who installs it is often not the person whose data a call touches. Anthropic separates the two. When an Owner adds a connector to a Team or Enterprise organization, each person then connects to it and enables it for themselves. The reason is one sentence: "This ensures that Claude can only access tools and data that the individual user has access to, unless the connector uses a shared credential such as an API key, which gives everyone who uses it that credential's access."
A call carries the access of the person who connected the connector, so the provider applies that person's scopes and shares. Revoking one connection removes one person's access.
The exception causes the trouble. A connector holding a shared API key gives everyone who uses it that credential's access. Two people with different rights then produce identical calls. The record names the key, and the prompt named a person.
An audit therefore resolves each call to a person, or to a key with nobody behind it. Which of the two a team has was decided when the connector was added. Inside Kortix the same question is which account a connector call runs as.
The same MCP servers, with the rule in a file
Kortix reaches the same remote servers and keeps the account and the rule as objects a reviewer can read. A connector with provider: mcp carries a url and a transport of http by default or sse. That provider means Kortix calling someone else's MCP server (Read the docs). The entry is what an MCP connector is in Kortix, a manifest entry with actions and policies that never holds a credential.
The account is a named object on the connector, and its owner type is Kortix's answer to a shared key: every account carries one, so the question a shared credential leaves open has a field to answer it. Which type a team picks, and what happens when a call names none, is the account decision.
The rule that holds a write lives on the same entry. A rule at a higher level cannot be loosened by a lower one, and the four levels, with where a rule belongs among them, are a page of their own. Allow (always_run) runs a call, Ask (require_approval) holds it, Block (block) refuses it, and "Approval holds the call; the agent's turn pauses and resumes."
Connector credentials are brokered server-side and never enter the machine. Every action is recorded. Reading, exporting and streaming the audit log depend on the plan. Kortix connects 3,000+ apps in a click, plus MCP, OpenAPI, Postman, GraphQL and raw HTTP. One policy block covers a managed app and a remote MCP server with the same lines. A team with its servers behind one endpoint can put an open-source MCP gateway in front, and the rule on the call still belongs to the file.
connectors:
- slug: linear
provider: mcp
url: https://mcp.linear.app/mcp
transport: http
sensitive: true
agents:
triage-bot:
connectors: [linear]
policies:
- match: "linear.delete_issue"
action: blockThe entry names the server, the grant names the agent, and the project-wide rule stops the delete. The sensitive: true line keeps the connector's unmatched actions behind a person, reads included. That file is the diff a reviewer approves before the connector runs.
A setup path for a Claude team
Four steps put a Claude team on a surface it can explain to an auditor.
- Choose the surface. A custom connector fits a team in claude.ai, Claude Desktop or Cowork. A local
claude_desktop_config.jsonserver fits one person on one machine.claude mcp addfits Claude Code inside a repository. - Name the account before the connector. For a custom connector that means saying whether each person connects individually or one shared key serves the team, and putting a name on whoever owns that key. For a local server it means writing down which machine's user runs the process.
- Set the rule that holds writes. Name the action that must wait for a person, and the level of the file where that rule goes.
- Review the manifest as a diff. A new connector, a grant or a rule arrives as lines a teammate can read. The reviewer can name the agent, the account and the action in one pass.
Questions about Claude and MCP connectors
The three surfaces, where a connector is added, and whose access a call carries.
Does Claude support MCP?
Yes. Custom connectors using remote MCP are available on Claude, Cowork and Claude Desktop on Free, Pro, Max, Team and Enterprise plans, and a Free plan is limited to one custom connector.
Where do I add MCP connectors in Claude?
Under Customize → Connectors for an individual on Pro or Max. On a Team plan only Owners and Primary Owners can add them, and on Enterprise the same right extends to people with a custom role that includes Manage access to Libraries. A single conversation switches a connector on with the "+" button, then "Connectors".
Can Claude use a local MCP server?
Yes, in Claude Desktop through claude_desktop_config.json. Those local servers are a separate mechanism from a custom connector and are not available in Cowork or claude.ai.
Whose permissions do Claude connectors use?
For a custom connector, the access of the person who connected it, unless it uses a shared credential such as an API key, which gives everyone who uses it that credential's access.
Name the surface, name the account, put the rule in the repo.
Connectors, grants and policies in one git repo you own, so the next account question reads a diff.