How to Configure MCP Connectors Safely in Claude Code

An MCP connector lets Claude Code use tools provided by an external service. The connection is powerful because it can expose real data and actions, so correct setup means more than reaching a “Connected” status: you must trust the server, grant the smallest useful access, and test what it can actually read or change.

What an MCP connector does

The Model Context Protocol (MCP) defines how an AI client communicates with a tool server. A remote MCP server can expose operations such as searching Notion pages, reading a record, creating an issue, or querying a database. Claude Code sends a structured tool request; the server handles authentication and calls the external service.

A connector is therefore part of your security boundary. The MCP server, its operator, the external account, and the permissions granted during authorization all affect what Claude can do. Servers that retrieve untrusted webpages or documents can also introduce prompt-injection risk.

Check the current Claude Code MCP documentation before copying a command, because supported transports and flags can change.

Connect the official Notion MCP server

1. Confirm the server URL and choose a configuration scope

Use the server URL published by the service or listed in a trusted connector directory. Do not substitute a similarly named community server without reviewing who operates it and how it handles data.

Claude Code supports local, project, and user configuration scopes. The default local scope is private to you and the current project. Use project scope only when the whole team should receive the server definition, and remember that a committed .mcp.json can require workspace approval before it connects.

2. Add the remote HTTP server

For the official Notion remote server, the current Claude Code syntax is:

claude mcp add --transport http notion https://mcp.notion.com/mcp

HTTP is the preferred remote transport when the provider supports it. Do not use an arbitrary URL from a tutorial, and never paste an access token into a public repository.

3. Complete OAuth from inside Claude Code

Start Claude Code, enter /mcp, select the Notion server, and follow the browser authorization flow. Read the authorization screen before approving it. If the service lets you choose pages, workspaces, or capabilities, grant only the resources required for the task.

For example, a research workflow may need read access to one knowledge database but not permission to create pages or browse a private team area. Use a separate service account or workspace area when the provider cannot narrow the scope sufficiently.

4. Verify status and inspect the server

claude mcp list
claude mcp get notion

The list can show states such as connected, needs authentication, pending approval, or failed to connect. An “Added” message means the configuration was written; it does not by itself prove that OAuth is complete or that the tools work.

Run a low-risk read test against a known page. Confirm that the connector cannot access an unrelated page before enabling any write operation.

Apply least privilege to every connector

TipsMake's guide to connecting a local AI model to Obsidian with MCP shows a different use case, but the same rule applies: each connector should expose only the tools and content the workflow needs.

Use a read-only Postgres role

A database connector requires extra care because a broad database credential can expose or modify many records at once. Create a dedicated role for the connector instead of reusing an administrator or application account. The exact SQL depends on your schema and database policy; a database administrator should review it.

CREATE ROLE claude_mcp_reader LOGIN PASSWORD 'use-a-secret-manager';
GRANT CONNECT ON DATABASE appdb TO claude_mcp_reader;
GRANT USAGE ON SCHEMA reporting TO claude_mcp_reader;
GRANT SELECT ON reporting.orders, reporting.customers TO claude_mcp_reader;

Do not put the real password in a committed file or article. Store it in the supported secret mechanism, require TLS according to your database configuration, and use a network rule that permits only the required source. Verify that the role cannot write, change schema, call unsafe functions, or read other tables.

Use connectors in Claude Desktop and routines

In Claude Desktop, supported connectors can be added from the connector control near the prompt or managed under Settings → Connectors. Local, cloud, SSH, and routine sessions do not all expose connectors in the same way, so check the current interface for the session type you are using.

When creating a routine, select only the connector needed for that scheduled task. A routine that reads one Notion database should not also receive access to email, Slack, a code repository, and a production database. Review the prompt and connector permissions together: a narrowly written prompt cannot compensate for an unnecessarily powerful credential.

Troubleshoot common connector problems

Needs authentication

Open /mcp and complete or repeat the provider's login flow. Do not assume OAuth tokens expire on a universal schedule; providers and account policies differ. Check the status reported by Claude Code and the provider's connected-app settings.

Failed to connect

Run claude mcp get <name> and confirm the transport and URL match the provider's current documentation. Check whether the server is reachable and whether a proxy, firewall, or organization policy blocks it. Avoid switching to an unverified mirror merely to make the error disappear.

Pending approval

Project-scoped servers from .mcp.json may wait for workspace trust or explicit approval. Inspect the configuration and the repository before approving it; a cloned project should not be able to activate its own tools silently.

The connector sees too much

Remove or disconnect it, reduce permissions in the external service, then authenticate again. If the service offers only broad access, create a separate account whose visible resources are already limited.

The tool behaves on malicious instructions

Documents and webpages accessed through a connector can contain instructions aimed at the model. Restrict write tools, require human review for messages or destructive actions, and keep high-value services out of workflows that process untrusted content. TipsMake's discussion of AI-browser safety and connected tools explains the same risk in browser automation.

Connector review checklist

• The server URL comes from an official or reviewed source.
• The configuration scope is no broader than necessary.
• Secrets are not stored in source control, shell history, or shared prompts.
• OAuth grants only required resources and actions.
• A read-only test succeeds and an unauthorized test fails.
• Unused connectors are absent from the session or routine.
• Write, message, and delete actions require an appropriate review step.
• There is a documented way to revoke access and rotate credentials.

Check your understanding

• Question 1:

  You want a routine to read two Postgres reporting tables. What is the safest starting permission?

  • A. Full read/write access to every schema.
  • B. A dedicated role with SELECT on only those tables.
  • C. The production administrator login.
  • D. An anonymous public endpoint.

  EXPLAIN:

  A dedicated read-only role limits both accidental changes and the impact of a compromised connector.

• Question 2:

  Which command checks the health of configured MCP servers?

  • A. claude status oauth
  • B. claude mcp list
  • C. notion mcp verify
  • D. oauth --refresh-all

  EXPLAIN:

  claude mcp list displays configured servers and their connection status. Use claude mcp get <name> for details.

• Question 3:

  Why should a routine include only the connectors it needs?

  • A. MCP requires exactly one connector.
  • B. Fewer connectors reduce exposed data, actions, and failure points.
  • C. OAuth works only once per account.
  • D. Connectors cannot be reused.

  EXPLAIN:

  Removing unnecessary connectors limits authority and makes the workflow easier to audit and troubleshoot.

Submit your work

Training results

You have completed 0 questions.

-- / --

Review the lesson