An MCP server is a supplier. Approve it like one.

In What is an MCP I called a connector a door into one of your systems. This lesson is about who decides which doors get fitted.

Anyone can publish an MCP server. Most of the ones your people can find in an afternoon were built by someone you have never heard of, run on a computer you have never seen, and were listed in a marketplace that didn’t check either.

The number: six domains, from US$4 a year

In October, OX Security published an analysis of 15,465 MCP servers listed across five public registries, which came down to 5,095 unique hostnames. These are their figures, not ours. OX sells security products and the article promotes its report, so read it in that light. What it describes is not hard to believe.

2.3% of the hostnames no longer resolved. Six sat on expired domains that anyone could register for between US$4 and US$12 a year. Buy one of those and you inherit the trust of anyone whose AI tools still point at it. About one in two hundred ran through a free tunnelling service, which means the “server” was somebody’s own computer.

OX’s summary is the line I would put in front of any leader: “Until marketplaces add vetting, code signing, and origin verification, the enterprise has to do that work.”

What Claude checks, and what it doesn’t

Anthropic’s directory labels connectors by how much it has reviewed them. Verified connectors have been tested more closely, and even then Anthropic says that isn’t a security audit, because the developer still controls the tools and can change them after review. Community connectors have been screened but not reviewed in depth. A custom connector, added by its address, hasn’t been reviewed by Anthropic at all. The advice for all three is the same: only connect to developers you trust, and watch for tools that change.

On Team and Enterprise plans, only owners (and, on Enterprise, roles given the right) can add a custom connector for the business. That is a gate. It isn’t a decision. Someone still has to know what they are saying yes to.

Treat it as a supplier

Approving an MCP server is a supplier decision. You wouldn’t give a new cloud supplier your customer data because it had a marketplace listing. An MCP server gets the same reach into a system, often in an afternoon, and usually without anyone asking where it runs.

So treat it like a supplier:

• One named person says yes or no.
• The reason gets written down, where the next person can find it.
• The list gets checked again. A server you approved can move, change hands or lapse after you said yes. An approval has a date on it.

What we did, and what it doesn’t cover

Our own AI policy counts anything that lets an AI tool reach a system’s data as a connection, whether or not an admin console shows it. New tools are requested in an open channel, with a link, the reason and the cost, so everyone sees the question and the answer. And every connection runs on an individual company account, so access ends when the account is disabled.

We considered a separate register of every connection and decided against it. Accounts end access cleanly. What they don’t do is tell you that a server you approved has changed since, or that one you stopped needing is still there. That is the gap OX’s numbers point at. A control without an owner is a wish, and that includes this one.

Our list

So, while writing this, we listed what our firm has connected to Claude. In October 2026 it was 14 connectors:

Connector	What it reaches
Asana	Tasks and projects
Atlassian	Jira and Confluence
Canva	Designs
Gmail	Email
Google Calendar	Calendars
Google Drive	Files
Lucid	Diagrams and whiteboards
Account Engagement (custom)	Marketing automation
Microsoft 365	SharePoint, OneDrive, Outlook and Teams
Salesforce (custom)	Our CRM
Salesforce Trailhead	Salesforce learning content
Slack	Messages and channels
Wispr Flow	Meeting notes
Xero	Accounts

Two of them are custom, added by address, so Anthropic hasn’t reviewed them. That makes them the two our own approval has to carry.

There was a fifteenth. A WordPress.com connector was still installed, though no longer connected, from the website we moved off in September. It had simply outlived the site. That is what an approved list with a date on it catches.

One thing to try this week

Ask who in your business can say yes to a new MCP server or connector. If the answer is “whoever has admin”, write a name down instead, and put it next to “to ask for a new tool” on your one-page rules.