MCP connectors explained: how AI agents use your tools
The standard that connects AI agents to Linear, Sentry, Notion and the rest of your stack, in plain words: how it works, who runs it, and where the risk is.
· Sources
Short answer
MCP (Model Context Protocol) is an open standard for connecting AI apps to tools and data. The AI app is the client. Each service, such as Sentry or Notion, offers an MCP server with a list of tools. The agent reads that list, picks the right tool and uses it within the permissions you granted.
What is MCP?
MCP stands for Model Context Protocol. It's an open standard that Anthropic released in November 2024 for building secure, two-way connections between AI apps and the data and tools they need[1].
Before MCP, every AI app needed its own integration with every service. Ten apps and twenty services meant two hundred integrations, each with its own sign-in and its own way of describing what it does. With a standard, a service publishes one MCP server, and any app that speaks MCP can use it.
In practice, MCP is what lets an AI agent leave the chat and work in your company's apps: read an error in Sentry, open an issue in Linear, look up a page in Notion. The model stays the same. It just has tools now.
How does MCP work?
MCP has three participants[3]:
- Host: the AI app people use, such as a code editor, Claude or a team chat.
- MCP client: the part of the host that holds the connection to one server. The host creates one client per server.
- MCP server: the program that offers a service's tools and data.
A server can offer three things: tools, which are actions the model can run (query a database, call an API); resources, which are context data (a file's contents, a record); and prompts, which are reusable instruction templates[3].
A task follows the same path every time:
- The client asks the server which tools exist. Each comes with a name, a description and the fields it accepts.
- The model reads the person's request and picks the tool that fits.
- The client calls the tool with the values the model chose.
- The server runs it and returns the result, which goes back to the model as context.
- The model decides whether it's done or needs another tool.
Under the hood, messages use JSON-RPC 2.0[3]. People using a connector never see that. People building a server do.
What is an MCP server, and what's the difference between local and remote?
An MCP server is the program that translates a service into the protocol. It can run in two places[3]:
| Type | Where it runs | How it talks | Example |
|---|---|---|---|
| Local | On the same machine as the AI app | Standard input and output (stdio) | A server that reads files on your computer |
| Remote | On the vendor's infrastructure | HTTP (Streamable HTTP), with OAuth sign-in | Sentry's official server, which runs on the Sentry platform |
For a company, the vendor's official remote server is usually the best option. The vendor runs and updates it, nobody on your team installs anything, and sign-in goes through the service's own consent screen. Community servers exist for almost everything, but each one needs a review before it gets near company data.
Who maintains the MCP standard?
Since December 2025, MCP has lived in the Agentic AI Foundation (AAIF), formed under the Linux Foundation. Anthropic contributed MCP, Block contributed goose, and OpenAI contributed AGENTS.md[2]. At launch, the Linux Foundation counted more than 10,000 published MCP servers[2].
The specification ships in dated versions. The latest, from July 28, 2026, defines how tools, sign-in and security work[4][5]. Neutral governance matters if you're buying: a standard that no single vendor controls is less likely to change direction overnight.
What are MCP connectors in Claude and ChatGPT?
“Connector” is what many apps call an MCP server once it's hooked up. In Claude, custom connectors using remote MCP are available on the Free, Pro, Max, Team and Enterprise plans; on Team, only owners can add them[6]. In ChatGPT, you add a custom MCP server from the plugins area, with OAuth, and write actions ask for confirmation by default[7].
Both are built for one person talking to one assistant. Once a team has several agents, the questions change: who connects the service, which agents may use which tools, and who approves the risky ones. The rest of this guide covers that.
How does one-click sign-in to an MCP server work?
Remote servers use OAuth, the same “Sign in with…” flow you already know. The specification lays out the path: the server answers that sign-in is required and points to its authorization server; the app reads that server's public metadata and registers itself as a client[5].
Registration is what decides whether sign-in is really one click. The specification allows three ways[5]:
- Client ID Metadata Documents (CIMD): the app identifies itself with a URL that describes it. It's the option the 2026 specification recommends.
- Dynamic Client Registration (DCR): the app registers itself on the spot. It's the most common option today, but the 2026 specification marks it deprecated and keeps it for compatibility.
- Pre-registration: someone creates an app in the vendor's dashboard and copies an ID and a secret. That's not one click.
Whichever way, the app must use PKCE, with the S256 method whenever it can, which protects the sign-in code from interception[8].
Not every vendor lets clients in this way. Some require an app registered with them; others publish dynamic registration but only accept clients they've approved. We checked server by server, with the date and method, in which official MCP servers support one-click sign-in.
How do agents in agentes.chat use MCP?
In agentes.chat, people and AI agents work in the same chat, and tool access works the way a company needs, not the way one person does. There are two layers:
- The workspace connects a service once, with OAuth or a key. Tokens are encrypted and never sent back to the browser or the apps.
- Each agent gets a subset. Per connector, access is No access, Read, or Read and write, or you pick tool by tool. “All tools” never includes running code.
The catalog has 58 one-click presets for 56 vendors' official remote MCP servers, including Linear, Sentry, Notion, Atlassian (Jira and Confluence), Asana, Stripe, Cloudflare, Supabase, GitLab, Datadog, Intercom and monday.com. You can also connect:
- GitHub, through the agentes.chat GitHub App or OAuth, with repositories chosen per agent;
- any MCP server by its URL, shown with its own logo;
- Google Drive, by entering a Drive MCP server address (not one click).
Some services aren't available yet, because the vendor requires a registered app or only lets approved clients in: Slack, HubSpot, Vercel, Zendesk, Box, Render, PagerDuty, Front, Pipedrive, Shopify, Microsoft 365 and Figma. There are no Google Calendar, Docs or Sheets connectors either.
Example · Acme (fictional company)
Sentry and Linear at Acme
An Acme admin connects Sentry and Linear to the workspace, signing in to each service. The infrastructure agent gets Read on Sentry and Read and write on Linear. The support agent gets Read on Linear only.
When someone in the channel asks it to look at a new error, the infrastructure agent reads the event in Sentry and creates the Linear issue without asking: it's an ordinary write it was granted. If the same work ran as a routine, with nobody watching, creating the issue would wait for a person. The support agent can see the issue but can't change it.
What can an agent do on its own with an MCP connector?
When a server is connected, agentes.chat classifies every tool, and an admin confirms the result:
| Tool | Example | What happens |
|---|---|---|
| Read | List issues, read an error, search a page | Runs freely, no approval |
| Ordinary write | Create or update an issue, add a comment | Runs without approval once granted |
| Sensitive | Names starting with verbs such as delete, remove, send, pay, publish, transfer, refund, share, drop or purge | Can only ask for approval, or be switched off |
| Marked destructive by the server | A tool carrying the destructive hint | Asks for approval |
| Ambiguous | A name that doesn't say what it does | A model suggests a level; if that fails, the tool asks |
On top of that sits a fixed rule: any tool with merge, deploy, rollback, revert_deploy or promote in its name or scope always asks, whatever the server says. On GitHub, merging a PR and running a workflow ask too.
The request shows up in the chat as a card with the exact action and values. It expires after 24 hours and runs once, exactly as approved. Routines that run with nobody watching go further: every write to a connected app asks a person. The full list is in our guide to human-in-the-loop AI agents.
How do you build an MCP server?
If a service you rely on has no server, or the server would be internal, you can build one. The short path:
- Pick a few tools. Start with the reads your team asks for most. Give them clear names, like list_orders, and descriptions that say when to use each one.
- Use an official SDK. The MCP project maintains SDKs in several languages, plus reference servers to learn from[3].
- Test with the MCP Inspector, the official tool for listing and calling a server's tools[3].
- Deploy it as a remote server, over HTTP with OAuth sign-in, following the authorization part of the specification[5].
- Mark what reads and what destroys. Annotations help, but the specification tells clients to treat them as untrusted unless the server is trusted[4]. Don't rely on them alone to protect data.
Once it's live, you add it to agentes.chat by its URL, like any other server, and it goes through the same classification.
What are the risks of MCP?
MCP gives the model the power to act, and the risk comes with it. The main ones:
- Too much access. A token with every permission, for a task that only needed to read.
- Hidden instructions. A tool's result can carry text written to steer the model. The specification asks clients to validate results before passing them to the model[4]. In agentes.chat, all outside text, MCP answers included, reaches the model marked as untrusted.
- Actions nobody sees. The specification says there should always be a person able to deny a tool call, with confirmation for sensitive operations[4].
- Stolen tokens. Whoever gets a stored token can act as the app. That's why the specification requires secure token storage and recommends short-lived tokens[8].
- Fake servers. Check the address against the vendor's own documentation before you connect.
The defense is the same everywhere: give each agent the least access that gets the job done, keep sensitive actions waiting for a person, and keep a log of what each agent did. agentes.chat ships with those rules, and you adjust them. It's in early access, by invitation only. If you want to connect your team's tools to agents this way, join the waitlist.
Frequently asked questions
Is MCP only for Claude?
No. Anthropic created MCP, but it's an open standard, maintained since December 2025 by the Agentic AI Foundation under the Linux Foundation. ChatGPT, code editors and many other apps use MCP servers too.
What's the difference between MCP and an API?
An API is a service's own interface, and every API has its own format. MCP is a standard way to describe tools to AI models. Many MCP servers call the service's API underneath and present it in a form any AI app understands.
Do I need to code to use MCP connectors?
Not to use an existing server. In an app with a catalog, you pick the service, sign in and decide what each agent can do. You only need to code to build a new server.
Can an agent do anything in a connected app?
Only what you allow. In agentes.chat, each agent gets No access, Read, or Read and write per connector, or tool by tool. Sensitive actions ask for approval or stay switched off.
Why don't some services connect in one click?
Because the vendor requires an app registered with them, or only accepts clients it has approved. HubSpot, Slack and Figma are examples. Our server-by-server check is on the one-click MCP sign-in page.
Sources
Links checked on October 29, 2026. What this page says about agentes.chat describes the product on that date and may change during early access.
- 1Anthropic, Introducing the Model Context Protocol, November 25, 2024.
- 2Linux Foundation, Linux Foundation Announces the Formation of the Agentic AI Foundation (AAIF), Anchored by New Project Contributions Including Model Context Protocol (MCP), goose and AGENTS.md, December 9, 2025.
- 3Model Context Protocol, Architecture overview.
- 4Model Context Protocol, Specification: Tools (2026-07-28), July 28, 2026.
- 5Model Context Protocol, Specification: Authorization (2026-07-28), July 28, 2026.
- 6Anthropic, Get started with custom connectors using remote MCP.
- 7OpenAI, Add custom MCP server.
- 8Model Context Protocol, Specification: Authorization Security Considerations (2026-07-28), July 28, 2026.