Anthropic’s MCP connector removes a substantial piece of plumbing: a developer can let the Claude Messages API connect directly to remote Model Context Protocol servers without running a separate client. It supports multiple servers, bearer-token authentication and per-tool allowlists or denylists. The important limitation is equally explicit: the managed connector currently implements the tools part of MCP, not the complete protocol.[1]
Anthropic says the server must be publicly reachable over HTTPS through Streamable HTTP or Server-Sent Events. A local STDIO server cannot connect directly. Prompts and resources—the other major ways an MCP server can expose reusable material—also require the developer to manage a client connection and convert those protocol objects into Claude API inputs.[1][3]
Managed connector versus the wider MCP protocol
| Capability | Managed connector | What requires another route |
|---|---|---|
| Tools | Supported through the Messages API | Nothing extra for ordinary remote tool callsSource 1 |
| Prompts | Not exposed by the connector | Own MCP client plus SDK conversion helpersSource 1Source 3 |
| Resources | Not exposed by the connector | Own MCP client, then convert to content or file objectsSource 1Source 3 |
| Local STDIO server | Cannot connect directly | Run a client locally or expose an authorised remote transportSource 1 |
| Remote HTTPS server | Supported | Server, authentication and availability remain the developer’s responsibilitySource 1Source 2 |
Compatibility starts at the transport boundary
A server that works in a desktop MCP client may still be unusable through the managed connector because it exists only as a local process. Exposing it on the public internet is not a neutral conversion: the operator must add TLS, authentication, network controls, monitoring and a policy for who may invoke each tool.
Anthropic’s connector accepts OAuth bearer tokens, but the API consumer is expected to obtain and refresh them. The connector transports authority; it does not design the identity model. If one broad service token is shared across users, the tool can lose the human permission context that existed in the source system.[1]
The allowlist is part of the agent design
The connector can enable every discovered tool, allow only named tools or deny selected operations. For a read-only assistant, Anthropic specifically describes disabling destructive or write-capable tools. This is stronger than asking the model in a system prompt not to delete or publish data: an unavailable tool cannot be selected by the model.[1]
A dynamic server creates another control problem. Tool names and schemas can change after deployment. Anthropic now documents a beta option for pinning the tool list returned by a server, so later requests use the recorded list rather than silently adopting a changed surface. That creates a versionable contract between the agent and the server.[1]
Operational facts that alter the deployment
| Measure | Value | Context |
|---|---|---|
| Feature status | Beta | The connector uses a dated beta header and can change independently of the base Messages API.Source 1 |
| ZDR eligibility | Not eligible | Data exchanged with MCP servers follows Anthropic’s standard retention policy rather than zero-data-retention treatment.Source 1 |
| Transport | HTTPS URL | Streamable HTTP and SSE are supported; local STDIO is not direct.Source 1 |
| Server count | Multiple in one request | Each server needs a corresponding toolset configuration.Source 1 |
| Authentication | Bearer token supported | The API consumer handles the OAuth flow and token refresh.Source 1 |
| Unknown configured tool | Warning rather than request error | The backend can log a warning because server tool availability may be dynamic.Source 1 |
A convenient connector is not a full agent platform
The managed path solves discovery and invocation of remote tools. The application still needs to decide which user is acting, which tool is authorised, what confirmation a write requires, how retries are made safe, how results are validated and what audit record survives after the model response. MCP standardises an interface; it does not transfer operational responsibility to the protocol.
The limitation is useful because it defines the product honestly. “Supports MCP” can otherwise sound like complete interchangeability between clients, servers and protocol features. Anthropic’s connector is a narrower and valuable claim: Claude’s API can call controlled tools on remote MCP servers. Builders should design around that exact boundary instead of discovering it after an agent depends on a missing resource or local server.
Sources & further reading
- MCP connector Claude Platform Docs · Accessed 10 Oct 2026
- Remote MCP servers Claude Platform Docs · Accessed 10 Oct 2026
- Model Context Protocol specification Model Context Protocol · Accessed 10 Oct 2026