Is it safe to connect an MCP server to Claude or ChatGPT? A checklist

In short

Connect only trusted MCP servers, check permissions, limit tools, keep approvals on and know how to revoke. A checklist from official sources, Nov 2026.

By FezolaPublished November 15, 20263 min read

On this page

Connecting an MCP server to Claude or ChatGPT is as safe as the server you choose and the permissions you give it. Connect only servers built and hosted by organizations you trust, check what permissions they ask for, switch off tools you do not need, keep approvals on for anything that writes, and know how to revoke access. This checklist follows Anthropic's help page on custom connectors and the Model Context Protocol security guidance, both read on 15 November 2026.

The checklist

Checked 15 November 2026.
Check	Why it matters	Source
Trust the publisher	Custom connectors can link to services Anthropic has not verified	Anthropic
Read the permissions	Limit scopes where possible and deny access if they look unnecessary	Anthropic
Know the credential type	OAuth means Claude does not see your password; API keys are stored encrypted	Anthropic
Keep approvals on	Click Allow always only for tools you trust to run unsupervised	Anthropic
Disable unneeded tools	The Search and tools menu lets you switch tools off	Anthropic
Watch for hidden instructions	Prompt injection through tool results is a known risk	Anthropic
Be careful in Research	Tools can run automatically without further approval	Anthropic
Prefer least privilege	Broad scopes enlarge the damage if a token leaks	MCP project
Treat local servers with care	They run with your privileges and need consent and sandboxing	MCP project
Know how to revoke	Disconnect in the assistant or in the service's security settings	Anthropic

What the official sources say

Anthropic's help page on custom connectors says connecting a service lets Claude access it and potentially change data, based on your permissions. It advises reviewing the authentication settings Claude detects, limiting scopes, and watching tool inputs and outputs, because server developers can change tool behavior over time. On Team and Enterprise plans, everyone using a shared credential gets that credential's access, so use one limited to what members should reach. During Research, connector tools can run automatically: disable tools that can write.

The MCP project's security best practices are written for developers, but they explain the risks behind the checklist: proxy servers that skip consent, tokens passed through without validation, requests to internal addresses, local servers that execute commands, and over-broad scopes. Its scope guidance is to start with minimal permissions and raise them only when needed.

How Fezola handles it

Fezola creates replies as drafts, keeps sending off until you turn it on mailbox by mailbox, treats mail content as data and never as instructions, and refuses to connect to addresses on private networks. API keys and tokens are stored encrypted, and you can disconnect any source at any time. It still reads private content, so apply the same checklist to it. See is it safe to give AI access to your email and remote or local MCP server. Fezola is free for 2 sources; Pro is $9 a month or $90 a year, with a 7-day free trial.

Create your free Fezola account to connect your mailboxes with drafts by default.

Questions and answers

Is it safe to connect an MCP server to Claude?

It depends on the server. Anthropic's help page, read on 15 November 2026, advises connecting only to servers built and hosted by organizations you trust, reviewing the permissions requested and limiting scopes where possible.

What is prompt injection in an MCP context?

Malicious servers, or content a tool returns, can include hidden instructions meant to make the assistant act unintentionally. Anthropic says Claude has built-in protections but you should still monitor tool inputs and outputs.

Should I click Allow always?

Anthropic's page says to click Allow always only for servers and tools you trust to run unsupervised. Keep approvals on for tools that can write, send or delete.

Are local MCP servers riskier than remote ones?

They have different risks. The MCP project's security guidance says local servers run with your own privileges and can be targeted by malicious startup commands or insecure localhost services, so they need consent and sandboxing. A remote server's risks are about who runs it and what you let it do.

How do I remove access?

Disconnect the connector in the assistant's settings, or revoke the authorization in the third-party service's security settings. With Fezola you can also disconnect any source.