Learn · Guide

What is an MCP server, and how is it used with Claude Team?

Published 31 October 2026

Short answer. An MCP server is a small program that gives an AI assistant such as Claude a defined way into one of your systems: it lists what Claude may look up or do there, and does it when Claude asks. MCP, the Model Context Protocol, is the open standard for how the two talk. In Claude Team or Enterprise, an owner of the company’s Claude account adds the server once as a custom connector. Each employee then connects with their own sign-in and sees only what they may see. Run the server in your own cloud with only the access it needs, read-only to begin with, and write every call to the logbook.

This guide explains what MCP is, what an employee can do with an MCP server, how it gets into Claude Team, and how the company keeps control of it.

MCP is a shared standard for connecting AI to your systems

MCP is an open standard for connecting AI applications to outside systems, such as files, databases and business systems (modelcontextprotocol.io). Anthropic created it (Claude Help Center), and other AI applications, such as ChatGPT and Visual Studio Code, support it too (modelcontextprotocol.io). A system that has an MCP server can be reached by any AI application that speaks MCP, so it is built once.

Three parts take part in every connection (MCP architecture):

Part	What it is	In Claude Team
Host	The AI application the person works in	Claude
Client	The part of the host that keeps one connection to one server	Created by Claude for each connector
Server	The program that offers data and actions from one system	Your MCP server, for example on the accounting data

A server offers three kinds of things: tools, which are actions Claude can call; resources, which are data Claude can read; and prompts, which are ready-made instructions. How an agent chooses and calls a tool is explained in Tools for AI agents.

What an employee can do with an MCP server

With an MCP server on the company’s figures, an employee can ask Claude a question such as “Why did costs rise last quarter?” Claude calls the server’s tools, the server looks up the figures the employee is allowed to see, and Claude answers with the figures and the records behind them. Where the server offers it, the employee can also ask for the data as a file to open in a spreadsheet.

The person who builds the server decides what its tools do. A tool can read data, create or change data, or act on the user’s behalf (Claude Help Center). Claude can only do what the server offers, and only with the access the employee signed in with.

How an MCP server gets into Claude Team

Three people take part, in this order (Claude Help Center):

Whoever builds the server puts it in the company’s cloud, behind a sign-in, with your IT, in-house or your IT partner, where access to the systems is involved.
An owner of the Claude account adds it once for the whole company: Organization settings › Connectors › Add › Custom › Web, then the server’s address and how people sign in. On a Team plan, only an Owner or Primary Owner can do this. On an Enterprise plan, a person with a custom role that includes “Manage access to Libraries” can do it too.
Each employee finds the connector under Customize › Connectors, selects Connect and signs in with their own account. In a conversation, they turn it on under the “+” button › Connectors.

Claude reaches the server from Anthropic’s cloud, also when the employee uses the desktop app. The server must therefore be reachable over the internet, or the company’s firewall must let in Anthropic’s published IP addresses (Claude Help Center). The data stays in the company’s cloud; the answer to each question passes through Claude.

How access stays under the company’s control

Control sits in five places, and the company holds each of them:

Layer	What it does	Who controls it
Sign-in per person	Each employee signs in as themselves, so the server knows who asks and shows only what that person may see. A connector set up with a shared API key gives everyone that key’s access, so choose sign-in per person (Claude Help Center).	The company, in the server’s sign-in
The server’s own access	The server runs under its own identity, with only the rights its tools need, read-only on the systems it reads. A tier per role can limit which data each group sees and how much each question may fetch.	The company, in its own cloud
Tool permissions in Claude	An owner can set each tool, or each group of tools, to “Always allow”, “Needs approval” or “Blocked” for everyone, for example reading allowed and writing blocked. This narrows access; it never grants more than the system behind it allows (Claude Help Center). On Enterprise, roles can set this per group of employees (Claude Help Center).	An owner of the Claude account
The logbook	The server writes every call to the logbook: who asked, which tool, what it returned, and when. If the logbook entry cannot be written, the server sends no answer.	The company, in its own cloud
Withdrawal	An employee can disconnect, an owner can remove the connector for everyone, and the company can switch off a person’s access in the server itself (Claude Help Center).	The employee, the owner and the company

The layer that holds whatever Claude asks is the server’s own access. The settings in Claude add a second check on top.

Start with reading, add writing later

Start with an MCP server that only reads. It answers questions, and it cannot change anything in the systems behind it.

Add writing later, one tool at a time, when there is a job that needs it. A good first write tool makes drafts that a person approves in the system they already use, such as a draft entry in the accounting system that the server can never post. Writing through an MCP server is a step like any other, and the three sign-off zones, “acts alone”, “asks first” and “the operator signs off”, decide who checks it. Read When may an AI agent act on its own?

Keep write tools switched off when employees use Research in Claude. In Research, Claude can call connector tools without asking for approval each time, and Anthropic advises disabling tools that can write (Claude Help Center).

What can go wrong

MCP itself cannot enforce security; the specification leaves that to the applications and servers that use it (MCP specification). The risks below are the ones to plan for:

Risk	What it looks like	What limits it
Prompt injection	Text in an invoice, an email or a server’s tool description is written to make Claude do something nobody asked for	Only your own or trusted servers; access the model cannot widen; read-only first
Access that is too broad	The server’s identity can read every dataset or write to every table	Only the rights its tools need; a tier per role
A shared credential	Everyone reaches the system with the same key, so the server cannot tell who asked	Sign-in per person
Tools that change	A server’s tools are updated and start doing something new	Your own server, changed only after review; tool permissions in Claude

Anthropic gives the same advice for custom connectors: connect only to servers you trust, grant only the access needed, and watch what the tools do (Claude Help Center). Where to put the limits an AI agent cannot cross, and how to test them, is explained in What are guardrails for an AI agent, and who enforces them?

Checked against Anthropic’s documentation on 31 October 2026.