One read of Claude Documentationclaude-docs-20261020T180705Z
246 pages moved out of 277 read.
Pages moved
246
significant first
Pages read
277
in this capture
Captured
18:07 UTC
Corpus hash
cf94986ff2f8
corpus-hash
What this read moved
126-150 of 246, page 6 of 10This capture is too large to show at once. Changes 126-150 of 246 are below, significant first; the rest are on the following screens.
connectors/building/troubleshooting Changed · +42 / -48 lines
from line 96
9696
9797**How to fix:** Register the MCP server URL on the API app registration:
9898
99<Steps>
100 <Step title="Open the API app registration">
101 In the [Microsoft Entra admin center](https://entra.microsoft.com), open the app registration that represents your protected API. If you have separate registrations for the OAuth client and the API, this is the API registration, not the client.
102 </Step>
99**1. Open the API app registration**
103100
104 <Step title="Add the MCP server URL as an Application ID URI">
105 Under **Expose an API**, add your MCP server URL as an additional [Application ID URI](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-expose-web-apis). The value must match exactly, including the path, without a trailing slash.
106 </Step>
101In the [Microsoft Entra admin center](https://entra.microsoft.com), open the app registration that represents your protected API. If you have separate registrations for the OAuth client and the API, this is the API registration, not the client.
107102
108 <Step title="Allow the API's token audiences">
109 If your server validates the token audience, such as through Azure App Service Authentication, add the API app's Application (client) ID and its `api://` URI to the allowed token audiences so your server accepts tokens issued for the API. This is the **Allowed token audiences** setting, not **Allowed client applications**, which is a different list.
110 </Step>
103**2. Add the MCP server URL as an Application ID URI**
111104
112 <Step title="Confirm the client's API permission">
113 If the OAuth client and the API are separate app registrations, confirm the client has an admin-consented API permission for the scope your API exposes.
114 </Step>
115</Steps>
105Under **Expose an API**, add your MCP server URL as an additional [Application ID URI](https://learn.microsoft.com/en-us/entra/identity-platform/quickstart-configure-app-expose-web-apis). The value must match exactly, including the path, without a trailing slash.
116106
117<Note>
118 By default, Microsoft Entra accepts a new Application ID URI only if it contains your tenant ID, your app ID, or a domain verified in your tenant, as described in [Microsoft's identifier URI restrictions](https://learn.microsoft.com/en-us/entra/identity-platform/identifier-uri-restrictions). If your MCP server runs on a platform hostname, such as `*.azurewebsites.net`, Entra rejects that URL when you add it under **Expose an API**, so serve the server from a custom domain that your tenant has verified and register that URL instead. A tenant administrator can also exempt your app registration from this policy so that Entra accepts a noncompliant URI. Microsoft notes that an `https://` URI can require a verified domain even then, which makes the custom domain the dependable fix.
119</Note>
107**3. Allow the API's token audiences**
120108
109If your server validates the token audience, such as through Azure App Service Authentication, add the API app's Application (client) ID and its `api://` URI to the allowed token audiences so your server accepts tokens issued for the API. This is the **Allowed token audiences** setting, not **Allowed client applications**, which is a different list.
110
111**4. Confirm the client's API permission**
112
113If the OAuth client and the API are separate app registrations, confirm the client has an admin-consented API permission for the scope your API exposes.
114
115> [!NOTE]
116>
117> By default, Microsoft Entra accepts a new Application ID URI only if it contains your tenant ID, your app ID, or a domain verified in your tenant, as described in [Microsoft's identifier URI restrictions](https://learn.microsoft.com/en-us/entra/identity-platform/identifier-uri-restrictions). If your MCP server runs on a platform hostname, such as `*.azurewebsites.net`, Entra rejects that URL when you add it under **Expose an API**, so serve the server from a custom domain that your tenant has verified and register that URL instead. A tenant administrator can also exempt your app registration from this policy so that Entra accepts a noncompliant URI. Microsoft notes that an `https://` URI can require a verified domain even then, which makes the custom domain the dependable fix.
118
121119If the OAuth flow completes successfully on your server, meaning you see the token issued in your logs, but the connection still fails, file a [GitHub issue](https://github.com/anthropics/claude-ai-mcp/issues) with the `ofid_` reference ID and the timestamps from your server's OAuth logs.
122120
123121## Unexpected error while invoking tool
from line 124
126124
127125**How to check:** Compare the failing call inside and outside Claude:
128126
129<Steps>
130 <Step title="Run the call in MCP Inspector">
131 Run the same tool call against your server in [MCP Inspector](https://modelcontextprotocol.io/docs/tools/inspector) and compare the result with the error Claude reports.
132 </Step>
127**1. Run the call in MCP Inspector**
133128
134 <Step title="Check your server's logs">
135 Check your server's logs for the tool handler's error at the time of the failure, and whether the failure affects every user of your connector or one account.
136 </Step>
137</Steps>
129Run the same tool call against your server in [MCP Inspector](https://modelcontextprotocol.io/docs/tools/inspector) and compare the result with the error Claude reports.
138130
131**2. Check your server's logs**
132
133Check your server's logs for the tool handler's error at the time of the failure, and whether the failure affects every user of your connector or one account.
134
139135If none of these is the cause, [report the problem](#report-the-problem-to-anthropic) with the tool name and the time of the failure.
140136
141137## Diagnostic checklist
from line 138
142138
143139The checklist covers every cause on this page in the order Claude encounters them during a connection. Run through it before filing an issue.
144140
145<Steps>
146 <Step title="Public DNS resolution">
147 From a network outside your own, confirm `dig +short your-server.example.com` returns a globally routable address.
148 </Step>
141**1. Public DNS resolution**
149142
150 <Step title="Public reachability">
151 From a public network, confirm `curl -i https://your-server.example.com/your-mcp-path` returns a response. A `401` or `405` is fine, and a timeout or connection refused is not.
152 </Step>
143From a network outside your own, confirm `dig +short your-server.example.com` returns a globally routable address.
153144
154 <Step title="No redirect">
155 Run `curl -sI https://your-server.example.com/your-mcp-path` and confirm the response is not a `3xx` redirect to a different host. If it is, register the redirect target instead.
156 </Step>
145**2. Public reachability**
157146
158 <Step title="No WAF block">
159 Check your edge logs for `403` or `429` responses. Allowlist Anthropic's published egress range if needed. See the [IP address reference](https://platform.claude.com/docs/en/api/ip-addresses).
160 </Step>
147From a public network, confirm `curl -i https://your-server.example.com/your-mcp-path` returns a response. A `401` or `405` is fine, and a timeout or connection refused is not.
161148
162 <Step title="Discovery metadata">
163 Confirm `/.well-known/oauth-protected-resource` returns `200` with valid JSON, and that one of `/.well-known/oauth-authorization-server` or `/.well-known/openid-configuration` does the same. Only one is needed. The authorization server metadata should include a `registration_endpoint` (DCR) or advertise `"client_id_metadata_document_supported": true` (CIMD), or you should be using pre-registered credentials, and it should advertise `"code_challenge_methods_supported": ["S256"]`.
164 </Step>
149**3. No redirect**
165150
166 <Step title="Cross-host hint">
167 If your authorization server is on a different host than your MCP server, confirm your protected resource metadata's `authorization_servers` field points at it, and that the authorization server's host is reachable from Anthropic's egress range and answers `/.well-known/openid-configuration` or `/.well-known/oauth-authorization-server`. See [Serve discovery metadata](/docs/connectors/building/authentication#serve-discovery-metadata).
168 </Step>
151Run `curl -sI https://your-server.example.com/your-mcp-path` and confirm the response is not a `3xx` redirect to a different host. If it is, register the redirect target instead.
169152
170 <Step title="Collect the reference ID">
171 Reproduce the failure and copy the `ofid_` value from the error URL, then [report the problem](#report-the-problem-to-anthropic) with it.
172 </Step>
173</Steps>
153**4. No WAF block**
154
155Check your edge logs for `403` or `429` responses. Allowlist Anthropic's published egress range if needed. See the [IP address reference](https://platform.claude.com/docs/en/api/ip-addresses).
156
157**5. Discovery metadata**
158
159Confirm `/.well-known/oauth-protected-resource` returns `200` with valid JSON, and that one of `/.well-known/oauth-authorization-server` or `/.well-known/openid-configuration` does the same. Only one is needed. The authorization server metadata should include a `registration_endpoint` (DCR) or advertise `"client_id_metadata_document_supported": true` (CIMD), or you should be using pre-registered credentials, and it should advertise `"code_challenge_methods_supported": ["S256"]`.
160
161**6. Cross-host hint**
162
163If your authorization server is on a different host than your MCP server, confirm your protected resource metadata's `authorization_servers` field points at it, and that the authorization server's host is reachable from Anthropic's egress range and answers `/.well-known/openid-configuration` or `/.well-known/oauth-authorization-server`. See [Serve discovery metadata](/docs/connectors/building/authentication#serve-discovery-metadata).
164
165**7. Collect the reference ID**
166
167Reproduce the failure and copy the `ofid_` value from the error URL, then [report the problem](#report-the-problem-to-anthropic) with it.
174168
175169## Report the problem to Anthropic
176170
connectors/building/what-to-build Changed · +5 / -7 lines
from line 13
1313
1414This page is for developers deciding which of those pieces their plugin needs. Once you've decided, [Plugin structure and testing](/docs/plugins/build), [Build an MCP server for Claude](/docs/connectors/building/index), and [Publish to the directory](/docs/directory/publish) cover the work.
1515
16<Note>
17 * If you're choosing what to add to your own Claude rather than what to build, see [Connectors, skills, and plugins](/docs/extend/overview), which compares the three from the user's side
18 * If you're building for your own organization and not listing publicly, the same decisions apply, and you distribute the result as a [custom connector](/docs/connectors/custom/add-unlisted#add-a-connector-by-url) and an [organization plugin](/docs/plugins/admin) instead of through the directory
19</Note>
16> [!NOTE]
17>
18> * If you're choosing what to add to your own Claude rather than what to build, see [Connectors, skills, and plugins](/docs/extend/overview), which compares the three from the user's side
19> * If you're building for your own organization and not listing publicly, the same decisions apply, and you distribute the result as a [custom connector](/docs/connectors/custom/add-unlisted#add-a-connector-by-url) and an [organization plugin](/docs/plugins/admin) instead of through the directory
2020
2121## Reach your product with an MCP connector
2222
from line 50
5050
5151The diagram shows what the server and the plugin each give people. The server gives them your connector. The plugin adds your skills and points to that same server.
5252
53<img className="block dark:hidden" src="https://mintcdn.com/claude-ai/-njlLvrWxFCRdJVz/images/extend/what-you-ship.svg?fit=max&auto=format&n=-njlLvrWxFCRdJVz&q=85&s=532adf863a7d27314b67c68b561ee94d" alt="Diagram in two columns. Left, what you ship: 1, a remote MCP server you host, with your tools; 2, a plugin holding a connector entry with your server's URL and skills that teach Claude how to use your product. Right, what people get: your connector, so Claude can reach your product, and your skills, so Claude uses it the way you intend, in Chat, Cowork, and Claude Code. Three straight arrows: from the server across to your connector, labeled people connect to it; from the plugin's connector entry up to the server, labeled points to the same server; and from the plugin's skills across to your skills, labeled people add the plugin." width="1000" height="440" data-path="images/extend/what-you-ship.svg" />
54
55<img className="hidden dark:block" src="https://mintcdn.com/claude-ai/-njlLvrWxFCRdJVz/images/extend/what-you-ship-dark.svg?fit=max&auto=format&n=-njlLvrWxFCRdJVz&q=85&s=c68dde016b86337ca85dfa19c538d95e" alt="Diagram in two columns. Left, what you ship: 1, a remote MCP server you host, with your tools; 2, a plugin holding a connector entry with your server's URL and skills that teach Claude how to use your product. Right, what people get: your connector, so Claude can reach your product, and your skills, so Claude uses it the way you intend, in Chat, Cowork, and Claude Code. Three straight arrows: from the server across to your connector, labeled people connect to it; from the plugin's connector entry up to the server, labeled points to the same server; and from the plugin's skills across to your skills, labeled people add the plugin." width="1000" height="440" data-path="images/extend/what-you-ship-dark.svg" />
53
5654
5755In a plugin, you reference a remote MCP server by URL. If a user has both your directory connector and your plugin installed, Claude sees one set of tools, because the plugin and the connector point at the same server.
5856
connectors/custom/add-unlisted Changed · +101 / -113 lines
from line 6
66
77This page is for people adding a connector to their own Claude and for Team and Enterprise Owners adding one for their organization.
88
9<Note>
10 * If you want a service that's already in the directory, see the [Connectors Directory](/docs/connectors/directory) and connect it from there
11 * If you're building the server yourself, see [Build an MCP server for Claude](/docs/connectors/building/index)
12 * If your server runs inside your private network, see [MCP tunnels](/docs/connectors/mcp-tunnels/overview)
13</Note>
9> [!NOTE]
10>
11> * If you want a service that's already in the directory, see the [Connectors Directory](/docs/connectors/directory) and connect it from there
12> * If you're building the server yourself, see [Build an MCP server for Claude](/docs/connectors/building/index)
13> * If your server runs inside your private network, see [MCP tunnels](/docs/connectors/mcp-tunnels/overview)
1414
1515If you have a server URL, go to [Add a connector by URL](#add-a-connector-by-url). If you have a desktop extension, go to [Install a local connector in the desktop app](#install-a-local-connector-in-the-desktop-app).
1616
from line 27
2727
2828You can add any third-party connector as a custom connector as long as you have the URL of its remote MCP server. On Team and Enterprise plans, an Owner adds the connector for the organization, and members then connect with their own account.
2929
30<Warning>
31 Custom connectors allow connections to unverified services. Claude can access and perform actions within these services, so review [Security and privacy](#security-and-privacy) before you add one.
32</Warning>
30> [!WARNING]
31>
32> Custom connectors allow connections to unverified services. Claude can access and perform actions within these services, so review [Security and privacy](#security-and-privacy) before you add one.
3333
3434### On a Team or Enterprise plan
3535
from line 39
3939
4040Adding the connector in organization settings makes it appear under [**Customize > Connectors**](https://claude.ai/customize/connectors) for members, with the **Custom** label. To add it:
4141
42<Steps>
43 <Step title="Open organization connectors">
44 Go to [**Organization settings > Connectors**](https://claude.ai/admin-settings/connectors).
45 </Step>
42**1. Open organization connectors**
4643
47 <Step title="Add a custom connector">
48 Select **Add**, then **Custom**. If Claude asks for the connector type, choose **Web**.
49 </Step>
44Go to [**Organization settings > Connectors**](https://claude.ai/admin-settings/connectors).
5045
51 <Step title="Enter the server URL">
52 Enter the remote MCP server URL.
53 </Step>
46**2. Add a custom connector**
5447
55 <Step title="Enter OAuth credentials if needed">
56 Optionally, enter an OAuth client ID and secret. See [Choose authentication settings](#choose-authentication-settings).
57 </Step>
48Select **Add**, then **Custom**. If Claude asks for the connector type, choose **Web**.
5849
59 <Step title="Add the connector">
60 Click **Add**.
61 </Step>
62</Steps>
50**3. Enter the server URL**
6351
52Enter the remote MCP server URL.
53
54**4. Enter OAuth credentials if needed**
55
56Optionally, enter an OAuth client ID and secret. See [Choose authentication settings](#choose-authentication-settings).
57
58**5. Add the connector**
59
60Click **Add**.
61
6462#### Connect as a member
6563
6664Once an Owner has added the connector, each member connects to it with their own account:
6765
68<Steps>
69 <Step title="Open Customize > Connectors">
70 Go to **Customize > Connectors**.
71 </Step>
66**1. Open Customize > Connectors**
7267
73 <Step title="Find the custom connector">
74 Find the connector with the **Custom** label.
75 </Step>
68Go to **Customize > Connectors**.
7669
77 <Step title="Connect">
78 Click **Connect** to authenticate.
79 </Step>
80</Steps>
70**2. Find the custom connector**
8171
72Find the connector with the **Custom** label.
73
74**3. Connect**
75
76Click **Connect** to authenticate.
77
8278### On a Free, Pro, or Max plan
8379
8480You add custom connectors to your own account. On the Free plan, you can add one custom connector.
8581
86<Steps>
87 <Step title="Open Customize > Connectors">
88 Go to **Customize > Connectors**.
89 </Step>
82**1. Open Customize > Connectors**
9083
91 <Step title="Add a custom connector">
92 Click **Add custom connector**.
93 </Step>
84Go to **Customize > Connectors**.
9485
95 <Step title="Enter the server URL">
96 Enter the remote MCP server URL.
97 </Step>
86**2. Add a custom connector**
9887
99 <Step title="Enter OAuth credentials if needed">
100 Optionally, enter OAuth credentials. See [Choose authentication settings](#choose-authentication-settings).
101 </Step>
88Click **Add custom connector**.
10289
103 <Step title="Add the connector">
104 Click **Add**.
105 </Step>
106</Steps>
90**3. Enter the server URL**
10791
92Enter the remote MCP server URL.
93
94**4. Enter OAuth credentials if needed**
95
96Optionally, enter OAuth credentials. See [Choose authentication settings](#choose-authentication-settings).
97
98**5. Add the connector**
99
100Click **Add**.
101
108102### Choose authentication settings
109103
110104The layout of the **Add custom connector** dialog varies by organization. If yours shows a name, a URL, and **Advanced settings** on one screen, enter the OAuth client ID and secret under **Advanced settings**. If yours has two steps, it asks you to choose among the settings in this section.
from line 123
129123
130124### Authenticate with request headers
131125
132<Note>
133 Request header authentication is in beta and available to a limited set of organizations. If you don't see the **Request headers** section in the **Add custom connector** dialog, your organization doesn't have access yet.
134</Note>
126> [!NOTE]
127>
128> Request header authentication is in beta and available to a limited set of organizations. If you don't see the **Request headers** section in the **Add custom connector** dialog, your organization doesn't have access yet.
135129
136130If your MCP server authenticates with an API key, bearer token, or other fixed credential instead of OAuth, configure it in the **Request headers** section of the **Add custom connector** dialog. Claude stores each header value securely, doesn't show it again after you save, and sends it on every request to your server.
137131
from line 137
143137
144138A request header holds a fixed credential, such as an API key, that Claude stores and sends on every request to your server. To add one:
145139
146<Steps>
147 <Step title="Open Request headers">
148 In the **Add custom connector** dialog, open **Request headers**.
149 </Step>
140**1. Open Request headers**
150141
151 <Step title="Choose the header name">
152 Select a header name from the list, or choose **Custom header** to enter a different name. The list offers standard authentication and routing header names such as `authorization`, `x-api-key`, and `x-auth-token`, which every connector can use.
153 </Step>
142In the **Add custom connector** dialog, open **Request headers**.
154143
155 <Step title="Enter the value">
156 Enter the header value exactly as your server expects to receive it.
157 </Step>
144**2. Choose the header name**
158145
159 <Step title="Mark it required or optional">
160 Choose whether the header is **Required**. When a required header has no stored value at connection time, the connection fails. When an optional header has no value, Claude omits it from the request.
161 </Step>
146Select a header name from the list, or choose **Custom header** to enter a different name. The list offers standard authentication and routing header names such as `authorization`, `x-api-key`, and `x-auth-token`, which every connector can use.
162147
163 <Step title="Add more headers and save">
164 Repeat for any additional headers your server needs, then click **Add**. You can add up to four headers.
165 </Step>
166</Steps>
148**3. Enter the value**
167149
150Enter the header value exactly as your server expects to receive it.
151
152**4. Mark it required or optional**
153
154Choose whether the header is **Required**. When a required header has no stored value at connection time, the connection fails. When an optional header has no value, Claude omits it from the request.
155
156**5. Add more headers and save**
157
158Repeat for any additional headers your server needs, then click **Add**. You can add up to four headers.
159
168160Anthropic reviews and approves each custom header name before Claude sends it to a third-party server. This review prevents connector configuration from being used to send arbitrary header names. If you enter a header name that isn't approved, Claude rejects the save with an error. To request approval for a custom header name, contact [Claude support](https://support.claude.com/en/articles/9015913-how-to-get-support).
169161
170162#### Enter the full header value
from line 178
186178
187179You can edit a connector's name or URL, or remove the connector:
188180
189<Steps>
190 <Step title="Open your connectors">
191 Go to **Customize > Connectors**. If you're a Team or Enterprise Owner, go to **Organization settings > Connectors** instead.
192 </Step>
181**1. Open your connectors**
193182
194 <Step title="Remove or open the menu">
195 Click **Remove**, or select the three-dot menu.
196 </Step>
183Go to **Customize > Connectors**. If you're a Team or Enterprise Owner, go to **Organization settings > Connectors** instead.
197184
198 <Step title="Follow the prompts">
199 Follow the prompts.
200 </Step>
201</Steps>
185**2. Remove or open the menu**
202186
187Click **Remove**, or select the three-dot menu.
188
189**3. Follow the prompts**
190
191Follow the prompts.
192
203193You can't change authentication settings after you add a connector. That covers OAuth credentials and request headers. To change them, remove the connector and add it again with the new details. Members then need to reconnect.
204194
205195## Install a local connector in the desktop app
from line 200
210200
211201To install an extension you have as a `.mcpb` file:
212202
213<Steps>
214 <Step title="Open Settings > Extensions">
215 In the Claude desktop app, go to **Settings > Extensions**.
216 </Step>
203**1. Open Settings > Extensions**
217204
218 <Step title="Drag in the file">
219 Drag the `.mcpb` file onto the page. Claude opens a preview of the extension.
220 </Step>
205In the Claude desktop app, go to **Settings > Extensions**.
221206
222 <Step title="Install">
223 Select **Install**, then confirm.
224 </Step>
225</Steps>
207**2. Drag in the file**
208
209Drag the `.mcpb` file onto the page. Claude opens a preview of the extension.
210
211**3. Install**
212
213Select **Install**, then confirm.
226214
227215The extension then appears in the list on the **Extensions** page.
228216
connectors/directory Changed · +12 / -14 lines
from line 6
66
77The directory contains both verified connectors and community connectors. Verification isn't a security audit. [Connector verification](/docs/connectors/verification) explains what each label means.
88
9<Note>
10 All connectors in the directory are subject to the [Anthropic Software Directory Policy](https://support.claude.com/en/articles/13145358-anthropic-software-directory-policy) and the [Anthropic Software Directory Terms](https://support.claude.com/en/articles/13145338-anthropic-software-directory-terms).
11</Note>
9> [!NOTE]
10>
11> All connectors in the directory are subject to the [Anthropic Software Directory Policy](https://support.claude.com/en/articles/13145358-anthropic-software-directory-policy) and the [Anthropic Software Directory Terms](https://support.claude.com/en/articles/13145338-anthropic-software-directory-terms).
1212
1313## Understand how the directory works
1414
from line 54
5454
5555Organizations can submit their MCP servers for review and inclusion in the directory:
5656
57<Steps>
58 <Step title="Review the submission guidelines">
59 Review the [submission guidelines](/docs/connectors/building/submission).
60 </Step>
57**1. Review the submission guidelines**
6158
62 <Step title="Meet the standards">
63 Ensure your server meets security and compatibility standards.
64 </Step>
59Review the [submission guidelines](/docs/connectors/building/submission).
6560
66 <Step title="Submit in the developer portal">
67 Submit through the developer portal at [claude.ai/directory/manage](https://claude.ai/directory/manage).
68 </Step>
69</Steps>
61**2. Meet the standards**
62
63Ensure your server meets security and compatibility standards.
64
65**3. Submit in the developer portal**
66
67Submit through the developer portal at [claude.ai/directory/manage](https://claude.ai/directory/manage).
7068
7169Anyone on a paid Claude plan can submit, and on Team and Enterprise an Owner submits; see [who can submit to the directory](/docs/directory/publish#confirm-you-can-submit-to-the-directory) for the role and organization requirements. After publication, the same dashboard shows your server's health and usage; see [Manage your directory listing](/docs/connectors/building/managing-your-listing).
7270
connectors/getting-started Changed · +37 / -41 lines
from line 8
88
99If you already know which connector you want, open [**Customize > Connectors**](https://claude.ai/customize/connectors) and follow [Add a connector from the directory](#add-a-connector-from-the-directory).
1010
11<Note>
12 * If the service you want isn't in the directory and you have its server URL, see [Add a connector that isn't in the directory](/docs/connectors/custom/add-unlisted#add-a-connector-by-url)
13 * If you're building a connector, see [Build an MCP server for Claude](/docs/connectors/building/index)
14 * If you're a Team or Enterprise Owner deciding which connectors your organization offers, see [Browse the directory](/docs/connectors/directory#browse-the-directory) to add them from organization settings and handle member requests
15</Note>
11> [!NOTE]
12>
13> * If the service you want isn't in the directory and you have its server URL, see [Add a connector that isn't in the directory](/docs/connectors/custom/add-unlisted#add-a-connector-by-url)
14> * If you're building a connector, see [Build an MCP server for Claude](/docs/connectors/building/index)
15> * If you're a Team or Enterprise Owner deciding which connectors your organization offers, see [Browse the directory](/docs/connectors/directory#browse-the-directory) to add them from organization settings and handle member requests
1616
1717## Before you begin
1818
from line 27
2727
2828The Connectors directory lists the connectors that Anthropic and other providers offer. You reach it from **Customize**, the page in claude.ai and the desktop app that holds your connectors, skills, and plugins.
2929
30<Steps>
31 <Step title="Open the Connectors page">
32 Go to [**Customize > Connectors**](https://claude.ai/customize/connectors). In the desktop app, select **Customize** in the sidebar, then **Connectors**.
33 </Step>
30**1. Open the Connectors page**
3431
35 <Step title="Find the connector">
36 Select **Discover** to browse the directory. Enter a service name in **Search connectors**, or look through the categories, then select a connector to open its page.
32Go to [**Customize > Connectors**](https://claude.ai/customize/connectors). In the desktop app, select **Customize** in the sidebar, then **Connectors**.
3733
38 Each listing carries a Verified or Community label. [Connector verification](/docs/connectors/verification) explains what each one means.
39 </Step>
34**2. Find the connector**
4035
41 <Step title="Start the connection">
42 Select **Connect to Claude**. Some connectors first ask for details such as a server URL or the region your account is hosted in. Enter them and continue.
36Select **Discover** to browse the directory. Enter a service name in **Search connectors**, or look through the categories, then select a connector to open its page.
4337
44 On a Team or Enterprise plan, what you see depends on whether the connector has been added for your organization:
38Each listing carries a Verified or Community label. [Connector verification](/docs/connectors/verification) explains what each one means.
4539
46 * If it hasn't, you see **Request** or a note to ask an organization Owner instead of a connect button. [Request a connector on a Team plan](/docs/connectors/directory#request-a-connector-on-a-team-plan) covers what happens next
47 * If you're an Owner, the button reads **Connect for your team** and adds the connector for everyone in your organization. You then connect your own account with **Connect to Claude**. To try the connector without adding it for everyone, select the arrow next to **Connect for your team**, then **Connect just for me**
48 </Step>
40**3. Start the connection**
4941
50 <Step title="Sign in to the service">
51 Claude takes you to the service's sign-in page:
42Select **Connect to Claude**. Some connectors first ask for details such as a server URL or the region your account is hosted in. Enter them and continue.
5243
53 * On claude.ai, the page opens in the same browser tab
54 * In the desktop app, the page opens in your browser
44On a Team or Enterprise plan, what you see depends on whether the connector has been added for your organization:
5545
56 Sign in, review the access Claude asks for, and approve it.
46* If it hasn't, you see **Request** or a note to ask an organization Owner instead of a connect button. [Request a connector on a Team plan](/docs/connectors/directory#request-a-connector-on-a-team-plan) covers what happens next
47* If you're an Owner, the button reads **Connect for your team** and adds the connector for everyone in your organization. You then connect your own account with **Connect to Claude**. To try the connector without adding it for everyone, select the arrow next to **Connect for your team**, then **Connect just for me**
5748
58 A connector that doesn't use sign-in connects as soon as you select the button, with no page to visit.
59 </Step>
49**4. Sign in to the service**
6050
61 <Step title="Confirm the connection">
62 When sign-in finishes and you're back on the **Connectors** page, the connector is listed under **Your connectors** with the status **Connected**.
63 </Step>
64</Steps>
51Claude takes you to the service's sign-in page:
6552
53* On claude.ai, the page opens in the same browser tab
54* In the desktop app, the page opens in your browser
55
56Sign in, review the access Claude asks for, and approve it.
57
58A connector that doesn't use sign-in connects as soon as you select the button, with no page to visit.
59
60**5. Confirm the connection**
61
62When sign-in finishes and you're back on the **Connectors** page, the connector is listed under **Your connectors** with the status **Connected**.
63
6664## Use the connector in a conversation
6765
6866A connected connector is available in your conversations on the web, desktop, and mobile. You choose in each conversation whether Claude can use it.
6967
70<Steps>
71 <Step title="Make sure the connector is on">
72 In a new or existing chat, select **+** in the message box and select **Connectors**. The connector you connected is in the list with a toggle next to it. The toggle controls whether Claude can use the connector in this conversation. If it's off, turn it on.
73 </Step>
68**1. Make sure the connector is on**
7469
75 <Step title="Ask for something the service holds">
76 Send a message that needs the service, such as "What's on my calendar tomorrow afternoon?" for a calendar connector or "Summarize the open issues assigned to me" for an issue tracker.
77 </Step>
70In a new or existing chat, select **+** in the message box and select **Connectors**. The connector you connected is in the list with a toggle next to it. The toggle controls whether Claude can use the connector in this conversation. If it's off, turn it on.
7871
79 <Step title="Approve the tool call">
80 Claude can ask for your approval before it uses one of the connector's tools. Select **Allow once** to continue, or **Always allow** to skip the prompt for that tool from now on. You can change this later under the connector's [tool permissions](#manage-or-disconnect-a-connector).
81 </Step>
82</Steps>
72**2. Ask for something the service holds**
73
74Send a message that needs the service, such as "What's on my calendar tomorrow afternoon?" for a calendar connector or "Summarize the open issues assigned to me" for an issue tracker.
75
76**3. Approve the tool call**
77
78Claude can ask for your approval before it uses one of the connector's tools. Select **Allow once** to continue, or **Always allow** to skip the prompt for that tool from now on. You can change this later under the connector's [tool permissions](#manage-or-disconnect-a-connector).
8379
8480To stop Claude from using a connector in a conversation, turn its toggle off in the same **+** menu. The connector stays connected: Claude is still signed in to the service on your account, and you can turn the toggle back on in any conversation. To sign Claude out of the service entirely, [disconnect the connector](#manage-or-disconnect-a-connector).
8581
connectors/github/index Changed · +45 / -51 lines
from line 6
66
77By the end of this page you have added repository content to a chat or a project and asked Claude about it. Claude reads file names and contents only: it doesn't see commit history, pull requests, or issues.
88
9<Note>
10 If you want Claude to edit code, run commands, and open pull requests in your repository, see [Claude Code](https://code.claude.com/docs).
11</Note>
9> [!NOTE]
10>
11> If you want Claude to edit code, run commands, and open pull requests in your repository, see [Claude Code](https://code.claude.com/docs).
1212
1313## Add repository content
1414
1515You can add repository content to a single conversation, or to a [project](https://support.claude.com/en/articles/9517075-what-are-projects), a workspace in Claude where a set of chats share the same background documents. Choose the tab below for where you want the content available.
1616
17<Tabs>
18 <Tab title="In a chat">
19 In a chat, the **Add from GitHub** option appears only after your GitHub account is connected to Claude. To connect your GitHub account, follow these steps:
17**In a chat**
2018
21 1. Go to [**Customize > Connectors**](https://claude.ai/customize/connectors).
22 2. Select **GitHub Integration**.
23 3. Select **Connect**.
19In a chat, the **Add from GitHub** option appears only after your GitHub account is connected to Claude. To connect your GitHub account, follow these steps:
2420
25 After your GitHub account is connected, add a repository to a chat:
211. Go to [**Customize > Connectors**](https://claude.ai/customize/connectors).
222. Select **GitHub Integration**.
233. Select **Connect**.
2624
27 <Steps>
28 <Step title="Open the add menu">
29 In the conversation, select **+** at the lower left of the message box.
30 </Step>
25After your GitHub account is connected, add a repository to a chat:
3126
32 <Step title="Choose GitHub">
33 Select **Add from GitHub**.
34 </Step>
27**1. Open the add menu**
3528
36 <Step title="Pick a repository">
37 Search the repositories you have access to, or paste a repository URL.
38 </Step>
29In the conversation, select **+** at the lower left of the message box.
3930
40 <Step title="Add the repository">
41 Select **Add repository**. Claude adds the repository's URL to your message.
42 </Step>
31**2. Choose GitHub**
4332
44 <Step title="Send your message">
45 Send your question.
46 </Step>
47 </Steps>
48 </Tab>
33Select **Add from GitHub**.
4934
50 <Tab title="In a project">
51 You can add repository content only to a private project, one you haven't shared with other people. In a shared project, the **GitHub** option is dimmed and shows **Only accessible from private projects**.
35**3. Pick a repository**
5236
53 If your GitHub account isn't connected to Claude yet, selecting **GitHub** sends you to GitHub to sign in before you continue.
37Search the repositories you have access to, or paste a repository URL.
5438
55 <Steps>
56 <Step title="Open project knowledge">
57 Open the project and, in its project knowledge section, select **+**.
58 </Step>
39**4. Add the repository**
5940
60 <Step title="Choose GitHub">
61 Select **GitHub**.
62 </Step>
41Select **Add repository**. Claude adds the repository's URL to your message.
6342
64 <Step title="Pick a repository">
65 Search the repositories you have access to, or paste a repository URL.
66 </Step>
43**5. Send your message**
6744
68 <Step title="Select files and folders">
69 Use the file browser to select the files and folders you want Claude to read.
70 </Step>
45Send your question.
7146
72 <Step title="Add the files">
73 Select **Add files**.
74 </Step>
75 </Steps>
47**In a project**
7648
77 The selected content is added to the project's knowledge.
78 </Tab>
79</Tabs>
49You can add repository content only to a private project, one you haven't shared with other people. In a shared project, the **GitHub** option is dimmed and shows **Only accessible from private projects**.
50
51If your GitHub account isn't connected to Claude yet, selecting **GitHub** sends you to GitHub to sign in before you continue.
52
53**1. Open project knowledge**
54
55Open the project and, in its project knowledge section, select **+**.
56
57**2. Choose GitHub**
58
59Select **GitHub**.
60
61**3. Pick a repository**
62
63Search the repositories you have access to, or paste a repository URL.
64
65**4. Select files and folders**
66
67Use the file browser to select the files and folders you want Claude to read.
68
69**5. Add the files**
70
71Select **Add files**.
72
73The selected content is added to the project's knowledge.
8074
8175## Grant Claude access to a private repository
8276
connectors/google/calendar Changed · +12 / -14 lines
from line 6
66
77By the end of this page you have connected your Google account and asked Claude a first question about your schedule. Claude reads your calendar only; it can't create or change events or send invitations.
88
9<Note>
10 If your organization uses Outlook or Teams calendars, see [Microsoft 365](/docs/connectors/microsoft/365) instead.
11</Note>
9> [!NOTE]
10>
11> If your organization uses Outlook or Teams calendars, see [Microsoft 365](/docs/connectors/microsoft/365) instead.
1212
1313## Connect Google Calendar
1414
1515You connect Google Calendar once from your connector settings, and Claude can then read your calendar in any conversation where you turn the connector on.
1616
17<Steps>
18 <Step title="Open your connectors">
19 Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins.
20 </Step>
17**1. Open your connectors**
2118
22 <Step title="Connect Google Calendar">
23 Find **Google Calendar** in the list and select **Connect**.
24 </Step>
19Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins.
2520
26 <Step title="Sign in to Google">
27 Sign in to your Google account and grant the requested permissions.
28 </Step>
29</Steps>
21**2. Connect Google Calendar**
22
23Find **Google Calendar** in the list and select **Connect**.
24
25**3. Sign in to Google**
26
27Sign in to your Google account and grant the requested permissions.
3028
3129When the connection succeeds, the **Connect** button on the Google Calendar connector changes to **Disconnect**.
3230
connectors/google/drive Changed · +39 / -47 lines
from line 6
66
77To get going, [connect Google Drive](#connect-google-drive) and then [try a first question](#try-the-connector).
88
9<Note>
10 If you want Claude to search your email or calendar rather than your files, see [Gmail](/docs/connectors/google/gmail) or [Google Calendar](/docs/connectors/google/calendar).
11</Note>
9> [!NOTE]
10>
11> If you want Claude to search your email or calendar rather than your files, see [Gmail](/docs/connectors/google/gmail) or [Google Calendar](/docs/connectors/google/calendar).
1212
1313## Connect Google Drive
1414
1515You connect Google Drive once from your connector settings, and Claude can then use it in any conversation where you turn the connector on.
1616
17<Steps>
18 <Step title="Open your connectors">
19 Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins.
20 </Step>
17**1. Open your connectors**
2118
22 <Step title="Connect Google Drive">
23 Find **Google Drive** in the list and select **Connect**.
24 </Step>
19Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins.
2520
26 <Step title="Sign in to Google">
27 Sign in to your Google account and grant the requested permissions.
28 </Step>
29</Steps>
21**2. Connect Google Drive**
3022
23Find **Google Drive** in the list and select **Connect**.
24
25**3. Sign in to Google**
26
27Sign in to your Google account and grant the requested permissions.
28
3129When the connection succeeds, the **Connect** button on the Google Drive connector changes to **Disconnect**.
3230
3331On Team and Enterprise plans, Google Drive doesn't appear in your connector list until an Owner adds it for your organization. Each member then connects their own Google account. For the full walkthrough, including troubleshooting, see [Get started with connectors](/docs/connectors/getting-started).
from line 53
5553
5654Besides letting Claude search on its own, you can pick specific Drive files yourself. A file you pick is attached to the conversation, or added to a [project](https://support.claude.com/en/articles/9517075-what-are-projects)'s knowledge so every chat in that project can use it. The picker lists your Google Docs, Sheets, and Slides.
5755
58<Tabs>
59 <Tab title="In a chat">
60 <Steps>
61 <Step title="Open the add menu">
62 In the conversation, select **+** at the lower left of the message box.
63 </Step>
56**In a chat**
6457
65 <Step title="Choose Google Drive">
66 Select **Add from Google Drive**.
67 </Step>
58**1. Open the add menu**
6859
69 <Step title="Pick a file">
70 Search for the file by name, or select it from the list.
71 </Step>
60In the conversation, select **+** at the lower left of the message box.
7261
73 <Step title="Send your message">
74 Write your question and send it. Claude reads the file's current content from Drive each time you send a message, so later edits in Drive reach Claude too.
75 </Step>
76 </Steps>
77 </Tab>
62**2. Choose Google Drive**
7863
79 <Tab title="In a project">
80 You can add Drive files only to a private project, one you haven't shared with other people. In a shared project, the **Google Drive** option is dimmed and shows **Only accessible from private projects**. To add a file to a private project's knowledge:
64Select **Add from Google Drive**.
8165
82 <Steps>
83 <Step title="Open the add menu">
84 Open the project and, in its knowledge section, select **Add files**.
85 </Step>
66**3. Pick a file**
8667
87 <Step title="Choose Google Drive">
88 Select **Google Drive**.
89 </Step>
68Search for the file by name, or select it from the list.
9069
91 <Step title="Pick a file">
92 Search for the file, paste its Google Drive URL, or select it from the list.
93 </Step>
94 </Steps>
70**4. Send your message**
9571
96 The file appears in the project's knowledge and is available to Claude in every chat in that project. Its content refreshes from Drive periodically when you open the project.
97 </Tab>
98</Tabs>
72Write your question and send it. Claude reads the file's current content from Drive each time you send a message, so later edits in Drive reach Claude too.
73
74**In a project**
75
76You can add Drive files only to a private project, one you haven't shared with other people. In a shared project, the **Google Drive** option is dimmed and shows **Only accessible from private projects**. To add a file to a private project's knowledge:
77
78**1. Open the add menu**
79
80Open the project and, in its knowledge section, select **Add files**.
81
82**2. Choose Google Drive**
83
84Select **Google Drive**.
85
86**3. Pick a file**
87
88Search for the file, paste its Google Drive URL, or select it from the list.
89
90The file appears in the project's knowledge and is available to Claude in every chat in that project. Its content refreshes from Drive periodically when you open the project.
9991
10092Claude receives a text version of each file you add this way:
10193
connectors/google/gmail Changed · +12 / -14 lines
from line 6
66
77By the end of this page you have connected your Google account and asked Claude a first question about your email. Claude reads and searches email only; it can't create, send, or modify messages.
88
9<Note>
10 If your organization uses Outlook, see [Microsoft 365](/docs/connectors/microsoft/365) instead.
11</Note>
9> [!NOTE]
10>
11> If your organization uses Outlook, see [Microsoft 365](/docs/connectors/microsoft/365) instead.
1212
1313## Connect Gmail
1414
1515You connect Gmail once from your connector settings, and Claude can then search your email in any conversation where you turn the connector on.
1616
17<Steps>
18 <Step title="Open your connectors">
19 Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins.
20 </Step>
17**1. Open your connectors**
2118
22 <Step title="Connect Gmail">
23 Find **Gmail** in the list and select **Connect**.
24 </Step>
19Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins.
2520
26 <Step title="Sign in to Google">
27 Sign in to your Google account and grant the requested permissions.
28 </Step>
29</Steps>
21**2. Connect Gmail**
22
23Find **Gmail** in the list and select **Connect**.
24
25**3. Sign in to Google**
26
27Sign in to your Google account and grant the requested permissions.
3028
3129When the connection succeeds, the **Connect** button on the Gmail connector changes to **Disconnect**.
3230
connectors/mcp-tunnels/oauth Changed · +6 / -6 lines
from line 2
22
33> Make OAuth sign-in work for MCP servers reached through an MCP tunnel when the authorization server or identity provider is inside your network.
44
5<Note>
6 MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team.
7</Note>
5> [!NOTE]
6>
7> MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team.
88
99An MCP tunnel carries Claude's requests to an MCP server inside your network, but it does not authenticate to that server. Each tunneled server should still require OAuth, as the [MCP authorization specification](https://modelcontextprotocol.io/specification/2025-11-25/basic/authorization) describes, so that a member signs in with their own account before Claude can call the server's tools. This page is for the administrator adding a tunneled server as a custom connector, and explains what to configure when the OAuth authorization server is itself only reachable inside your network.
1010
11<Note>
12 If your authorization server is reachable from the public internet and its metadata advertises public URLs, you don't need anything on this page. Add the connector as described in [Set up an MCP tunnel](/docs/connectors/mcp-tunnels/setup#add-tunneled-servers-as-connectors), and members sign in as they would for any other connector.
13</Note>
11> [!NOTE]
12>
13> If your authorization server is reachable from the public internet and its metadata advertises public URLs, you don't need anything on this page. Add the connector as described in [Set up an MCP tunnel](/docs/connectors/mcp-tunnels/setup#add-tunneled-servers-as-connectors), and members sign in as they would for any other connector.
1414
1515## Understand how OAuth works through a tunnel
1616
connectors/mcp-tunnels/overview Changed · +6 / -6 lines
from line 2
22
33> Connect Claude to MCP servers inside your private network without opening inbound firewall ports or exposing the servers to the internet.
44
5<Note>
6 MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team. The preview is provided as-is, without uptime, support, or continuity commitments, and it depends on a third-party network provider (Cloudflare) that makes no availability commitment for the underlying transport. Anthropic may modify or discontinue MCP tunnels at any time.
7</Note>
5> [!NOTE]
6>
7> MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team. The preview is provided as-is, without uptime, support, or continuity commitments, and it depends on a third-party network provider (Cloudflare) that makes no availability commitment for the underlying transport. Anthropic may modify or discontinue MCP tunnels at any time.
88
99MCP tunnels connect Claude to [Model Context Protocol (MCP)](/docs/connectors/building/mcp) servers that run inside your private network. You run a small tunnel stack on a host in your network, the stack opens an outbound-only connection to Anthropic, and Claude sends MCP requests to your servers over that connection. Your firewall needs no inbound rules and your MCP servers need no public endpoint. Members of your organization use the tunneled servers as [custom connectors](/docs/connectors/custom/add-unlisted#add-a-connector-by-url) in Claude, the same way they use any other remote MCP server.
1010
from line 76
7676| | Restricting network access for the proxy hosts and MCP servers |
7777| | Notifying Anthropic if you suspect a compromise |
7878
79<Warning>
80 An attacker who obtains your tunnel token and one of your TLS private keys could impersonate your proxy and read MCP request payloads, including OAuth tokens. Store both with your organization's secrets-management controls, restrict file permissions, and rotate them on a schedule and immediately after any suspected exposure. See [Rotate credentials](/docs/connectors/mcp-tunnels/setup#rotate-credentials).
81</Warning>
79> [!WARNING]
80>
81> An attacker who obtains your tunnel token and one of your TLS private keys could impersonate your proxy and read MCP request payloads, including OAuth tokens. Store both with your organization's secrets-management controls, restrict file permissions, and rotate them on a schedule and immediately after any suspected exposure. See [Rotate credentials](/docs/connectors/mcp-tunnels/setup#rotate-credentials).
8282
8383## Limits
8484
connectors/mcp-tunnels/setup Changed · +397 / -429 lines
The two sides of this change are more than 400 edits apart, too far apart to line up, so this is the differ's own diff of it and the words inside a line are not marked.
from line 2
22
33> Create a Tunnels API key, deploy the MCP tunnel stack with Helm or Docker Compose, verify the connection, and add tunneled MCP servers as custom connectors.
44
5<Note>
6 MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team.
7</Note>
5> [!NOTE]
6>
7> MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team.
88
99This page covers the full setup of an MCP tunnel for a claude.ai Enterprise organization, from creating the API key that provisioning uses to members calling a tunneled MCP server from Claude. You need the Owner or Primary Owner role in claude.ai, and someone who can deploy containers to a Kubernetes cluster or a Docker host inside your network. Read [MCP tunnels](/docs/connectors/mcp-tunnels/overview) first if the tunnel stack, the tunnel domain, and routes are unfamiliar.
1010
from line 12
1212
1313The setup component that runs alongside the tunnel stack needs a short-lived credential to create the tunnel, register its certificate authority (CA) certificate with Anthropic, and fetch the tunnel token. In claude.ai that credential is a Tunnels API key.
1414
15<Steps>
16 <Step title="Open Organization settings > Tunnels">
17 In claude.ai, go to **Organization settings > Tunnels**. This page appears once Anthropic has enabled MCP tunnels for your organization.
18 </Step>
19
20 <Step title="Create a key">
21 Open **Tunnels API** and create a key.
22 </Step>
23
24 <Step title="Copy the key">
25 Copy the key somewhere safe for the next section. You pass it to the setup component once.
26 </Step>
27</Steps>
15**1. Open Organization settings > Tunnels**
16
17In claude.ai, go to **Organization settings > Tunnels**. This page appears once Anthropic has enabled MCP tunnels for your organization.
18
19**2. Create a key**
20
21Open **Tunnels API** and create a key.
22
23**3. Copy the key**
24
25Copy the key somewhere safe for the next section. You pass it to the setup component once.
2826
2927The tunnel stack does not use the key at runtime. Revoke the key as soon as setup completes, and create a fresh one later when you rotate the tunnel token.
3028
from line 34
3634
3735Both the Helm and Docker Compose paths need at least one route. A route maps a subdomain of your tunnel domain to the internal URL of an MCP server, in the form `scheme://host:port` with no path. The examples use `docs` pointing at `http://docs-mcp.example.corp:8080`. Replace them with your own servers.
3836
39<Tabs>
40 <Tab title="Helm">
41 <Steps>
42 <Step title="Fetch the default values">
43 ```bash theme={null}
44 helm show values \
45 oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
46 --version 2.1.0 > values.yaml
47 ```
48
49 The file includes comments explaining each field.
50 </Step>
51
52 <Step title="Configure routes">
53 Edit `values.yaml` and add a `routes` entry under `gateway.config` for each MCP server. Leave `tunnel.id` empty so the setup component creates the tunnel during install.
54
55 ```yaml values.yaml theme={null}
56 tunnel:
57 id: ""
58 # Increment to rotate the tunnel token on a later upgrade.
59 tokenVersion: "1"
60
61 gateway:
62 config:
63 routes:
64 docs: http://docs-mcp.example.corp:8080
65 search: http://10.0.12.7:9000
66 ```
67
68 With these routes, Claude reaches the servers at `docs.<your-tunnel-domain>` and `search.<your-tunnel-domain>`. If a route targets an address outside the RFC 1918 private ranges (some managed Kubernetes distributions allocate Service IPs elsewhere), add the range under `gateway.config.upstream.allowed_ips` as described in [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting#proxy-logs-ip-validation-failed).
69 </Step>
70
71 <Step title="Review the rendered manifests">
72 Render the chart with a placeholder key and review the output according to your organization's practices for third-party manifests. Rendering makes no API calls.
73
74 ```bash theme={null}
75 helm template mcp-tunnel \
76 oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
77 --version 2.1.0 \
78 -n mcp-tunnel \
79 -f values.yaml \
80 --set api.token=placeholder > rendered.yaml
81 ```
82 </Step>
83
84 <Step title="Install">
85 Read the Tunnels API key into an environment variable so it stays out of your shell history and values file, then install into a dedicated namespace.
86
87 ```bash theme={null}
88 # Paste the Tunnels API key (input is hidden)
89 read -rs API_TOKEN && export API_TOKEN
90
91 helm install mcp-tunnel \
92 oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
93 --version 2.1.0 \
94 --namespace mcp-tunnel --create-namespace \
95 -f values.yaml \
96 --set api.token="$API_TOKEN"
97 ```
98
99 The setup component runs as a pre-install hook, so `helm install` blocks until the tunnel is created, the CA is registered, and the credentials are stored in the `mcp-tunnel` Secret. If the install fails with a hook error, see [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting#helm-install-fails-with-a-hook-error).
100
101 <Warning>
102 Revoke the Tunnels API key in **Organization settings > Tunnels > Tunnels API** as soon as the install completes. Helm records `--set` values in its release history Secrets, and Kubernetes Secrets are not encrypted at rest by default, so the key remains recoverable from the cluster until you revoke it.
103 </Warning>
104 </Step>
105
106 <Step title="Read the tunnel domain">
107 You need the tunnel domain to add connectors later.
108
109 ```bash theme={null}
110 kubectl -n mcp-tunnel get secret mcp-tunnel \
111 -o jsonpath='{.data.tunnel-domain}' | base64 -d
112 ```
113
114 The value looks like `abc123.tunnel.anthropic.com`.
115 </Step>
116 </Steps>
117
118 To restrict the pod's egress at the network level, set `networkPolicy.enabled: true` in `values.yaml` and list your MCP servers under `networkPolicy.mcpServers`. The policy already allows cloudflared to reach the tunnel edge. Your cluster's network plugin must support NetworkPolicy.
119
120 For later configuration changes such as routes or replica count, edit `values.yaml` and run `helm upgrade` with the same `--version` and `-f values.yaml`, without the API key. Keep a complete `values.yaml` rather than relying on `--reuse-values`, because Helm's deep merge can silently keep a route you deleted.
121 </Tab>
122
123 <Tab title="Docker Compose">
124 <Steps>
125 <Step title="Prepare the deployment directory">
126 ```bash theme={null}
127 mkdir -p mcp-tunnel/{config,data}
128 cd mcp-tunnel
129 sudo chown 65532:65532 data
130 ```
131
132 The containers run as the non-root user ID `65532` and need write access to `data/`.
133 </Step>
134
135 <Step title="Write docker-compose.yaml">
136 The compose file pins images by digest, runs every container as non-root with a read-only filesystem, drops all Linux capabilities, and disables privilege escalation.
137
138 ```bash theme={null}
139 cat > docker-compose.yaml <<'EOF'
140 services:
141 # One-time provisioning. Run with: docker compose run --rm setup
142 setup:
143 image: us-docker.pkg.dev/anthropic-public-registry/images/mcp-proxy@sha256:d243d30642d39857a0579e465cb3b9bf3ae7c1141e83143bb6856777a31467a5
144 entrypoint: ["/setup"]
145 command:
146 - init
147 - --api-url=https://api.anthropic.com
148 - --output=dir:/data
149 - --token-version=1
150 environment:
151 - API_TOKEN
152 volumes:
153 - ./data:/data
154 user: "65532:65532"
155 read_only: true
156 security_opt:
157 - no-new-privileges:true
158 cap_drop:
159 - ALL
160 profiles: ["setup"]
161
162 cloudflared:
163 image: cloudflare/cloudflared@sha256:0e56c13c7058fcef9c4f0e7d83372f82330548dbf8f8b366f3d8b506526d93b2
164 command: tunnel --no-autoupdate run --url http://localhost:8080
165 environment:
166 - TUNNEL_TOKEN
167 # Share the proxy's network namespace so localhost:8080 reaches it.
168 network_mode: "service:mcp-proxy"
169 restart: unless-stopped
170 user: "65532:65532"
171 read_only: true
172 security_opt:
173 - no-new-privileges:true
174 cap_drop:
175 - ALL
176 stop_grace_period: 30s
177 logging:
178 options:
179 max-size: "10m"
180 max-file: "3"
181
182 mcp-proxy:
183 image: us-docker.pkg.dev/anthropic-public-registry/images/mcp-proxy@sha256:d243d30642d39857a0579e465cb3b9bf3ae7c1141e83143bb6856777a31467a5
184 volumes:
185 - ./config/mcp-proxy.yaml:/etc/mcp-gateway/config.yaml:ro
186 - ./data:/data:ro
187 restart: unless-stopped
188 user: "65532:65532"
189 read_only: true
190 security_opt:
191 - no-new-privileges:true
192 cap_drop:
193 - ALL
194 # Match shutdown_timeout in the proxy config
195 stop_grace_period: 30s
196 logging:
197 options:
198 max-size: "10m"
199 max-file: "3"
200 EOF
201 ```
202 </Step>
203
204 <Step title="Provision the tunnel">
205 Read the Tunnels API key into an environment variable, then run the setup component. It creates the tunnel, generates the CA and server certificate, registers the CA with Anthropic, fetches the tunnel token, and writes everything to `data/`.
206
207 ```bash theme={null}
208 # Paste the Tunnels API key (input is hidden)
209 read -rs API_TOKEN && export API_TOKEN
210
211 docker compose run --rm setup
212 ```
213
214 Read the tunnel domain and keep it for later steps.
215
216 ```bash theme={null}
217 export TUNNEL_DOMAIN=$(sudo cat data/tunnel-domain)
218 echo "$TUNNEL_DOMAIN"
219 ```
220
221 <Warning>
222 Revoke the Tunnels API key in **Organization settings > Tunnels > Tunnels API** before continuing, and run `unset API_TOKEN`. The stack does not need the key at runtime.
223 </Warning>
224 </Step>
225
226 <Step title="Write the proxy config">
227 `tunnel_domain` is required so the proxy can strip the domain from incoming hostnames and look up the remaining subdomain in `routes`. `routes` is a map, not a list.
228
229 ```bash theme={null}
230 cat > config/mcp-proxy.yaml <<EOF
231 listen_addr: ":8080"
232 log_level: info
233 shutdown_timeout: 30s
234 tunnel_domain: ${TUNNEL_DOMAIN}
235 tls:
236 cert_file: /data/tls.crt
237 key_file: /data/tls.key
238 routes:
239 docs: http://docs-mcp.example.corp:8080
240 search: http://10.0.12.7:9000
241 upstream:
242 allowed_ips:
243 - 10.0.0.0/8
244 EOF
245 ```
246
247 `upstream.allowed_ips` is the proxy's protection against server-side request forgery. Use the narrowest ranges that cover your MCP servers. Setting it replaces the RFC 1918 default rather than extending it.
248 </Step>
249
250 <Step title="Start the stack">
251 ```bash theme={null}
252 export TUNNEL_TOKEN=$(sudo cat data/tunnel-token)
253 docker compose up -d
254 ```
255
256 The compose file reads `TUNNEL_TOKEN` from the host environment with no default, so repeat the export in every fresh shell and after a reboot. For a multi-host deployment, copy the `mcp-tunnel/` directory to each host and start it the same way. The same tunnel token and certificates work across all replicas.
257 </Step>
258 </Steps>
259
260 The `data/` directory now holds the tunnel ID, tunnel domain, tunnel token, CA key pair, and server key pair. Protect it with your organization's file-permission, encryption-at-rest, and secrets-management controls, and consider moving `ca.key` and `tunnel-token` to secure storage.
261 </Tab>
262</Tabs>
37**Helm**
38
39**1. Fetch the default values**
40
41```bash theme={null}
42helm show values \
43 oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
44 --version 2.1.0 > values.yaml
45```
46
47The file includes comments explaining each field.
48
49**2. Configure routes**
50
51Edit `values.yaml` and add a `routes` entry under `gateway.config` for each MCP server. Leave `tunnel.id` empty so the setup component creates the tunnel during install.
52
53```yaml values.yaml theme={null}
54tunnel:
55 id: ""
56 # Increment to rotate the tunnel token on a later upgrade.
57 tokenVersion: "1"
58
59gateway:
60 config:
61 routes:
62 docs: http://docs-mcp.example.corp:8080
63 search: http://10.0.12.7:9000
64```
65
66With these routes, Claude reaches the servers at `docs.<your-tunnel-domain>` and `search.<your-tunnel-domain>`. If a route targets an address outside the RFC 1918 private ranges (some managed Kubernetes distributions allocate Service IPs elsewhere), add the range under `gateway.config.upstream.allowed_ips` as described in [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting#proxy-logs-ip-validation-failed).
67
68**3. Review the rendered manifests**
69
70Render the chart with a placeholder key and review the output according to your organization's practices for third-party manifests. Rendering makes no API calls.
71
72```bash theme={null}
73helm template mcp-tunnel \
74 oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
75 --version 2.1.0 \
76 -n mcp-tunnel \
77 -f values.yaml \
78 --set api.token=placeholder > rendered.yaml
79```
80
81**4. Install**
82
83Read the Tunnels API key into an environment variable so it stays out of your shell history and values file, then install into a dedicated namespace.
84
85```bash theme={null}
86# Paste the Tunnels API key (input is hidden)
87read -rs API_TOKEN && export API_TOKEN
88
89helm install mcp-tunnel \
90 oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
91 --version 2.1.0 \
92 --namespace mcp-tunnel --create-namespace \
93 -f values.yaml \
94 --set api.token="$API_TOKEN"
95```
96
97The setup component runs as a pre-install hook, so `helm install` blocks until the tunnel is created, the CA is registered, and the credentials are stored in the `mcp-tunnel` Secret. If the install fails with a hook error, see [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting#helm-install-fails-with-a-hook-error).
98
99> [!WARNING]
100>
101> Revoke the Tunnels API key in **Organization settings > Tunnels > Tunnels API** as soon as the install completes. Helm records `--set` values in its release history Secrets, and Kubernetes Secrets are not encrypted at rest by default, so the key remains recoverable from the cluster until you revoke it.
102
103**5. Read the tunnel domain**
104
105You need the tunnel domain to add connectors later.
106
107```bash theme={null}
108kubectl -n mcp-tunnel get secret mcp-tunnel \
109 -o jsonpath='{.data.tunnel-domain}' | base64 -d
110```
111
112The value looks like `abc123.tunnel.anthropic.com`.
113
114To restrict the pod's egress at the network level, set `networkPolicy.enabled: true` in `values.yaml` and list your MCP servers under `networkPolicy.mcpServers`. The policy already allows cloudflared to reach the tunnel edge. Your cluster's network plugin must support NetworkPolicy.
115
116For later configuration changes such as routes or replica count, edit `values.yaml` and run `helm upgrade` with the same `--version` and `-f values.yaml`, without the API key. Keep a complete `values.yaml` rather than relying on `--reuse-values`, because Helm's deep merge can silently keep a route you deleted.
117
118**Docker Compose**
119
120**1. Prepare the deployment directory**
121
122```bash theme={null}
123mkdir -p mcp-tunnel/{config,data}
124cd mcp-tunnel
125sudo chown 65532:65532 data
126```
127
128The containers run as the non-root user ID `65532` and need write access to `data/`.
129
130**2. Write docker-compose.yaml**
131
132The compose file pins images by digest, runs every container as non-root with a read-only filesystem, drops all Linux capabilities, and disables privilege escalation.
133
134```bash theme={null}
135cat > docker-compose.yaml <<'EOF'
136services:
137 # One-time provisioning. Run with: docker compose run --rm setup
138 setup:
139 image: us-docker.pkg.dev/anthropic-public-registry/images/mcp-proxy@sha256:d243d30642d39857a0579e465cb3b9bf3ae7c1141e83143bb6856777a31467a5
140 entrypoint: ["/setup"]
141 command:
142 - init
143 - --api-url=https://api.anthropic.com
144 - --output=dir:/data
145 - --token-version=1
146 environment:
147 - API_TOKEN
148 volumes:
149 - ./data:/data
150 user: "65532:65532"
151 read_only: true
152 security_opt:
153 - no-new-privileges:true
154 cap_drop:
155 - ALL
156 profiles: ["setup"]
157
158 cloudflared:
159 image: cloudflare/cloudflared@sha256:0e56c13c7058fcef9c4f0e7d83372f82330548dbf8f8b366f3d8b506526d93b2
160 command: tunnel --no-autoupdate run --url http://localhost:8080
161 environment:
162 - TUNNEL_TOKEN
163 # Share the proxy's network namespace so localhost:8080 reaches it.
164 network_mode: "service:mcp-proxy"
165 restart: unless-stopped
166 user: "65532:65532"
167 read_only: true
168 security_opt:
169 - no-new-privileges:true
170 cap_drop:
171 - ALL
172 stop_grace_period: 30s
173 logging:
174 options:
175 max-size: "10m"
176 max-file: "3"
177
178 mcp-proxy:
179 image: us-docker.pkg.dev/anthropic-public-registry/images/mcp-proxy@sha256:d243d30642d39857a0579e465cb3b9bf3ae7c1141e83143bb6856777a31467a5
180 volumes:
181 - ./config/mcp-proxy.yaml:/etc/mcp-gateway/config.yaml:ro
182 - ./data:/data:ro
183 restart: unless-stopped
184 user: "65532:65532"
185 read_only: true
186 security_opt:
187 - no-new-privileges:true
188 cap_drop:
189 - ALL
190 # Match shutdown_timeout in the proxy config
191 stop_grace_period: 30s
192 logging:
193 options:
194 max-size: "10m"
195 max-file: "3"
196EOF
197```
198
199**3. Provision the tunnel**
200
201Read the Tunnels API key into an environment variable, then run the setup component. It creates the tunnel, generates the CA and server certificate, registers the CA with Anthropic, fetches the tunnel token, and writes everything to `data/`.
202
203```bash theme={null}
204# Paste the Tunnels API key (input is hidden)
205read -rs API_TOKEN && export API_TOKEN
206
207docker compose run --rm setup
208```
209
210Read the tunnel domain and keep it for later steps.
211
212```bash theme={null}
213export TUNNEL_DOMAIN=$(sudo cat data/tunnel-domain)
214echo "$TUNNEL_DOMAIN"
215```
216
217> [!WARNING]
218>
219> Revoke the Tunnels API key in **Organization settings > Tunnels > Tunnels API** before continuing, and run `unset API_TOKEN`. The stack does not need the key at runtime.
220
221**4. Write the proxy config**
222
223`tunnel_domain` is required so the proxy can strip the domain from incoming hostnames and look up the remaining subdomain in `routes`. `routes` is a map, not a list.
224
225```bash theme={null}
226cat > config/mcp-proxy.yaml <<EOF
227listen_addr: ":8080"
228log_level: info
229shutdown_timeout: 30s
230tunnel_domain: ${TUNNEL_DOMAIN}
231tls:
232 cert_file: /data/tls.crt
233 key_file: /data/tls.key
234routes:
235 docs: http://docs-mcp.example.corp:8080
236 search: http://10.0.12.7:9000
237upstream:
238 allowed_ips:
239 - 10.0.0.0/8
240EOF
241```
242
243`upstream.allowed_ips` is the proxy's protection against server-side request forgery. Use the narrowest ranges that cover your MCP servers. Setting it replaces the RFC 1918 default rather than extending it.
244
245**5. Start the stack**
246
247```bash theme={null}
248export TUNNEL_TOKEN=$(sudo cat data/tunnel-token)
249docker compose up -d
250```
251
252The compose file reads `TUNNEL_TOKEN` from the host environment with no default, so repeat the export in every fresh shell and after a reboot. For a multi-host deployment, copy the `mcp-tunnel/` directory to each host and start it the same way. The same tunnel token and certificates work across all replicas.
253
254The `data/` directory now holds the tunnel ID, tunnel domain, tunnel token, CA key pair, and server key pair. Protect it with your organization's file-permission, encryption-at-rest, and secrets-management controls, and consider moving `ca.key` and `tunnel-token` to secure storage.
263255
264256## Verify the connection
265257
266258Check the logs on your side first. cloudflared logs four `Registered tunnel connection` lines when it has reached the tunnel edge, and the proxy logs one `route configured` line per route.
267259
268<CodeGroup>
269 ```bash Helm theme={null}
270 kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c cloudflared | grep "Registered tunnel connection"
271 kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c mcp-proxy | grep "route configured"
272 ```
273
274 ```bash Docker Compose theme={null}
275 docker compose logs cloudflared | grep "Registered tunnel connection"
276 docker compose logs mcp-proxy | grep "route configured"
277 ```
278</CodeGroup>
260```bash Helm theme={null}
261kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c cloudflared | grep "Registered tunnel connection"
262kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c mcp-proxy | grep "route configured"
263```
264
265```bash Docker Compose theme={null}
266docker compose logs cloudflared | grep "Registered tunnel connection"
267docker compose logs mcp-proxy | grep "route configured"
268```
279269
280270The containers take a few seconds to start, so rerun the commands if they come back empty. If cloudflared never registers, see [Troubleshooting](/docs/connectors/mcp-tunnels/troubleshooting#the-tunnel-stack-starts-but-cloudflared-never-connects). The end-to-end check happens from Claude, in the next section.
281271
from line 273
283273
284274Each route becomes a custom connector for your organization. The connector URL is the route's tunnel hostname plus the path your MCP server serves. Many servers serve at `/mcp`, and the proxy forwards the path unchanged.
285275
286<Steps>
287 <Step title="Open organization connectors">
288 In claude.ai, go to **Organization settings > Connectors**.
289 </Step>
290
291 <Step title="Add a custom connector">
292 Select **Add**, then **Custom**. If Claude asks for the connector type, choose **Web**.
293 </Step>
294
295 <Step title="Enter the tunnel URL">
296 Enter the server URL, for example `https://docs.abc123.tunnel.anthropic.com/mcp`.
297 </Step>
298
299 <Step title="Configure authentication">
300 Configure authentication for the server. If its OAuth authorization server is also inside your network, turn on **Tunnel OAuth configuration** and follow [Authenticate to MCP servers behind a tunnel](/docs/connectors/mcp-tunnels/oauth).
301 </Step>
302
303 <Step title="Add the connector">
304 Select **Add**.
305 </Step>
306</Steps>
276**1. Open organization connectors**
277
278In claude.ai, go to **Organization settings > Connectors**.
279
280**2. Add a custom connector**
281
282Select **Add**, then **Custom**. If Claude asks for the connector type, choose **Web**.
283
284**3. Enter the tunnel URL**
285
286Enter the server URL, for example `https://docs.abc123.tunnel.anthropic.com/mcp`.
287
288**4. Configure authentication**
289
290Configure authentication for the server. If its OAuth authorization server is also inside your network, turn on **Tunnel OAuth configuration** and follow [Authenticate to MCP servers behind a tunnel](/docs/connectors/mcp-tunnels/oauth).
291
292**5. Add the connector**
293
294Select **Add**.
307295
308296Members then find the connector in their own connector settings and select **Connect** to sign in, as described in [Add a connector by URL](/docs/connectors/custom/add-unlisted#add-a-connector-by-url). To confirm the tunnel end to end, connect the server yourself and ask Claude to use one of its tools while you watch the proxy logs for the request.
309297
from line 299
311299
312300Adding another MCP server later takes a new route and a new connector. No certificate or cloudflared changes are needed, because the server certificate covers every subdomain of your tunnel domain.
313301
314<Steps>
315 <Step title="Add a route">
316 Add a route for the new server.
317 </Step>
318
319 <Step title="Apply the change">
320 Apply the change:
321
322 <CodeGroup>
323 ```bash Helm theme={null}
324 # After adding the route under gateway.config.routes in values.yaml
325 helm upgrade mcp-tunnel \
326 oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
327 --version 2.1.0 \
328 -n mcp-tunnel \
329 -f values.yaml
330 ```
331
332 ```bash Docker Compose theme={null}
333 # After adding the route in config/mcp-proxy.yaml
334 docker compose restart mcp-proxy
335 ```
336 </CodeGroup>
337 </Step>
338
339 <Step title="Register the connector">
340 Register the new hostname as another custom connector.
341 </Step>
342</Steps>
302**1. Add a route**
303
304Add a route for the new server.
305
306**2. Apply the change**
307
308Apply the change:
309
310```bash Helm theme={null}
311# After adding the route under gateway.config.routes in values.yaml
312helm upgrade mcp-tunnel \
313 oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
314 --version 2.1.0 \
315 -n mcp-tunnel \
316 -f values.yaml
317```
318
319```bash Docker Compose theme={null}
320# After adding the route in config/mcp-proxy.yaml
321docker compose restart mcp-proxy
322```
323
324**3. Register the connector**
325
326Register the new hostname as another custom connector.
343327
344328## Rotate credentials
345329
from line 337
353337
354338The tunnel token authenticates cloudflared's outbound connection. Rotate it on your regular schedule and immediately if you suspect exposure. Rotation does not sever connections that are already established, so you can rotate, restart cloudflared with the new value, and let the old connections drain.
355339
356<Tabs>
357 <Tab title="Helm">
358 <Steps>
359 <Step title="Increment the token version">
360 Increment `tunnel.tokenVersion` in `values.yaml`.
361 </Step>
362
363 <Step title="Create a Tunnels API key">
364 Create a fresh Tunnels API key.
365 </Step>
366
367 <Step title="Upgrade">
368 Upgrade. The setup component re-runs, rotates the token, and updates the Secret.
369
370 ```bash theme={null}
371 read -rs API_TOKEN && export API_TOKEN
372
373 helm upgrade mcp-tunnel \
374 oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
375 --version 2.1.0 \
376 -n mcp-tunnel \
377 -f values.yaml \
378 --set api.token="$API_TOKEN" \
379 --set setup.force=true
380 ```
381
382 Revoke the API key once the upgrade completes.
383 </Step>
384 </Steps>
385 </Tab>
386
387 <Tab title="Docker Compose">
388 <Steps>
389 <Step title="Increment the token version">
390 Edit `docker-compose.yaml` and increment the `--token-version` value in the `setup` service (for example from `1` to `2`), so the new value persists for future runs.
391 </Step>
392
393 <Step title="Create a Tunnels API key">
394 Create a fresh Tunnels API key.
395 </Step>
396
397 <Step title="Re-run setup">
398 Re-run setup, then restart cloudflared with the new token:
399
400 ```bash theme={null}
401 read -rs API_TOKEN && export API_TOKEN
402 docker compose run --rm setup
403
404 export TUNNEL_TOKEN=$(sudo cat data/tunnel-token)
405 docker compose up -d cloudflared
406 ```
407 </Step>
408 </Steps>
409
410 Revoke the API key and run `unset API_TOKEN` once rotation completes. For a multi-host deployment, setup writes the new token only to the `data/` directory on the host where it ran, so copy the updated `data/` directory (at minimum `data/tunnel-token`) to every other host that runs a replica. Then repeat the last two commands on each of those hosts so every replica restarts with the new token.
411 </Tab>
412</Tabs>
340**Helm**
341
342**1. Increment the token version**
343
344Increment `tunnel.tokenVersion` in `values.yaml`.
345
346**2. Create a Tunnels API key**
347
348Create a fresh Tunnels API key.
349
350**3. Upgrade**
351
352Upgrade. The setup component re-runs, rotates the token, and updates the Secret.
353
354```bash theme={null}
355read -rs API_TOKEN && export API_TOKEN
356
357helm upgrade mcp-tunnel \
358 oci://us-docker.pkg.dev/anthropic-public-registry/charts/mcp-tunnel \
359 --version 2.1.0 \
360 -n mcp-tunnel \
361 -f values.yaml \
362 --set api.token="$API_TOKEN" \
363 --set setup.force=true
364```
365
366Revoke the API key once the upgrade completes.
367
368**Docker Compose**
369
370**1. Increment the token version**
371
372Edit `docker-compose.yaml` and increment the `--token-version` value in the `setup` service (for example from `1` to `2`), so the new value persists for future runs.
373
374**2. Create a Tunnels API key**
375
376Create a fresh Tunnels API key.
377
378**3. Re-run setup**
379
380Re-run setup, then restart cloudflared with the new token:
381
382```bash theme={null}
383read -rs API_TOKEN && export API_TOKEN
384docker compose run --rm setup
385
386export TUNNEL_TOKEN=$(sudo cat data/tunnel-token)
387docker compose up -d cloudflared
388```
389
390Revoke the API key and run `unset API_TOKEN` once rotation completes. For a multi-host deployment, setup writes the new token only to the `data/` directory on the host where it ran, so copy the updated `data/` directory (at minimum `data/tunnel-token`) to every other host that runs a replica. Then repeat the last two commands on each of those hosts so every replica restarts with the new token.
413391
414392### Renew the server certificate
415393
416394The server certificate the proxy presents is valid for 90 days, and you are responsible for renewing it before it expires. Renewal is local. It signs a new certificate with the CA already stored in your deployment, makes no API calls, and needs no API key. The proxy reloads the certificate file automatically, so no restart is required.
417395
418<Tabs>
419 <Tab title="Helm">
420 The chart deploys a CronJob that runs daily and renews the certificate once it is within 30 days of expiry. Monitor the CronJob and the certificate's expiry date to confirm renewal completes.
421 </Tab>
422
423 <Tab title="Docker Compose">
424 Run the renewal from the deployment directory. With `--renew-before=720h` the command does nothing while more than 30 days of validity remain, so it is safe to run on a schedule such as a daily cron entry.
425
426 ```bash theme={null}
427 docker compose run --rm setup renew-cert --output=dir:/data --renew-before=720h
428 ```
429 </Tab>
430</Tabs>
396**Helm**
397
398The chart deploys a CronJob that runs daily and renews the certificate once it is within 30 days of expiry. Monitor the CronJob and the certificate's expiry date to confirm renewal completes.
399
400**Docker Compose**
401
402Run the renewal from the deployment directory. With `--renew-before=720h` the command does nothing while more than 30 days of validity remain, so it is safe to run on a schedule such as a daily cron entry.
403
404```bash theme={null}
405docker compose run --rm setup renew-cert --output=dir:/data --renew-before=720h
406```
431407
432408## Remove a tunnel
433409
434410Decommission a tunnel when you no longer need it, or as the first steps of responding to a suspected compromise. Archiving a tunnel invalidates its token, detaches its domain, and is permanent.
435411
436<Steps>
437 <Step title="Record the tunnel ID">
438 <CodeGroup>
439 ```bash Helm theme={null}
440 TUNNEL_ID=$(kubectl -n mcp-tunnel get secret mcp-tunnel \
441 -o jsonpath='{.data.tunnel-id}' | base64 -d)
442 ```
443
444 ```bash Docker Compose theme={null}
445 TUNNEL_ID=$(sudo cat data/tunnel-id)
446 ```
447 </CodeGroup>
448 </Step>
449
450 <Step title="Stop the tunnel stack">
451 <CodeGroup>
452 ```bash Helm theme={null}
453 helm uninstall mcp-tunnel -n mcp-tunnel
454 ```
455
456 ```bash Docker Compose theme={null}
457 docker compose down
458 ```
459 </CodeGroup>
460
461 If you are responding to a suspected compromise, use `docker compose down --timeout 0` to sever the connection immediately.
462 </Step>
463
464 <Step title="Remove the connectors">
465 In **Organization settings > Connectors**, remove each custom connector that points at the tunnel's hostnames.
466 </Step>
467
468 <Step title="Archive the tunnel">
469 Create a fresh Tunnels API key and call the [archive endpoint](https://platform.claude.com/docs/en/api/beta/tunnels/archive) of the Tunnels API. Revoke the key when you are done.
470
471 ```bash theme={null}
472 read -rs API_TOKEN && export API_TOKEN
473
474 curl -X POST "https://api.anthropic.com/v1/tunnels/${TUNNEL_ID}/archive" \
475 -H "Authorization: Bearer $API_TOKEN" \
476 -H "anthropic-version: 2023-06-01" \
477 -H "anthropic-beta: mcp-tunnels-2026-06-22"
478 ```
479 </Step>
480
481 <Step title="Delete the stored credentials">
482 <CodeGroup>
483 ```bash Helm theme={null}
484 # The setup component created this Secret, so helm uninstall leaves it behind
485 kubectl -n mcp-tunnel delete secret mcp-tunnel
486 ```
487
488 ```bash Docker Compose theme={null}
489 sudo rm -rf data
490 ```
491 </CodeGroup>
492 </Step>
493</Steps>
412**1. Record the tunnel ID**
413
414```bash Helm theme={null}
415TUNNEL_ID=$(kubectl -n mcp-tunnel get secret mcp-tunnel \
416 -o jsonpath='{.data.tunnel-id}' | base64 -d)
417```
418
419```bash Docker Compose theme={null}
420TUNNEL_ID=$(sudo cat data/tunnel-id)
421```
422
423**2. Stop the tunnel stack**
424
425```bash Helm theme={null}
426helm uninstall mcp-tunnel -n mcp-tunnel
427```
428
429```bash Docker Compose theme={null}
430docker compose down
431```
432
433If you are responding to a suspected compromise, use `docker compose down --timeout 0` to sever the connection immediately.
434
435**3. Remove the connectors**
436
437In **Organization settings > Connectors**, remove each custom connector that points at the tunnel's hostnames.
438
439**4. Archive the tunnel**
440
441Create a fresh Tunnels API key and call the [archive endpoint](https://platform.claude.com/docs/en/api/beta/tunnels/archive) of the Tunnels API. Revoke the key when you are done.
442
443```bash theme={null}
444read -rs API_TOKEN && export API_TOKEN
445
446curl -X POST "https://api.anthropic.com/v1/tunnels/${TUNNEL_ID}/archive" \
447 -H "Authorization: Bearer $API_TOKEN" \
448 -H "anthropic-version: 2023-06-01" \
449 -H "anthropic-beta: mcp-tunnels-2026-06-22"
450```
451
452**5. Delete the stored credentials**
453
454```bash Helm theme={null}
455# The setup component created this Secret, so helm uninstall leaves it behind
456kubectl -n mcp-tunnel delete secret mcp-tunnel
457```
458
459```bash Docker Compose theme={null}
460sudo rm -rf data
461```
494462
495463If you archived the tunnel because of a suspected compromise, also notify your Anthropic account team, rotate any OAuth tokens or secrets your MCP servers issued, and review the proxy, cloudflared, and MCP server logs for the affected period before you provision a replacement tunnel.
496464
497465
connectors/mcp-tunnels/troubleshooting Changed · +26 / -30 lines
from line 2
22
33> Fix MCP tunnel problems: cloudflared won't connect, tools don't appear, routing and IP validation errors, TLS and certificate failures, and OAuth errors.
44
5<Note>
6 MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team.
7</Note>
5> [!NOTE]
6>
7> MCP tunnels are in research preview and are available to organizations on the Claude Enterprise plan by request. To request access, [submit the MCP tunnels interest form](https://claude.com/form/mcp-tunnels) or contact your Anthropic account team.
88
99A request through an [MCP tunnel](/docs/connectors/mcp-tunnels/overview) can fail at three points, and it helps to check them in order. First the outbound connection from cloudflared to the tunnel edge, then the inner TLS handshake between Anthropic and your proxy, then the proxy's routing to your MCP server. The cloudflared and proxy logs on your side show which point a request reached. If the proxy logs nothing at all for a request, it never arrived in your network.
1010
11<CodeGroup>
12 ```bash Helm theme={null}
13 kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c cloudflared
14 kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c mcp-proxy
15 ```
11```bash Helm theme={null}
12kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c cloudflared
13kubectl -n mcp-tunnel logs deploy/mcp-tunnel -c mcp-proxy
14```
1615
17 ```bash Docker Compose theme={null}
18 docker compose logs cloudflared
19 docker compose logs mcp-proxy
20 ```
21</CodeGroup>
16```bash Docker Compose theme={null}
17docker compose logs cloudflared
18docker compose logs mcp-proxy
19```
2220
2321For proxy configuration fields and certificate rules referenced below, see the [MCP tunnels reference](https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/reference). The [platform troubleshooting guide](https://platform.claude.com/docs/en/agents-and-tools/mcp-tunnels/troubleshooting) covers the same stack and applies to claude.ai tunnels as well, apart from its Console-specific steps.
2422
from line 80
8280 - 100.64.12.0/22 # example: a cluster Service range outside RFC 1918
8381```
8482
85<Warning>
86 Don't set `0.0.0.0/0` or `disable_ip_validation` outside of isolated testing. IP validation is the proxy's protection against server-side request forgery.
87</Warning>
83> [!WARNING]
84>
85> Don't set `0.0.0.0/0` or `disable_ip_validation` outside of isolated testing. IP validation is the proxy's protection against server-side request forgery.
8886
8987### Proxy exits with `cannot unmarshal !!seq into map[string]string`
9088
from line 102
104102
105103Work through these checks in order.
106104
107<Steps>
108 <Step title="Confirm the stack is connected">
109 Confirm the stack is connected, using the log checks in [Verify the connection](/docs/connectors/mcp-tunnels/setup#verify-the-connection).
110 </Step>
105**1. Confirm the stack is connected**
111106
112 <Step title="Confirm the tunnel's organization">
113 Confirm the tunnel was created with a Tunnels API key from the same claude.ai organization where you are adding the connector. A tunnel created from another organization, including a Claude Console organization, is refused before any traffic reaches your network, and your proxy logs show nothing.
114 </Step>
107Confirm the stack is connected, using the log checks in [Verify the connection](/docs/connectors/mcp-tunnels/setup#verify-the-connection).
115108
116 <Step title="Confirm the connector URL's path">
117 Confirm the connector URL includes the path your MCP server serves, such as `/mcp`. A request to the bare hostname reaches the proxy but the server may answer `404`.
118 </Step>
109**2. Confirm the tunnel's organization**
119110
120 <Step title="Watch the proxy logs">
121 Watch the proxy logs while you retry. `no route for host` and `IP validation failed` point to the sections above. An upstream connection error means the proxy can't reach the MCP server from where it runs.
122 </Step>
123</Steps>
111Confirm the tunnel was created with a Tunnels API key from the same claude.ai organization where you are adding the connector. A tunnel created from another organization, including a Claude Console organization, is refused before any traffic reaches your network, and your proxy logs show nothing.
112
113**3. Confirm the connector URL's path**
114
115Confirm the connector URL includes the path your MCP server serves, such as `/mcp`. A request to the bare hostname reaches the proxy but the server may answer `404`.
116
117**4. Watch the proxy logs**
118
119Watch the proxy logs while you retry. `no route for host` and `IP validation failed` point to the sections above. An upstream connection error means the proxy can't reach the MCP server from where it runs.
124120
125121## OAuth sign-in
126122
connectors/microsoft/365 Changed · +70 / -80 lines
from line 6
66
77By the end of this page you have the connector set up for your organization and your own account connected, and you have asked Claude a first question that draws on Microsoft 365.
88
9<Note>
10 * If your organization runs Claude Desktop on third-party inference, see [Connect to Microsoft 365](/docs/third-party/claude-desktop/connectors-m365) instead
11 * If you're in a US government deployment, see [Set up the Microsoft 365 connector](/docs/government/connectors/microsoft-365) in the government section
12</Note>
9> [!NOTE]
10>
11> * If your organization runs Claude Desktop on third-party inference, see [Connect to Microsoft 365](/docs/third-party/claude-desktop/connectors-m365) instead
12> * If you're in a US government deployment, see [Set up the Microsoft 365 connector](/docs/government/connectors/microsoft-365) in the government section
1313
1414## Review what Claude can do
1515
from line 41
4141
4242On Team and Enterprise plans, an Owner or Primary Owner adds the connector once for everyone. The steps below are the automatic setup, which is the recommended path.
4343
44<Steps>
45 <Step title="Open organization connectors">
46 In claude.ai, go to [**Organization settings > Connectors**](https://claude.ai/admin-settings/connectors).
47 </Step>
44**1. Open organization connectors**
4845
49 <Step title="Add Microsoft 365">
50 Select **Add**, then **All available**. Find **Microsoft 365** and select **Add to your team**.
51 </Step>
46In claude.ai, go to [**Organization settings > Connectors**](https://claude.ai/admin-settings/connectors).
5247
53 <Step title="Connect and grant consent">
54 Connect your own account and grant the organization-wide permissions.
55 </Step>
48**2. Add Microsoft 365**
5649
57 <Step title="Adjust access if needed">
58 Restrict which users can use the connector, or revoke specific permission scopes.
59 </Step>
60</Steps>
50Select **Add**, then **All available**. Find **Microsoft 365** and select **Add to your team**.
6151
52**3. Connect and grant consent**
53
54Connect your own account and grant the organization-wide permissions.
55
56**4. Adjust access if needed**
57
58Restrict which users can use the connector, or revoke specific permission scopes.
59
6260For the detailed administrator walkthrough, see [Set up the Microsoft 365 connector](https://support.claude.com/en/articles/12542951-set-up-the-microsoft-365-connector) in the help center. The [Microsoft 365 connector security guide](https://support.claude.com/en/articles/12684923-microsoft-365-connector-security-guide) covers the permission model.
6361
6462### Connect your account
from line 63
6563
6664Once the connector is available to you, connect your own Microsoft 365 account.
6765
68<Steps>
69 <Step title="Open your connectors">
70 Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins.
71 </Step>
66**1. Open your connectors**
7267
73 <Step title="Connect Microsoft 365">
74 Find **Microsoft 365** and select **Connect**.
75 </Step>
68Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins.
7669
77 <Step title="Sign in to Microsoft">
78 Sign in with your work or school Microsoft credentials.
79 </Step>
80</Steps>
70**2. Connect Microsoft 365**
8171
72Find **Microsoft 365** and select **Connect**.
73
74**3. Sign in to Microsoft**
75
76Sign in with your work or school Microsoft credentials.
77
8278When the connection succeeds, the **Connect** button on the Microsoft 365 connector changes to **Disconnect**. For the member walkthrough, see [Connect to Microsoft 365](https://support.claude.com/en/articles/15183774-connect-to-microsoft-365) in the help center.
8379
8480## Try the connector
from line 103
107103
108104If write actions are off for your organization, administrators turn them on for all users in the Microsoft 365 connector configuration, or enable them for specific users with role-based access control (beta). Administrators also check the restriction on each tool that sends Teams messages. A per-tool restriction overrides the **Default restriction** row, so a tool that is blocked for all users stays unavailable until an administrator changes its restriction. To let users choose those tools:
109105
110<Steps>
111 <Step title="Open the connector's configuration">
112 Open the Microsoft 365 connector under **Organization settings > Connectors**.
113 </Step>
106**1. Open the connector's configuration**
114107
115 <Step title="Find Tool permission restrictions">
116 Find **Tool permission restrictions**.
117 </Step>
108Open the Microsoft 365 connector under **Organization settings > Connectors**.
118109
119 <Step title="Allow each Teams messaging tool">
120 Set each Teams messaging tool so that users can choose it.
121 </Step>
122</Steps>
110**2. Find Tool permission restrictions**
123111
112Find **Tool permission restrictions**.
113
114**3. Allow each Teams messaging tool**
115
116Set each Teams messaging tool so that users can choose it.
117
124118## Permissions
125119
126120All permissions are delegated: Claude acts on behalf of users and can only access and change content that you already have permission to access and change in Microsoft 365. Write actions are available when your administrators enable them, as described in [Write actions](#write-actions).
from line 125
131125
132126A Global Administrator or Application Administrator approves the added permissions for the whole tenant by opening the admin consent link and accepting the list it shows.
133127
134<Steps>
135 <Step title="Open the admin consent link">
136 Replace `YOUR_TENANT_ID` with the Directory (tenant) ID shown in **Entra admin center > Overview**, then open the link. The `client_id` value is the connector's Application ID, shown on the **M365 MCP Server for Claude** enterprise application's **Overview** page.
128**1. Open the admin consent link**
137129
138 ```text theme={null}
139 https://login.microsoftonline.com/YOUR_TENANT_ID/adminconsent?client_id=07c030f6-5743-41b7-ba00-0a6e85f37c17
140 ```
141 </Step>
130Replace `YOUR_TENANT_ID` with the Directory (tenant) ID shown in **Entra admin center > Overview**, then open the link. The `client_id` value is the connector's Application ID, shown on the **M365 MCP Server for Claude** enterprise application's **Overview** page.
142131
143 <Step title="Review the permissions and accept">
144 The consent screen lists every permission the connector requests, including any added since your tenant first approved it and the permissions that write actions need. The Teams tools use `Team.ReadBasic.All` to list teams, `People.Read` to look up people, and `ChatMessage.Send`, `ChannelMessage.Send`, and `Chat.Create` to send messages. Select **Accept**.
145 </Step>
132```text theme={null}
133https://login.microsoftonline.com/YOUR_TENANT_ID/adminconsent?client_id=07c030f6-5743-41b7-ba00-0a6e85f37c17
134```
146135
147 <Step title="Confirm the approval">
148 Check the address bar of the page Microsoft sends you to. The approval succeeded when the address contains `admin_consent=True`, and the approved permissions then appear on the connector's **Permissions** page.
149 </Step>
150</Steps>
136**2. Review the permissions and accept**
151137
138The consent screen lists every permission the connector requests, including any added since your tenant first approved it and the permissions that write actions need. The Teams tools use `Team.ReadBasic.All` to list teams, `People.Read` to look up people, and `ChatMessage.Send`, `ChannelMessage.Send`, and `Chat.Create` to send messages. Select **Accept**.
139
140**3. Confirm the approval**
141
142Check the address bar of the page Microsoft sends you to. The approval succeeded when the address contains `admin_consent=True`, and the approved permissions then appear on the connector's **Permissions** page.
143
152144Selecting **Grant admin consent for \{your organization}** on the connector's **Permissions** page in the Entra admin center approves the same list as the admin consent link.
153145
154146The admin consent link is for the connector used from claude.ai. If the Application ID on the enterprise application's **Overview** page differs from the one in the link (for example in a government deployment), use that ID instead. The Claude Desktop local connector and a self-hosted server use their own app registrations.
from line 149
157149
158150If something isn't working, start with the case that matches what you see.
159151
160<AccordionGroup>
161 <Accordion title="Authentication failures">
162 If sign-in fails, work through these checks:
152> **Authentication failures**
153>
154> If sign-in fails, work through these checks:
155>
156> * Confirm you're signing in with your work or school Microsoft 365 credentials, not a personal account
157> * Check that your Microsoft 365 license is active
158> * Review your organization's third-party app policies
159> * Try a different browser, or clear cookies and cache and sign in again
163160
164 * Confirm you're signing in with your work or school Microsoft 365 credentials, not a personal account
165 * Check that your Microsoft 365 license is active
166 * Review your organization's third-party app policies
167 * Try a different browser, or clear cookies and cache and sign in again
168 </Accordion>
161> **Documents not found**
162>
163> If Claude can't find a document you know exists:
164>
165> * Confirm you can open the document directly in Microsoft 365
166> * Make sure the document is stored in SharePoint or OneDrive, not only on your computer
167> * Wait and retry for recently uploaded documents, which can take time to index
168> * Name the specific SharePoint site, or search by the exact filename
169169
170 <Accordion title="Documents not found">
171 If Claude can't find a document you know exists:
172
173 * Confirm you can open the document directly in Microsoft 365
174 * Make sure the document is stored in SharePoint or OneDrive, not only on your computer
175 * Wait and retry for recently uploaded documents, which can take time to index
176 * Name the specific SharePoint site, or search by the exact filename
177 </Accordion>
178
179 <Accordion title="Incomplete search results">
180 If results are partial or miss what you expected:
181
182 * Be more specific about what you need
183 * Specify locations and date ranges
184 * Use exact phrases from the content
185 * Break a complex request into simpler questions
186 </Accordion>
187</AccordionGroup>
170> **Incomplete search results**
171>
172> If results are partial or miss what you expected:
173>
174> * Be more specific about what you need
175> * Specify locations and date ranges
176> * Use exact phrases from the content
177> * Break a complex request into simpler questions
188178
189179## Next steps
190180
connectors/slack/index Changed · +40 / -48 lines
from line 6
66
77By the end of this page you have installed the app, connected your account, and, if your plan includes it, turned on the connector and asked Claude a question that draws on Slack.
88
9<Note>
10 This page covers the earlier per-user Claude in Slack app. The current product is [Claude Tag](/docs/claude-tag/overview), which gives your team one Claude identity set up by an admin. If your organization used the earlier app, see [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/migrate-from-earlier).
11</Note>
9> [!NOTE]
10>
11> This page covers the earlier per-user Claude in Slack app. The current product is [Claude Tag](/docs/claude-tag/overview), which gives your team one Claude identity set up by an admin. If your organization used the earlier app, see [Migrate from the earlier Claude in Slack](/docs/claude-tag/admins/migrate-from-earlier).
1212
1313## Use the earlier Claude in Slack app
1414
from line 24
2424
2525A Slack admin adds the app to the workspace first, and then each person connects their own Claude account.
2626
27<Tabs>
28 <Tab title="Slack admins">
29 <Steps>
30 <Step title="Find the app">
31 Open the Claude app's listing in the Slack App Marketplace.
32 </Step>
27**Slack admins**
3328
34 <Step title="Add the app to Slack">
35 Select **Add to Slack**, then review and approve the app for your organization.
36 </Step>
29**1. Find the app**
3730
38 <Step title="Choose where to deploy">
39 Deploy the app org-wide or to specific workspaces.
40 </Step>
41 </Steps>
31Open the Claude app's listing in the Slack App Marketplace.
4232
43 To add the app to more workspaces later, open your Slack management workspace, go to **Integrations > Installed apps > Add to more workspaces**, and turn on each workspace that should have it.
44 </Tab>
33**2. Add the app to Slack**
4534
46 <Tab title="Individual users">
47 <Steps>
48 <Step title="Find Claude">
49 Find **Claude** in your Slack apps list or in the Slack App Marketplace.
50 </Step>
35Select **Add to Slack**, then review and approve the app for your organization.
5136
52 <Step title="Connect your account">
53 Select **Connect Account**, select your Claude organization, and then select **Authorize** to grant access.
54 </Step>
37**3. Choose where to deploy**
5538
56 <Step title="Start a conversation">
57 Return to Slack and select **+ New Chat**, or mention @Claude in a channel or thread.
58 </Step>
59 </Steps>
39Deploy the app org-wide or to specific workspaces.
6040
61 If your company's Slack requires admin approval and you aren't an admin, you see a **Request to install** prompt instead. Ask a Slack admin to approve the app, then connect.
41To add the app to more workspaces later, open your Slack management workspace, go to **Integrations > Installed apps > Add to more workspaces**, and turn on each workspace that should have it.
6242
63 To pin Claude to your Slack header, open the app's three-dot menu in Slack and select **Add this app to header**.
64 </Tab>
65</Tabs>
43**Individual users**
6644
45**1. Find Claude**
46
47Find **Claude** in your Slack apps list or in the Slack App Marketplace.
48
49**2. Connect your account**
50
51Select **Connect Account**, select your Claude organization, and then select **Authorize** to grant access.
52
53**3. Start a conversation**
54
55Return to Slack and select **+ New Chat**, or mention @Claude in a channel or thread.
56
57If your company's Slack requires admin approval and you aren't an admin, you see a **Request to install** prompt instead. Ask a Slack admin to approve the app, then connect.
58
59To pin Claude to your Slack header, open the app's three-dot menu in Slack and select **Add this app to header**.
60
6761## Search Slack with the connector
6862
6963The Slack connector is available on Team and Enterprise plans. With it turned on, Claude in claude.ai can search your workspace's channels, direct messages, and files to answer your questions. Install the Claude in Slack app before you enable the connector.
from line 66
7266
7367An Owner enables the connector for the organization once, and then each member connects their own account.
7468
75<Steps>
76 <Step title="Enable the connector for your organization">
77 An Owner goes to [**Organization settings > Connectors**](https://claude.ai/admin-settings/connectors) in claude.ai and enables the Slack connector.
78 </Step>
69**1. Enable the connector for your organization**
7970
80 <Step title="Open your connectors">
81 Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins.
82 </Step>
71An Owner goes to [**Organization settings > Connectors**](https://claude.ai/admin-settings/connectors) in claude.ai and enables the Slack connector.
8372
84 <Step title="Connect Slack">
85 Find **Slack** and select **Connect**.
86 </Step>
87</Steps>
73**2. Open your connectors**
8874
75Go to [**Customize > Connectors**](https://claude.ai/customize/connectors) in claude.ai. **Customize** is the page that holds your connectors, skills, and plugins.
76
77**3. Connect Slack**
78
79Find **Slack** and select **Connect**.
80
8981When the connection succeeds, the **Connect** button on the Slack connector changes to **Disconnect**.
9082
9183### Try the connector
from line 100
108100* **Claude in Slack app**: on the app's **Home** tab in Slack, select **Disconnect**
109101* **Slack connector**: go to [**Customize > Connectors**](https://claude.ai/customize/connectors), find **Slack**, and select **Disconnect**
110102
111<Note>
112 Disconnecting removes your account connection and deletes past conversations within 30 days.
113</Note>
103> [!NOTE]
104>
105> Disconnecting removes your account connection and deletes past conversations within 30 days.
114106
115107## Privacy and data
116108
connectors/verification Changed · +3 / -3 lines
from line 4
44
55The [Connectors Directory](/docs/connectors/directory) lists connectors from Anthropic and from third-party developers, and each one shows how much Anthropic has reviewed it. Use this page to understand what those labels mean before you connect one.
66
7<Note>
8 If you build connectors and want yours listed, see [List your own connector](#list-your-own-connector).
9</Note>
7> [!NOTE]
8>
9> If you build connectors and want yours listed, see [List your own connector](#list-your-own-connector).
1010
1111## Connector labels
1212
cowork/changelog Changed · +2154 / -2154 lines
Nothing in the body moved in this read. What changed is above.
cowork/guide/dispatch Changed · +24 / -28 lines
from line 14
1414
1515The Dispatch agent appears as **Dispatch** in the left sidebar. Selecting it opens a single conversation with the agent.
1616
17<Steps>
18 <Step title="Open Dispatch from the sidebar">
19 Select **Dispatch** in the left side panel.
20 </Step>
17**1. Open Dispatch from the sidebar**
2118
22 <Step title="Describe the outcome">
23 Tell the agent what you want done, the same way you'd brief a colleague. For
24 example: "Summarize the open Linear issues tagged reliability and draft a
25 status update for the team channel."
26 </Step>
19Select **Dispatch** in the left side panel.
2720
28 <Step title="Let Dispatch plan and run">
29 The agent decides how to split the work and starts one or more child tasks.
30 Each child task appears under the Dispatch group in the sidebar with its own
31 status.
32 </Step>
33</Steps>
21**2. Describe the outcome**
3422
23Tell the agent what you want done, the same way you'd brief a colleague. For
24example: "Summarize the open Linear issues tagged reliability and draft a
25status update for the team channel."
26
27**3. Let Dispatch plan and run**
28
29The agent decides how to split the work and starts one or more child tasks.
30Each child task appears under the Dispatch group in the sidebar with its own
31status.
32
3533You converse with one Dispatch agent, but it can run many child tasks beneath that conversation. Child tasks don't spawn further children of their own.
3634
3735## How Dispatch routes work
from line 70
7270
7371When Claude Desktop is running, your computer registers as a Dispatch host. From the Claude mobile app, you can start a Dispatch conversation that runs on your desktop, then check results from either device.
7472
75<Steps>
76 <Step title="Keep your desktop ready">
77 Leave Claude Desktop open with your computer awake and online.
78 </Step>
73**1. Keep your desktop ready**
7974
80 <Step title="Open Dispatch on mobile">
81 In the Claude mobile app, open Dispatch and describe the task. The work runs
82 on your desktop.
83 </Step>
75Leave Claude Desktop open with your computer awake and online.
8476
85 <Step title="Review on either device">
86 Progress and results appear in the Dispatch sidebar on desktop and in the
87 mobile app.
88 </Step>
89</Steps>
77**2. Open Dispatch on mobile**
78
79In the Claude mobile app, open Dispatch and describe the task. The work runs
80on your desktop.
81
82**3. Review on either device**
83
84Progress and results appear in the Dispatch sidebar on desktop and in the
85mobile app.
9086
9187## Related
9288
cowork/guide/plugins Changed · +23 / -27 lines
from line 25
2525
2626You browse, install, and upload plugins from the **Plugins** page. Open **Customize** in the sidebar, then select **Plugins**.
2727
28<Steps>
29 <Step title="Browse the marketplace">
30 Select **Discover** to see available plugins. The default marketplace is
31 Anthropic's official catalog; you can add other marketplaces by URL.
32 </Step>
28**1. Browse the marketplace**
3329
34 <Step title="Install">
35 Select a plugin and click **Install**. Installing doesn't add or sign you in
36 to any connector. If the plugin includes connectors, open its **Connectors**
37 tab afterward to add or connect each one.
38 </Step>
30Select **Discover** to see available plugins. The default marketplace is
31Anthropic's official catalog; you can add other marketplaces by URL.
3932
40 <Step title="Review components">
41 Open the installed plugin to see its skills, connectors, agents, and hooks.
42 Select **Disable plugin** to turn the whole plugin off, and connect or
43 disconnect each connector on its own from the **Connectors** tab.
44 </Step>
45</Steps>
33**2. Install**
4634
35Select a plugin and click **Install**. Installing doesn't add or sign you in
36to any connector. If the plugin includes connectors, open its **Connectors**
37tab afterward to add or connect each one.
38
39**3. Review components**
40
41Open the installed plugin to see its skills, connectors, agents, and hooks.
42Select **Disable plugin** to turn the whole plugin off, and connect or
43disconnect each connector on its own from the **Connectors** tab.
44
4745To install from a file instead, select the upload option on the Plugins page and select the plugin package.
4846
4947## Use a Git repository as a marketplace
from line 48
5048
5149A Git repository that contains plugin packages can serve as a marketplace, which lets you share plugins without publishing to the public catalog. For a marketplace you add yourself, repositories on GitHub, including GitHub Enterprise, are supported, and public repositories on GitLab and Bitbucket also work. To distribute plugins to everyone in a Team or Enterprise organization, an Owner syncs the repository from organization settings instead, as [Manage plugins for your organization](/docs/plugins/admin#add-your-own-plugins) describes.
5250
53<Steps>
54 <Step title="Add the repository">
55 On the Plugins page, select **Add marketplace** and enter the repository's
56 URL. Cowork accepts the standard `https://github.com/owner/repo` form and
57 the `owner/repo` shorthand for GitHub.
58 </Step>
51**1. Add the repository**
5952
60 <Step title="Install plugins from it">
61 Plugins defined in the repository appear alongside plugins from other
62 marketplaces. Install them the same way.
63 </Step>
64</Steps>
53On the Plugins page, select **Add marketplace** and enter the repository's
54URL. Cowork accepts the standard `https://github.com/owner/repo` form and
55the `owner/repo` shorthand for GitHub.
56
57**2. Install plugins from it**
58
59Plugins defined in the repository appear alongside plugins from other
60marketplaces. Install them the same way.
6561
6662Select **Check for updates** on a marketplace to pull the latest plugins from its repository, or turn on **Sync automatically**.
6763
cowork/guide/projects Changed · +13 / -15 lines
from line 23
2323
2424Open **Projects** in the left navigation and choose the **+** button to start. You're offered three starting points.
2525
26<Steps>
27 <Step title="Choose a starting point">
28 Select **Start from scratch** to create an empty project with a new folder,
29 **Import a project** to bring an existing claude.ai project into Cowork, or
30 **Use an existing folder** to point at a folder you already work from.
31 </Step>
26**1. Choose a starting point**
3227
33 <Step title="Name and describe it">
34 Give the project a name and a short description so you can tell it apart in
35 the sidebar.
36 </Step>
28Select **Start from scratch** to create an empty project with a new folder,
29**Import a project** to bring an existing claude.ai project into Cowork, or
30**Use an existing folder** to point at a folder you already work from.
3731
38 <Step title="Add folders and instructions">
39 Attach the local folders Claude should have access to, and write any
40 standing instructions you want applied to every session.
41 </Step>
42</Steps>
32**2. Name and describe it**
33
34Give the project a name and a short description so you can tell it apart in
35the sidebar.
36
37**3. Add folders and instructions**
38
39Attach the local folders Claude should have access to, and write any
40standing instructions you want applied to every session.
4341
4442You can attach more folders, links, or projects from Chat at any time from the project's settings.
4543
cowork/hipaa-setup Changed · +80 / -86 lines
from line 4
44
55The HIPAA configuration is an organization setting on Claude Enterprise plans, for organizations that handle protected health information (PHI) and have a [Business Associate Agreement (BAA)](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) with Anthropic. It applies to Claude Code (local mode) and Cowork (local mode), and it restricts features in both products.
66
7<Note>
8 "(local mode)" means a local session, not a session that runs in the cloud. Local sessions run in one of these places:
7> [!NOTE]
8>
9> "(local mode)" means a local session, not a session that runs in the cloud. Local sessions run in one of these places:
10>
11> * Claude Code in the terminal
12> * Claude Code in the Code tab of Claude Desktop
13> * Cowork in Claude Desktop
14>
15> The Claude Code extensions for VS Code and JetBrains aren't part of (local mode). They keep working with the HIPAA configuration applied, but your BAA doesn't cover them. See the [Implementation Guide](https://trust.anthropic.com/resources?s=l1wrssd9hsbi4gak0tp5a6\&name=%5Banthropic%5D-hipaa-ready-offering-implementation-guide) for the full list of Eligible Services.
916
10 * Claude Code in the terminal
11 * Claude Code in the Code tab of Claude Desktop
12 * Cowork in Claude Desktop
13
14 The Claude Code extensions for VS Code and JetBrains aren't part of (local mode). They keep working with the HIPAA configuration applied, but your BAA doesn't cover them. See the [Implementation Guide](https://trust.anthropic.com/resources?s=l1wrssd9hsbi4gak0tp5a6\&name=%5Banthropic%5D-hipaa-ready-offering-implementation-guide) for the full list of Eligible Services.
15</Note>
16
1717This page is for the IT or security administrator who manages the macOS and Windows computers where members run [Cowork](/docs/cowork/overview) in Claude Desktop. Other readers start on a different page:
1818
1919* **The Primary Owner, who applies the HIPAA configuration**: see [Use Claude Code (local mode) and Cowork (local mode) on a HIPAA-ready Enterprise plan](https://support.claude.com/en/articles/17318731) for what your BAA covers and how to apply the configuration
from line 68
6868
6969The following sample sets four keys that you could add to the Claude Desktop policy your organization deploys. If your organization doesn't deploy one yet, [Enterprise configuration](https://support.claude.com/en/articles/12622667-enterprise-configuration) explains how to deliver a policy with your device management tool.
7070
71<Tabs>
72 <Tab title="macOS">
73 Add these keys to a configuration profile for the `com.anthropic.claudefordesktop` preference domain:
71**macOS**
7472
75 ```xml theme={null}
76 <key>forceLoginOrgUUID</key>
77 <string>xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx</string>
78 <key>isLocalDevMcpEnabled</key>
79 <string>false</string>
80 <key>isDesktopExtensionEnabled</key>
81 <string>false</string>
82 <key>otlpContentCapture</key>
83 <string>[]</string>
84 ```
85 </Tab>
73Add these keys to a configuration profile for the `com.anthropic.claudefordesktop` preference domain:
8674
87 <Tab title="Windows">
88 Write these values under `HKLM\SOFTWARE\Policies\Claude`:
75```xml theme={null}
76<key>forceLoginOrgUUID</key>
77<string>xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx</string>
78<key>isLocalDevMcpEnabled</key>
79<string>false</string>
80<key>isDesktopExtensionEnabled</key>
81<string>false</string>
82<key>otlpContentCapture</key>
83<string>[]</string>
84```
8985
90 ```reg theme={null}
91 Windows Registry Editor Version 5.00
86**Windows**
9287
93 [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Claude]
94 "forceLoginOrgUUID"="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
95 "isLocalDevMcpEnabled"="false"
96 "isDesktopExtensionEnabled"="false"
97 "otlpContentCapture"="[]"
98 ```
99 </Tab>
100</Tabs>
88Write these values under `HKLM\SOFTWARE\Policies\Claude`:
10189
90```reg theme={null}
91Windows Registry Editor Version 5.00
92
93[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Claude]
94"forceLoginOrgUUID"="xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx"
95"isLocalDevMcpEnabled"="false"
96"isDesktopExtensionEnabled"="false"
97"otlpContentCapture"="[]"
98```
99
102100The sample writes every value as a string, including `false` and `[]`. [Value types](/docs/third-party/claude-desktop/configuration#value-types) lists the other encodings Claude Desktop accepts.
103101
104<Note>
105 The Claude Desktop policy is separate from Claude Code's managed settings, which [also apply to Cowork](#check-which-claude-code-managed-settings-apply-in-cowork).
106</Note>
102> [!NOTE]
103>
104> The Claude Desktop policy is separate from Claude Code's managed settings, which [also apply to Cowork](#check-which-claude-code-managed-settings-apply-in-cowork).
107105
108106#### What each Claude Desktop key does
109107
from line 116
118116
119117Cowork monitoring sends events to the OpenTelemetry collector that your organization sets up. When `otlpContentCapture` isn't set, those events can include prompt text, model responses, and tool inputs.
120118
121<Warning>
122 Check these values before you deploy:
119> [!WARNING]
120>
121> Check these values before you deploy:
122>
123> * **`otlpContentCapture`**: write the two characters `[]`. Claude Desktop reads an empty string as if the key weren't set, and Cowork monitoring events can then include prompt text, model responses, and tool inputs.
124> * **`forceLoginOrgUUID`**: if you deploy a value that Claude Desktop can't read as an organization ID, nobody can use the app on that computer. Members see "Sign-in is blocked by this device’s configuration".
123125
124 * **`otlpContentCapture`**: write the two characters `[]`. Claude Desktop reads an empty string as if the key weren't set, and Cowork monitoring events can then include prompt text, model responses, and tool inputs.
125 * **`forceLoginOrgUUID`**: if you deploy a value that Claude Desktop can't read as an organization ID, nobody can use the app on that computer. Members see "Sign-in is blocked by this device’s configuration".
126</Warning>
127
128126#### Confirm the Claude Desktop policy loaded
129127
130128Claude Desktop applies these keys when it starts, so quit Claude Desktop on a managed computer and open it again first. The table shows how to check each key.
from line 188
190188
191189The `disabledBuiltinTools` key takes a list of tool names, written as a string:
192190
193<Tabs>
194 <Tab title="macOS">
195 Add the key to the profile for the `com.anthropic.claudefordesktop` preference domain:
191**macOS**
196192
197 ```xml theme={null}
198 <key>disabledBuiltinTools</key>
199 <string>["WebSearch"]</string>
200 ```
201 </Tab>
193Add the key to the profile for the `com.anthropic.claudefordesktop` preference domain:
202194
203 <Tab title="Windows">
204 Add the value under `HKLM\SOFTWARE\Policies\Claude`:
195```xml theme={null}
196<key>disabledBuiltinTools</key>
197<string>["WebSearch"]</string>
198```
205199
206 ```reg theme={null}
207 "disabledBuiltinTools"="[\"WebSearch\"]"
208 ```
209 </Tab>
210</Tabs>
200**Windows**
211201
202Add the value under `HKLM\SOFTWARE\Policies\Claude`:
203
204```reg theme={null}
205"disabledBuiltinTools"="[\"WebSearch\"]"
206```
207
212208After a member restarts Claude Desktop, Claude can't search the web in Cowork tasks or Code tab sessions on that computer.
213209
214<Warning>
215 If you deploy a `disabledBuiltinTools` value that Claude Desktop can't read as a list, Claude Desktop turns off every built-in tool.
216</Warning>
210> [!WARNING]
211>
212> If you deploy a `disabledBuiltinTools` value that Claude Desktop can't read as a list, Claude Desktop turns off every built-in tool.
217213
218214## Confirm the HIPAA configuration in Claude Desktop
219215
220216Run this check on one managed computer after the Primary Owner applies the HIPAA configuration.
221217
222<Steps>
223 <Step title="Ask an Owner to turn Cowork back on">
224 Applying the HIPAA configuration turns Cowork off for your organization. Ask an Owner to go to [**Organization settings > Cowork**](https://claude.ai/admin-settings/cowork) and turn on the **Enable for your organization** toggle.
225 </Step>
218**1. Ask an Owner to turn Cowork back on**
226219
227 <Step title="Restart Claude Desktop">
228 Quit Claude Desktop and open it again.
229 </Step>
220Applying the HIPAA configuration turns Cowork off for your organization. Ask an Owner to go to [**Organization settings > Cowork**](https://claude.ai/admin-settings/cowork) and turn on the **Enable for your organization** toggle.
230221
231 <Step title="Check the title bar">
232 Confirm that the title bar shows a **HIPAA configured** label. On a Mac, open the sidebar to see it.
233 </Step>
222**2. Restart Claude Desktop**
234223
235 <Step title="Check your monitoring events">
236 If your organization uses [Cowork monitoring](/docs/cowork/monitoring), run a Cowork task. Confirm that the events your collector receives contain no prompt text, model responses, or tool inputs.
237 </Step>
238</Steps>
224Quit Claude Desktop and open it again.
225
226**3. Check the title bar**
227
228Confirm that the title bar shows a **HIPAA configured** label. On a Mac, open the sidebar to see it.
229
230**4. Check your monitoring events**
231
232If your organization uses [Cowork monitoring](/docs/cowork/monitoring), run a Cowork task. Confirm that the events your collector receives contain no prompt text, model responses, or tool inputs.
239233
240234The [HIPAA feature availability table](https://support.claude.com/en/articles/8114513-business-associate-agreements-baa-for-commercial-customers) lists which Cowork features are off with the HIPAA configuration applied, and which ones an Owner can turn back on.
241235
cowork/monitoring Changed · +12 / -12 lines
from line 4
44
55Track Cowork usage and activity across your organization by exporting events through [OpenTelemetry](https://opentelemetry.io/) (OTel). Cowork exports events via the OTel logs/events protocol, giving you visibility into user prompts, model responses, API requests, tool usage, and errors.
66
7<Note>
8 Monitoring is available for Team and Enterprise plans. OTel monitoring requires Claude desktop app version 1.1.4173 or later.
9</Note>
7> [!NOTE]
8>
9> Monitoring is available for Team and Enterprise plans. OTel monitoring requires Claude desktop app version 1.1.4173 or later.
1010
1111## Setup
1212
from line 26
2626
27274. Start a new Cowork session — settings are loaded at session start, so existing sessions won't pick up the new configuration
2828
29<Note>
30 The OTel exporter runs inside the Cowork VM, so it is subject to the session's egress rules. If your organization restricts network egress, Cowork automatically adds your collector's hostname to the session's egress allowlist. You don't need to add it at **Admin settings > Capabilities > Network egress**.
31</Note>
29> [!NOTE]
30>
31> The OTel exporter runs inside the Cowork VM, so it is subject to the session's egress rules. If your organization restricts network egress, Cowork automatically adds your collector's hostname to the session's egress allowlist. You don't need to add it at **Admin settings > Capabilities > Network egress**.
3232
3333## Events
3434
from line 79
7979| `workspace.host_paths` | Paths of the folders the user connected to the task (string array) |
8080| `terminal.type` | Terminal type (`non-interactive` for Cowork) |
8181
82<Note>
83 The account attributes — `organization.id`, `user.account_uuid`, `user.account_id`, and `user.email` — are populated from the user's Anthropic account, so they appear on first-party deployments only. On [third-party deployments](/docs/third-party/claude-desktop/overview) there is no Anthropic account and these attributes are absent; instead, the export carries the signed-in user's identity as the `enduser.id` resource attribute, described under [User attribution](/docs/third-party/claude-desktop/telemetry#user-attribution). The `process.owner` resource attribute (the operating-system login name) is standard OpenTelemetry process metadata and is present on all deployments.
84</Note>
82> [!NOTE]
83>
84> The account attributes — `organization.id`, `user.account_uuid`, `user.account_id`, and `user.email` — are populated from the user's Anthropic account, so they appear on first-party deployments only. On [third-party deployments](/docs/third-party/claude-desktop/overview) there is no Anthropic account and these attributes are absent; instead, the export carries the signed-in user's identity as the `enduser.id` resource attribute, described under [User attribution](/docs/third-party/claude-desktop/telemetry#user-attribution). The `process.owner` resource attribute (the operating-system login name) is standard OpenTelemetry process metadata and is present on all deployments.
8585
8686### User prompt event
8787
from line 218
218218
219219**Performance monitoring** — Track API request durations and tool execution times to identify performance bottlenecks.
220220
221<Note>
222 Cost values from events are approximations. For official billing data, refer to your billing dashboard.
223</Note>
221> [!NOTE]
222>
223> Cost values from events are approximations. For official billing data, refer to your billing dashboard.
224224
225225## Backend considerations
226226
cowork/overview Changed · +12 / -14 lines
from line 15
1515
1616Cowork supports the same extensibility features available across Claude products:
1717
18<Columns cols={2}>
19 <Card title="Connectors" icon="plug" href="/docs/connectors/overview">
20 Connect Claude to your tools and data sources using MCP.
21 </Card>
18> **[Connectors](/docs/connectors/overview)**
19>
20> Connect Claude to your tools and data sources using MCP.
2221
23 <Card title="Skills" icon="wand-magic-sparkles" href="/docs/skills/overview">
24 Teach Claude reusable workflows with custom instructions.
25 </Card>
22> **[Skills](/docs/skills/overview)**
23>
24> Teach Claude reusable workflows with custom instructions.
2625
27 <Card title="Plugins" icon="puzzle-piece" href="/docs/plugins/overview">
28 Bundle skills, connectors, and more into shareable packages.
29 </Card>
26> **[Plugins](/docs/plugins/overview)**
27>
28> Bundle skills, connectors, and more into shareable packages.
3029
31 <Card title="Monitoring" icon="chart-line" href="/docs/cowork/monitoring">
32 Track usage and activity across your organization.
33 </Card>
34</Columns>
30> **[Monitoring](/docs/cowork/monitoring)**
31>
32> Track usage and activity across your organization.
3533
3634You manage connectors, skills, and plugins from **Customize** in the sidebar. Cowork loads the ones enabled for your claude.ai account, synced at session start, and doesn't read the [Claude Code](https://code.claude.com/docs/en/skills) CLI's `~/.claude` directory on your machine. To use a skill or plugin that exists only in `~/.claude`, add it in **Customize**.
3735
directory/publish Changed · +17 / -19 lines
from line 8
88
99If you're ready to submit, open the [developer portal](https://claude.ai/directory/manage) or jump to [Start a submission in the developer portal](#start-a-submission-in-the-developer-portal).
1010
11<Note>
12 * If you're still deciding what goes in your plugin, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build)
13 * If you want to build a small example plugin and submit it, see [Build your first plugin](/docs/plugins/quickstart)
14 * If you want to share a plugin without a public listing, use [your own marketplace](https://code.claude.com/docs/en/plugins/publish) for Claude Code or [roll it out to your whole organization](/docs/plugins/org-rollout)
15 * If you came here from [Claude Marketplace](https://claude.com/marketplace), the website where you browse plugins, connectors, partner products, and service partners, you're in the right place: there's no separate Claude Marketplace submission, and you submit to the directory instead
16</Note>
11> [!NOTE]
12>
13> * If you're still deciding what goes in your plugin, see [Decide what to include in your plugin](/docs/connectors/building/what-to-build)
14> * If you want to build a small example plugin and submit it, see [Build your first plugin](/docs/plugins/quickstart)
15> * If you want to share a plugin without a public listing, use [your own marketplace](https://code.claude.com/docs/en/plugins/publish) for Claude Code or [roll it out to your whole organization](/docs/plugins/org-rollout)
16> * If you came here from [Claude Marketplace](https://claude.com/marketplace), the website where you browse plugins, connectors, partner products, and service partners, you're in the right place: there's no separate Claude Marketplace submission, and you submit to the directory instead
1717
1818## Before you submit to the directory
1919
from line 36
3636
3737To start a submission:
3838
39<Steps>
40 <Step title="Select Submit new">
41 In the developer portal at [claude.ai/directory/manage](https://claude.ai/directory/manage), select **Submit new**.
42 </Step>
39**1. Select Submit new**
4340
44 <Step title="Choose the submission type">
45 Under **What would you like to submit?**, choose **Plugin bundle** or **MCP connector**.
46 </Step>
41In the developer portal at [claude.ai/directory/manage](https://claude.ai/directory/manage), select **Submit new**.
4742
48 <Step title="Follow the checklist and submit pages">
49 Work through the checklist and submit pages for that kind:
43**2. Choose the submission type**
5044
51 * [Plugin pre-submission checklist](/docs/plugins/pre-submission-checklist), then [Submit a plugin](/docs/plugins/submit): for a plugin bundle
52 * [Connector pre-submission checklist](/docs/connectors/building/review-criteria), then [Submit a connector](/docs/connectors/building/submission): for an MCP connector
53 </Step>
54</Steps>
45Under **What would you like to submit?**, choose **Plugin bundle** or **MCP connector**.
46
47**3. Follow the checklist and submit pages**
48
49Work through the checklist and submit pages for that kind:
50
51* [Plugin pre-submission checklist](/docs/plugins/pre-submission-checklist), then [Submit a plugin](/docs/plugins/submit): for a plugin bundle
52* [Connector pre-submission checklist](/docs/connectors/building/review-criteria), then [Submit a connector](/docs/connectors/building/submission): for an MCP connector
5553
5654## Submit your plugin, and your MCP server as a connector
5755
directory/submission-status Changed · +3 / -3 lines
from line 6
66
77This page is for anyone with a submission in the portal. Review time isn't fixed.
88
9<Note>
10 If you haven't submitted yet, see [Publish to the directory](/docs/directory/publish).
11</Note>
9> [!NOTE]
10>
11> If you haven't submitted yet, see [Publish to the directory](/docs/directory/publish).
1212
1313Find your status in the table for your submission's kind: [plugin bundle](#plugin-bundle-statuses) or [MCP connector](#mcp-connector-statuses). If nothing is waiting on you and you still need an answer, see [Contact Anthropic about a submission](#contact-anthropic-about-a-submission).
1414