Unclear It is not clear what decides whether connector download offers are picked up at all, so whether this works by default is unknown.
Connectors from claude.ai link Claude Code to outside services. They work through MCP (Model Context Protocol), the standard Claude Code uses for outside tools. A connector's tool result can now offer files to download. Claude Code asks "Download … into …?" and gives you two choices, Download and Don't download.
If you choose Download, Claude Code:
- Saves up to 10 files from one tool result, each up to 100 MB.
- Puts them in a connector-downloads folder and writes a
.gitignorecontaining*there, so git ignores everything in it. - Refuses to save if git already tracks files in that folder.
- On macOS, marks the files with the quarantine attribute, and on Windows adds a Zone.Identifier. Both tell the system the file came from the internet.
- Adds a banner when a saved file is read, saying its contents are data and not instructions.
When a download is refused, Claude Code tells the model why. Reasons include an organization policy that does not allow connector downloads, not being signed in, a background run, and Remote Control being connected. Whether downloads are available depends on your account, on the organization policy allow_connector_file_downloads, and on checks made by the server. When you leave a worktree (a separate working copy of your project), the exit dialog now warns that removing the worktree also deletes files saved from connectors.
This lets connector data land on your disk, so the consent prompt and the safety checks around it matter. The git-ignore step keeps those files out of your commits, and the banner keeps the model from following instructions hidden inside a downloaded file.
It is not clear what decides whether connector download offers are picked up at all, so whether this works by default is unknown.