Connect Claude to a Custom MCP Server: Remote and Local Design Guide¶

For / Key Points

For: Developers and administrators connecting Claude to an internal API or custom service

Key Points:

Claude's custom connector reaches a remote MCP server from Anthropic's cloud
This route differs from a local MCP server configured in Claude Desktop
Design authentication, public reachability, tool permissions, and auditing before rollout

The Model Context Protocol (MCP) is an open standard for connecting AI applications to external data and tools.¹ Claude can register an existing or self-hosted remote MCP server as a custom connector.²

The first decision is not a configuration file. It is which Claude surface will connect to which server on which network.

Separate remote and local MCP¶

Concern	Custom remote MCP	Local MCP in Claude Desktop
Connection origin	Anthropic's cloud	User's computer
Reachability	Publicly reachable	Reachable from the computer
Main surfaces	Claude, Cowork, Claude Desktop	Claude Desktop
Typical use	SaaS, shared API, organization service	Local files, developer tools, on-device service
Management	Claude account or organization	Device configuration

Even when the client is Cowork or Claude Desktop, remote custom connector traffic does not originate directly from that computer. Anthropic's cloud connects to the server, so a VPN-only URL will not work without additional network design.²

Add the connector¶

Individual Pro or Max plan¶

Open Customize > Connectors
Select + > Add custom connector
Enter the remote MCP server name and URL
Optionally add an OAuth Client ID and Client Secret under advanced settings
Authenticate after adding it, then enable it for a conversation

Team or Enterprise¶

An Owner or Primary Owner opens Organization settings > Connectors
Register the URL through Add > Custom > Web
Add OAuth client details if required
Each user finds the connector under Customize > Connectors and authenticates individually

Free accounts can use one custom connector. The feature remains in beta, so screens and limits may change.²

Pre-deployment design review¶

Network¶

The server must accept connections from Anthropic's published source ranges. For internal systems, combine TLS, source restrictions, authentication, and rate limits instead of exposing an unrestricted endpoint.²

Authentication and authorization¶

Prefer per-user OAuth over a shared all-powerful token. Separate read and write tools and give write operations narrow scopes.

search_incidents        # read only
draft_incident_update   # draft only
publish_incident_update # publish after human approval

A single generic execute tool makes permission review and auditing much harder.

Tool definitions¶

State what a tool does, what it does not do, and its prerequisites in the name and description. Use explicit fields for target IDs, date ranges, and dry-run behavior instead of relying only on free-form text.

Audit and shutdown¶

Record the user, tool, target, result, and time on the server. Document how to revoke tokens, disable the connector, and suspend write tools independently.

Validate after connecting¶

Before permitting production writes, verify that:

Unauthenticated requests fail
Out-of-scope data is not returned
Read tools return only the intended fields
Dry-run returns a proposal without changing data
Writes occur only after explicit approval
Every call appears in the audit log

A custom connector can attach Claude to a service Anthropic has not verified. A malicious or compromised MCP server can become a path for data access or unintended actions. Connect only infrastructure operated by a trusted party.²

Summary¶

Choose remote MCP for shared Claude surfaces and local MCP for on-device use
Account for the fact that remote traffic originates in Anthropic's cloud
Build OAuth, least privilege, read/write separation, approval, and auditing into the tools
Test successful connectivity and safe execution as separate properties

If the service is already listed, start with Claude's Connectors Directory.