Check the Connector: 5 Checks Before You Plug AI Into Your Accounts

01 Why the login page isn't the check anymore

A connector is the plug between an AI assistant and one of your accounts. You sign in once, and the assistant can search your inbox, read your Drive or edit campaigns in your ad account.

The standard behind these plugs is MCP, short for Model Context Protocol, an open standard Anthropic created. On September 28, 2026, a warning was published for its official Python toolkit: "OAuth client could send credentials to an authorization server chosen by the MCP server."

What happened: you approve your real Google or Okta sign-in page, and the connector takes the hand-off that happens a second later. Your password stays put, but the connector gets a working pass into whatever the app could reach. Then it looks like a flaky server.

This wasn't Claude or ChatGPT. It hit apps built with that toolkit's sign-in code, like a custom agent or an automation an agency set up. Both official toolkits are fixed. As of the end of September, the Cloud Security Alliance said no attacks using the Python flaw had been reported.

The login page isn't the thing to check anymore. The connector is.

02 The five checks before you click connect

Pick the account it signs into. Experimental? A separate test account. A team? The most limited account that still does the job.

Decide: read, or write? Some only look. Others send, edit and delete. Block the tools that send, publish or spend until you've watched the rest.

Check what it does without asking. Save "Allow always" for connectors you'd trust to run with nobody watching.

Confirm who built it, and that it's the real one. The app's own company, or a stranger? Check the name against the real project.

Find the off switch. Know where you'll disconnect it before you connect it.

One key, whole team. Anthropic says that on Team and Enterprise plans, a connector using one shared key gives everyone that key's access. Use a key limited to what members should reach.

Connector record (one per connector)

Connector: [NAME]
Built by: [THE APP'S OWN COMPANY / VERIFIED / COMMUNITY / CUSTOM]
Signs into: [WHICH ACCOUNT]
Can: [READ ONLY / READ AND WRITE]
Blocked tools: [THE ONES THAT SEND, PUBLISH OR SPEND]
Allow always: [YES / NO]
Off switch: [WHERE TO DISCONNECT IT]
Review again: [DATE]

03 Setting the checks in Claude

Block one tool

Go to Customize > Connectors. Select the connector. Set each tool that sends, publishes or spends to Blocked.

Approvals

Claude asks before it uses a connector's tools, unless you click "Allow always." Anthropic's advice: click it only for tools you trust to run unsupervised.

The Research exception

During a Research task, Claude can use your connectors' tools without asking again. Anthropic's advice: switch off the tools that write first.

Who built it

Claude's directory separates connectors Anthropic has verified from community ones. A custom connector you add by its address is not verified.

04 Three questions for whoever built your AI tool

If an agency or developer built you an AI tool in Python, send them this.

Message to your developer

Hi [NAME],

A quick check on [TOOL NAME], after the MCP Python toolkit warning of September 28, 2026 (GHSA-qx49-fqc8-xw99):

1. Are we on version 1.30.0 or 2.2.0 (or later) of the MCP toolkit?
2. Did you turn on the new sign-in check the fix asks for (the issuer setting)?
3. Did you change any secrets the old version might have sent out, and revoke its tokens?

Thanks,
[YOUR NAME]

The "issuer" is the address of the real login service. The fix has the tool state it up front, so a connector can't swap in its own. For apps that sign in on their own, the advisory says upgrading alone is not enough: the issuer must be set. A "secret" is the app's own password with the login service; "tokens" are the passes it was handed. Cycode, whose researcher reported the flaw, says a leaked secret keeps working until someone changes it.

Built in JavaScript instead? That toolkit had the same kind of flaw, disclosed October 6, 2026, fixed in 1.31.0 and 2.2.0.

05 The monthly off-switch review

A connector you approved once isn't a connector that's safe forever. In September 2025, a fake connector for Postmark, an email-sending service, worked normally until version 1.0.16 added one line: blind-copy every email to its publisher.

Google: remove an app you don't use

Go to your Google Account's linked apps page. Select Access to your Google Account, then the app. Select See details. If you don't use it, select Remove access, then Confirm.

Claude

Disconnect any connector in Claude's settings at any time. TikTok's setup guide says its Claude connection expires every 30 days. Copy that habit everywhere.

Clear your Google linked apps. Remove what you don't use.

Clear your Claude connectors. Disconnect what nobody needs.

Book next month's review. Same day, every month.

When a connector fails. If it fails right after a perfectly real sign-in, don't shrug it off. Open the list.

Sources

GHSA-qx49-fqc8-xw99, MCP Python SDK security advisory (GitHub) Cycode: MCP SDK OAuth flaw enabled account takeover Cloud Security Alliance research note, September 30, 2026 MCP TypeScript SDK advisory, CVE-2026-104850 (GitLab Advisory Database) The Hacker News: first malicious MCP server found (postmark-mcp) Claude Help Center: custom connectors using remote MCP Claude docs: add a connector that isn't in the directory The Keyword: TikTok brings its Ads MCP to Claude PPC Land: Meta opens its ad system to Claude and ChatGPT Google Account Help: manage links with apps from other developers

Mathew's LibraryLibrary card

Free access

Keep reading free with your library card

One email opens this checklist and all 3 resources in Mathew's library. No account, no password.