Check what an AI connector can read and change
A supplier says their product “connects to your systems via MCP”. Someone in the meeting nods, nobody asks what that means, and the demo was good.
What you'll make
a one-page review brief for one proposed connector: what it can read and change, whose access it uses, where the data goes, and the questions still waiting for an answer.
What you'll need
the supplier’s written description or answers, about 20 minutes, and a chat in Claude, ChatGPT, Gemini or Copilot through your work account to organise them. You don’t install or connect anything.
Example result.
Job: help staff find an order's current status
Reads: orders and customer contact details (documented)
Writes: order notes and status (documented, not needed for this job)
Account: shared service account; its scope is not stated
Approval before writing: UNKNOWN; disconnect is not approval
Next: ask what the service account can reach, and who reviews it1. Name one job, and decode the words
Write the result you want in plain language. “Find an order’s current status” is much narrower than “connect the whole company”, and it tells you which capabilities to question.
Three words get used as if they’re interchangeable:
- An integration is two systems exchanging information. Plenty involve no AI at all.
- A connector (OpenAI calls it an app) lets an AI assistant work with one external service. Some only retrieve. Others can create, edit, send or delete.
- An agent decides which actions to take and takes them across several steps. It usually uses connectors.
MCP, the Model Context Protocol, is an open standard for connecting AI applications to tools and data. Its own documentation compares it to a USB-C port. That’s the useful part: a USB-C socket doesn’t make a device safe or well behaved. It means the plug fits.
Why this works: “supports MCP” tells you about compatibility. It says nothing about what the connector reads, changes or whose permissions it uses, so the job has to come first.
What you should see: one sentence naming the job, the sources it needs and who will see the answers.
2. Ask the supplier four questions in writing
Send these to the supplier or the colleague proposing the connector, and ask for written answers.
- Does it read, write or both, and which specific actions? A list, not a paragraph about seamless integration.
- Whose permissions does it use? The signed-in person’s, an administrator’s, or a shared service account’s.
- Where does the data go? Which organisations process it, and what are their retention, training-use and deletion terms?
- Who is asked before it writes, and who can turn it off? What happens if nobody responds?
Don’t put an API key, password or private connection link into any chat. An administrator can describe the scope without sharing the credential.
Why this works: each question maps to a different risk, and a supplier who can’t answer them clearly for a non-specialist has told you something useful anyway.
What you should see: four written answers, ideally with links to the supplier’s documentation.
3. Ask AI to organise the answers into a brief
Paste the answers and any documentation excerpts, with their links.
Prepare a review brief for this proposed connector and job, using only the material below. Fields: job; documented read actions; documented write actions; account or identity used; data recipients; retention and deletion; approval before writing; owner and disconnect route; unknowns.
For each field, state what is documented and give the source link or the supplier's exact words. Mark missing details UNKNOWN. Don't infer that MCP support, a well-known brand, EU hosting or a read-only label makes the connector safe or compliant. List the questions an administrator or supplier must still answer.
Job: [the job from step 1]
Material: [supplier answers and documentation excerpts][the job from step 1] is your one-sentence job. [supplier answers and documentation excerpts] is the written material from step 2.
Why this works: the source restriction makes gaps visible instead of filling them with marketing language.
What you should see: a brief with several UNKNOWN fields. That’s normal on a first pass, and it’s the point.
4. Decide what needs a human answer
Check that the job needs every action listed. If it only looks things up, ask why it needs write access. Then look at the approval controls your assistant offers. In Claude, connector tools can be set to Always allow, Needs approval or Blocked. On Team and Enterprise plans, Owners set this for the organisation. In ChatGPT, each app’s permission runs from Always ask (it asks before reading or changing anything) through Allow read actions and Allow low-risk actions to Allow all actions, which OpenAI flags as carrying elevated risk.
Both vendors make the same point: these settings only change when the assistant asks. They don’t grant new access, and they can’t remove access the connector already has. Permissions are a narrowing mechanism. They can’t fix access that was too wide to begin with.
Why this works: it separates two questions people often merge: what the connector can reach, and when a person is asked.
What you should see: one of three outcomes: “ready for a restricted trial”, “more information needed” or “unsuitable for this job”, agreed with your administrator, security or privacy owner. The chat itself doesn’t approve anything.
Check the result
- Every capability in the brief traces to the supplier’s words or a documentation link.
- Read actions and write actions are listed separately.
- The account question names a specific account type, or says UNKNOWN.
- Nothing in the brief treats MCP, hosting location or a brand name as evidence of safety.
The usual failure: the brief turns marketing wording into a conclusion. “Connects via MCP, hosted in the EU, can be disconnected” becomes “a safe, read-only integration”. Spot it by finding any adjective (safe, secure, compliant, read-only) and asking which sentence in the source supports it.
The source says [exact wording]. It does not establish [claim in the brief]. Replace that claim with UNKNOWN and add one precise question that would resolve it. Keep the supported capabilities unchanged.[exact wording] is the supplier’s sentence, and [claim in the brief] is the conclusion the model drew from it.
Worked example: an order-status connector
Fictional example. A supplier is selling an “AI operations assistant” that “connects to your systems via MCP”. The job is to help staff find an order’s current status. Their written answers:
Q1 Read/write and actions? "Full read access to orders, customers and invoices. Write access to order notes and status. Cannot create or delete records."
Q2 Whose permissions? "We connect using a service account provided by your administrator."
Q3 Where does it run? "Our platform is hosted in the EU. Data is processed on our infrastructure."
Q4 Approvals and off switch? "Your administrator can disable the connection at any time from our admin panel."The first brief summarised this as “a safe, read-only integration via MCP, hosted in the EU”. After the repair prompt, run once for each claim, the brief matched the example result, with these notes:
- Answer one is good, and the brief had it wrong. It names actions and draws the line at create and delete. But it includes writing to order status, which customers may see, so “read-only” was false. The lookup job doesn’t need either write action.
- Answer two is the real issue. A shared service account means everyone using the assistant can reach whatever that account can reach, regardless of their own access. That may be fine, but it has to be a decision. The follow-up is one line: what exactly can that service account access, and who reviews it?
- Answer four is the weakest. An off switch is not an approval mechanism. Nothing says a person is asked before a status changes. Answer three is half an answer: “our infrastructure” is another organisation holding customer data, which is a question for whoever owns data protection.
The outcome was “more information needed”, with two conditions: a documented scope for the service account and a written answer on approval before writing.
Try it
Read access and write access are separate
Choose the proposed job and inspect which capabilities it actually needs.
Order lookup needs a scoped read, not note updates or status changes. Even the reads need necessity and permission review.
Task kit for this job: Download (ZIP) · Reusable instructions
Go deeper
The MCP vocabulary worth knowing
The AI application is the host. It connects to MCP servers, programs that offer capabilities, through a client for each one. A server can offer tools (actions the assistant can invoke), resources (data it can read) and prompts (reusable templates). “Tool” doesn’t mean “write”: a tool can be a read-only search. A mechanism called elicitation lets a server ask the user for more information or confirmation mid-task, so two connectors to the same system can behave quite differently about stopping to ask. Check the combination you’ll use, not the protocol.
Where to look in your assistant
In Claude, connectors are managed under Customize › Connectors, where each tool’s permission can be set. Organisation-wide settings for Team and Enterprise are under Organization settings › Connectors. Claude inherits each person’s permissions from the connected service, except for custom connectors using a shared credential, which reach whatever that credential can access. In ChatGPT, connected apps are under Settings, labelled Apps or Plugins depending on your version, and each app has its own permission setting. Workspace admins can set limits that override yours.
When this isn't the right method
This isn’t a security review. Four questions catch the common vagueness, not a determined problem. Anything touching payment data, health data, children’s data or a regulated process needs the people whose job that is. The method also won’t tell you whether a connector is good at its job: one with careful permissions that returns the wrong records is still useless. Test that on work where you already know the answer, with your administrator’s agreed test records. If you’re asked to approve one and don’t feel qualified, say so, and ask for the four answers in writing anyway.