The Complete Agent Stack · Part 10 of 14 · Distribution layer

This guide is one part of a 14-part series on what a production data agent needs, from the data model it reads to the agent that keeps it accurate. Each part stands on its own, and they build on each other in order.

← Previous: Part 09: AI Report Builder · Next: Part 11: How to Evaluate an AI Data Agent →

Many people now draft, research and reason in a general-purpose assistant such as Claude, and data questions follow them there. The quickest route, exporting a spreadsheet and pasting it into the chat, gives an answer with no permissions, no shared definitions and no record for the data team. Connecting Claude to data through MCP can fix all three, but only if the server behind the connector is designed for it. This guide explains how Claude connects to external data, what makes a data connector governed and how to set one up.

Key Takeaways

• MCP is the open standard behind Claude connectors: Anthropic introduced the Model Context Protocol to replace one-off integrations, noting that "every new data source requires its own custom implementation" without a shared protocol.

• Remote connectors are reached from Anthropic's cloud: Claude's help centre says a remote MCP server must be reachable over the public internet from Anthropic's IP ranges, even when the user is on Claude Desktop.

• Per-user sign-in is what makes permissions work: Claude's connector documentation says tools that act as the individual user should use OAuth, where each person signs in with their own account, and that a shared API key should not be used to identify which user is calling.

• Ungoverned AI use has a measurable cost: IBM's breach research found that one in five organisations reported a breach due to shadow AI, with an average of $670,000 in higher breach costs.

The 45-second version:

What Is MCP, and How Does Claude Use It?

The Model Context Protocol is "an open standard that enables developers to build secure, two-way connections between their data sources and AI-powered tools" [1]. Anthropic introduced it because every new data source otherwise needed its own custom integration [1]. An MCP server exposes tools, resources and prompts, and an MCP client such as Claude discovers them and calls the tools when a conversation needs them.

In Claude, an MCP server appears as a connector. Claude's help centre describes three kinds [3]:

• Directory connectors are pre-built integrations listed in the Connectors Directory.

• Custom connectors point Claude at a remote MCP server by its URL.

• Desktop extensions run a local MCP server on the user's own computer inside Claude Desktop.

Custom connectors are available on Free, Pro, Max, Team and Enterprise plans, and Free users can add one [2]. On Team and Enterprise plans, an Owner adds the connector for the organisation and each member then connects with their own account [4]. Claude connects to a remote server from Anthropic's cloud infrastructure, so the server must be reachable from the public internet even for desktop users [2].

For builders, Claude's documentation recommends the Streamable HTTP transport, supports tools, prompts and resources, and accepts text and image tool results [5]. It also sets practical limits that shape how a data tool should respond. On claude.ai and Desktop, a tool result can be about 150,000 characters and a tool call times out after 240 seconds [5]. An analytics tool that returns ten thousand raw rows will hit those limits quickly, and large results also crowd the model's working context, as our guide to context rot explains. A tool that returns a summarised result, a short explanation and a chart avoids both problems.

Why Is Pasting Data Into a Chat Assistant Ungoverned?

When someone exports a table and pastes it into a chat, every control the data team built stays behind in the warehouse. The assistant sees whatever rows the person happened to export, and anything it produces can be shared onwards without the row-level rules that applied in the warehouse. It has no access to the agreed definition of "active customer" or "net spend", so it infers one from column names. The snapshot is stale the moment it leaves the warehouse. Nobody on the data team knows the question was asked or what answer came back.

This is a specific form of shadow AI, meaning AI use outside sanctioned systems. IBM's research on data breaches found that one in five organisations reported a breach due to shadow AI, and that those incidents carried an average of $670,000 in higher breach costs. The same report found that 63% of breached organisations either had no AI governance policy or were still developing one [8]. A governed path inside the assistant addresses the demand behind this behaviour, which a ban on assistants does not.

A second, quieter cost appears when teams fix the problem by building a separate agent just for Claude. That agent needs its own prompts, its own metric definitions and its own permission logic. Over time it drifts away from the agent embedded in the product or answering in Slack, and the data team ends up maintaining two sets of definitions.

Three Ways to Do Data Analysis in Claude

Teams usually choose between three patterns. Each has a place, and the right one depends on how sensitive the data is and how many people will ask questions.

The direct database route deserves a fair hearing. For an engineer who already holds credentials and knows the schema, it is quick and transparent. The trouble starts when the same connector is offered to people who do not know the data. The assistant has to write SQL against raw tables with no business context, a problem covered in our guide to the semantic layer for AI. It may also be running every query under one service account, so the database cannot tell users apart.

What Makes a Claude Data Connector Governed?

A governed connector carries the same controls into Claude that apply everywhere else. Five properties matter most.

Each user signs in as themselves

Claude's authentication documentation describes three options for remote servers: OAuth, where each user signs in with their own account; a static credential that an Owner enters once and Claude sends on every call; or no authentication [6]. For data, OAuth is the one that preserves identity. The documentation is explicit that a static credential should be treated "as the organization's credential, not a person's", and that tools which need to act as the individual user should use OAuth instead [6]. It also recommends scoping what each user can reach "with your service's own per-user permissions" [6].

Permissions are enforced by the server

Claude's help centre notes that connectors inherit each user's permissions in the source system, so a connector cannot retrieve content the user could not access there [3]. That guarantee is only as strong as the server's own enforcement. For analytics, the server should apply row-level security before any query runs, outside the model's context, so no prompt can talk its way around it.

Definitions come from one place

The connector should answer from the same data model, prompts and skills as every other deployment. A question asked in Claude and the same question asked in an embedded product should produce the same number, because both run through the same data model.

Tool access is deliberate

Team and Enterprise admins can set each connector action to "Always allow", "Needs approval" or "Blocked" [3]. Anthropic's own guidance for custom connectors is to connect only to trusted servers, review requested permission scopes, stay alert to prompt injection, reserve "Always allow" for trusted servers and block tools that are not needed [2][4]. A read-only analysis tool is easy to approve, while a connector that can write or delete data deserves more scrutiny.

Every call is observable

Admins should be able to see what people ask through Claude and what answers they receive, in the same history as every other surface. Without that, the data team cannot find wrong answers, spot missing definitions or show auditors who saw what. Our guide to AI agent observability covers what to log.

How to Set Up a Data Agent Connector in Claude

The exact screens change over time, but the sequence is stable.

1. Choose what the connector exposes. Decide which agent, project or dataset the MCP server should answer from, and keep the scope narrow at first.

2. Add the connector. On Team and Enterprise plans, an Owner adds it under organisation connector settings by URL, choosing OAuth sign-in. On individual plans, users add it themselves under Customize > Connectors [4].

3. Connect as each user. Every member clicks Connect and signs in through OAuth, so the server knows which person is asking and can apply their permissions [4].

4. Set tool permissions. Allow the analysis tool, and require approval for or block anything that writes data [3].

5. Tell Claude when to use it. Claude may not always route a data question to the connector, so naming the connector in the prompt, or adding a project instruction or skill, helps.

6. Review the first week of usage. Check the agent's history for questions it answered poorly, and add the missing definitions.

Charts are part of the experience. MCP Apps, an extension to MCP, lets a server render interactive interfaces such as charts inside a Claude conversation on web, desktop and mobile [7]. Claude also accepts image-based tool results [5], so a data connector can return a visual answer as well as text.

How Upsolve Approaches MCP for Claude

MCP for Claude connects an existing Upsolve agent to Claude with one OAuth sign-in, so questions asked in Claude run through the same governed context, permissions and observability as the product and Slack deployments. It is one of several deployment options: the same agent can be embedded in a product as an iframe, exposed to Claude for internal use, or deployed as an MCP server for end users' own agents.

Setup is a settings change in Upsolve and a connection in Claude, with no code. In organisation settings, an admin picks which agent the MCP server exposes and can switch it at any time. In the demo, that was the procurement analytics agent from a sample project. In Claude, the user finds the Upsolve AI connector in the connectors list, signs in through OAuth and allows the single tool it provides, Analyze Data.

Analyze Data runs the same analysis Upsolve runs everywhere else. In the demo, a sample question asked for purchase orders over the last six months. The answer noted that August's data was empty and its purchase orders were still in draft, and that July had fallen sharply from June, with a chart rendered directly in the Claude conversation. The demo prompt began with "Using Upsolve" because no Claude skill had yet been set up to route data questions to the connector, which is a useful habit for any team in its first weeks.

Governance carries over unchanged. The connector uses the same data model, row-level security and agent configuration as every other surface, and every Claude call appears in the agent's chat history for admins alongside embedded and Slack conversations. "You can find all the full observability here as an administrator and see how people are consuming your Upsolve data agent," said Serguei Balanovich, Upsolve. More detail is on the MCP for Claude feature page, and the reverse direction, connecting other MCP servers to an Upsolve agent, is covered in our guide to MCP servers for data agents.

Frequently Asked Questions

Can Claude connect to my data warehouse?

Yes, through an MCP connector. A team can connect Claude to a database MCP server directly, or to a data agent that sits between Claude and the warehouse. The direct route is quick for engineers who know the schema. For business users, a governed agent is safer, because it applies shared metric definitions and per-user row-level security before any query runs. Either way, a remote MCP server must be reachable from Anthropic's cloud over the public internet.

Is it safe to connect Claude to company data with MCP?

It can be, if the connector is set up carefully. Anthropic advises connecting only to trusted servers, reviewing requested permission scopes, watching for prompt injection and keeping "Always allow" for trusted tools. On the server side, per-user OAuth, permissions enforced outside the model and a full audit trail make the difference. A read-only analysis tool that returns summarised results carries much less risk than a broad connector with write access to production systems.

Do Claude connectors respect existing permissions?

Claude's help centre says connectors inherit each user's permissions in the source system, so Claude cannot reach data the user could not reach there. That holds only when the server knows who the user is. With OAuth, each person signs in with their own account and the server can enforce their rules. With a single shared API key, every request looks the same, and Claude's documentation warns against using such a key to identify individual users.

Can Claude show charts from an MCP server?

Yes. Claude accepts image-based tool results, and MCP Apps, an extension to the Model Context Protocol, lets a server render interactive interfaces such as charts directly inside a Claude conversation. Anthropic lists MCP Apps as available in Claude on web, desktop and mobile. For a data connector, this means an answer can arrive as a chart plus a short explanation, so users do not need to copy numbers into another tool to visualise them.

Which Claude plans support custom connectors?

Claude's help centre lists custom connectors using remote MCP on Free, Pro, Max, Team and Enterprise plans, with Free users limited to one. On Team plans, Owners and Primary Owners add custom connectors for the organisation. On Enterprise plans, people with a custom role that includes managing the organisation's libraries can add them too. Members then connect individually with their own accounts. Plan details can change, so check Anthropic's current documentation before rolling out.

How do admins see what people ask a data agent in Claude?

Claude shows each user their own conversations, but the data team needs a central view. The practical answer is to log on the server side: every tool call the connector receives, the question, the SQL that ran and the answer returned. When the connector fronts a data agent that is also deployed elsewhere, those logs should land in the same history as product and Slack conversations, so admins review one record of usage.

Sources

1. Anthropic: Introducing the Model Context Protocol. https://www.anthropic.com/news/model-context-protocol

2. Claude Help Center: Get started with custom connectors using remote MCP. https://support.claude.com/en/articles/11175166-get-started-with-custom-connectors-using-remote-MCP

3. Claude Help Center: Use connectors to extend Claude's capabilities. https://support.claude.com/en/articles/11176164-use-connectors-to-extend-claude-s-capabilities

4. Claude Docs: Add a connector that isn't in the directory. https://claude.com/docs/connectors/custom/add-unlisted

5. Claude Docs: Build an MCP server for Claude. https://claude.com/docs/connectors/building/index

6. Claude Docs: Authentication for connectors. https://claude.com/docs/connectors/building/authentication

7. Claude Blog: Your favorite work tools are now interactive connectors inside Claude. https://claude.com/blog/interactive-tools-in-claude

8. IBM Newsroom: IBM Report: 13% Of Organizations Reported Breaches Of AI Models Or Applications, 97% Of Which Reported Lacking Proper AI Access Controls. https://newsroom.ibm.com/2025-07-30-ibm-report-13-of-organizations-reported-breaches-of-ai-models-or-applications,-97-of-which-reported-lacking-proper-ai-access-controls

Bring your governed data agent into Claude. Start free at upsolve.ai with 2,000 free AI credits, or talk to our team about deploying one agent across your product, Slack and Claude. Next in the series: Part 11: How to Evaluate an AI Data Agent.