Connectors and MCP

How a routine reaches other services. Claude connectors, local MCP servers in a cloud run, gateways such as Zapier MCP, write access and gates, and how each is declared in app.toml.

What it is

A connector is an integration on a person’s claude.ai account, built on the Model Context Protocol (MCP). An MCP server is any service that speaks MCP; a connector is one way of adding one. In a scheduled task, connectors are how a run reads from and writes to other services without holding a key.

Why it exists

A connector is the top rung of the secrets ladder: the person authenticates once on claude.ai, and no key ever reaches the run, the repo or the Desk. Connector traffic also goes through Anthropic’s servers rather than the run’s network, so it is not blocked by the environment’s allowlist (connector-traffic-bypasses-sandbox-network, docs-stated). For most routines that makes a connector the safest and most reliable way to reach a service.

How it works

Connectors in a scheduled task

Per the scheduled tasks docs (source, fetched 2026-10-30):

Connectors are the claude.ai integrations on your account.
When you create a task, all of your currently connected connectors are included by default. Remove any the task does not need: “Claude can use an included connector during a run, including writes.”
MCP servers added locally with claude mcp add live on your machine, not your account, so a cloud task cannot see them. To use one, add it as a connector at claude.ai/customize/connectors, or, for a task with one repository, declare it in a committed .mcp.json (not for tasks that run as threads in a project).
Connector actions appear as you: “Slack messages, Linear tickets, or other connector actions use your linked accounts for those services.”

The registry records that connectors are account-level and that a task can drop connectors it does not need, but no per-tool subset was found (connectors-account-level, docs-stated).

How many connectors exist

The Claude connectors directory showed 1037 connectors under “All connectors” at fetch time (claude.com/connectors, fetched 2026-10-30). Treat it as a snapshot; the number changes.
Zapier’s MCP page states “9,000+ apps” and “66,000+ triggers and actions” (zapier.com/mcp, fetched 2026-10-30). That is Zapier’s figure for its own gateway, not an Anthropic figure. Zapier says each tool call uses two tasks from the same quota Zaps use.
Pipedream Connect describes built-in authentication for “more than 3,000 APIs via MCP” (pipedream.com/docs/connect/mcp/developers, fetched 2026-10-30).

Custom remote MCP connectors run from Anthropic’s cloud, so the server must be publicly reachable (support article, fetched 2026-10-30). On Team and Enterprise, an Owner enables a connector and each person authenticates.

Declaring a connector

Every connector or MCP server a routine uses is an [[integration]] in app.toml, named in the routine’s connectors list:

[[routine]]
name = "hiring-signals"
connectors = ["gmail"]

[[integration]]
name = "gmail"
kind = "connector"     # connector, mcp, secret-host or http
direction = "write"    # read or write; write needs gate = true
hosts = []
gate = true

lint refuses a write integration without a gate: “integration ‘gmail’ writes externally, set gate = true”. The permission screen lists each connector with its direction, and the person approves the list before anything is created. A pack declares the same thing in its connectors array; see Connectors in packs.

Write access and gates

Because an included connector can write, RoutineOS treats every write connector as a send. A gate stops any send, post or delete until a person approves (see Gates and approvals). A pilot saw a run use a send tool the approved permission screen did not list (run-uses-unlisted-send, pilot-verified), so the fixed prompt header forbids unlisted sends and each routine lists its tools.

Two connectors carry approval behaviour of their own:

Gmail: send actions require approval by default, and Team and Enterprise owners decide whether members can skip it (Google Workspace connectors, fetched 2026-10-30). In RoutineOS’s pilot, a Gmail send from an unattended run went through with no policy change (approval-email-slack, pilot-verified, 2026-10-28). The two do not obviously agree; probe it in your own account before relying on it.
Slack: a pilot needed the Slack connector’s tool policy set to “Ask for approval” on claude.ai before a send tool was exposed to the run (same registry record).

Local MCP servers and `.mcp.json`

A routine with delivery = "repo" can commit a .mcp.json to its repository to bring an MCP server into the run, per the docs above. The server still has to be reachable from the run’s network, so a stdio server must install inside the run (setup script) and an HTTP server must be on an allowed domain. Probe it first.

Worked example

Hiring Signals’ gate uses the email transport ([gate] transport = "email", 48 hours), and the email transport is the Gmail connector (see Gates and approvals). The jobs-watch pack declares three connectors: web-search and web (kind builtin, read, required) and mail (kind connector, write, optional, used by the approve stage, alternative Slack, “Add a mail connector to the routine’s environment before you turn gated messages on.”). So the only claude.ai connector it needs is a mail connector, and only once gated messages are on. It names no job-board connector.

When the person creates the task, every connector on their account is included by default: perhaps Gmail, Google Drive, Slack and Notion. RoutineOS’s permission screen lists only Gmail, so the person removes the other three in the task’s Connectors tab. A Hiring Signals run then cannot post to Slack or edit Notion, whatever a fetched page says.

If a job board later offers an MCP server, the design adds [[integration]] name = "jobs-board", kind = "mcp", direction = "read" (illustrative), and a new permission screen.

Reference

`kind`	Means	Network
`connector`	A claude.ai connector	Through Anthropic’s servers
`mcp`	An MCP server reached another way, for example `.mcp.json`	The run’s network unless it is a connector
`secret-host`	A host reached with a network secret	Reachable at any network level (docs)
`http`	A plain HTTP host	The environment’s allowlist

Common pitfalls

Leaving every connector included. The default includes all of them, with write access. Remove what the routine does not need.
Expecting claude mcp add servers in the cloud. They are on your machine.
Citing an integration count as Anthropic’s. 9,000+ is Zapier’s figure for Zapier MCP.
Assuming the connector acts as a bot. It acts as you.