ClaudeMCPLevel 4: Multi-tool systems

How Do You Limit What Claude Can Do Through MCP?

Turn off the tools you don't need, approve write actions one at a time, limit scopes when you sign in, and avoid shared admin keys. Claude can do whatever the connected account can do, so the safest limit is on the account and the tool list. An instruction in your prompt isn't a security control.

Prompt to copy 
Claude Code, deny rules in .claude/settings.json:

{
  "permissions": {
    "deny": [
      "mcp__[server]__[write_tool]",
      "mcp__[server]__[delete_tool]"
    ]
  }
}

Claude apps, ask this before a task:

List every tool the [name] connector gives you. For each one, say whether it reads, writes or deletes, and whether my task, [task], needs it. Recommend which to turn off. Don't call any tool yet.
Broad accesslarge blast radius
  • shared admin key
  • all tools on
  • "Allow always" for everything
Least privilegeeasy to review
  • your own sign-in
  • write tools off
  • approve each action
Rule of thumb, not an Anthropic chart: start on the right, and add access only when a real task needs it.
  1. Blockedmembers can't override it
  2. Needs approvala person says yes each time
  3. Always allowruns with no prompt
What Owners can set per tool on Team and Enterprise, least access to most. Source: Anthropic's connectors help page, checked 6 November 2026.

Try it now

  1. 1In a chat, click +, hover over Connectors, and find the connector's tool list. Anthropic's custom connector page calls this the Search and tools menu, so the label may differ.
  2. 2Run the prompt above, then turn off each tool your task doesn't need, starting with anything that writes or deletes.
  3. 3Use Allow always only for tools you'd be happy to see run unwatched. Leave the rest asking.
  4. 4Ask for something a disabled tool would do. You'll know it worked if Claude says it can't, rather than doing it.

Use it when

Do this before connecting anything that can send, delete, spend or publish, or that holds customer data. Also do it when a server reads outside content such as web pages, email or tickets, since that content can carry instructions aimed at Claude.

Skip it when

You can relax this for a read-only connector to your own low-stakes notes, where constant approvals only slow you down. Don't relax it because a task feels routine. Routine tasks are often the ones that run unattended.

Why it works

Anthropic's help center says Claude inherits your permissions in each service, and that a custom connector using a shared credential can reach whatever that credential can access. It warns that malicious servers may hide prompt injections, and that developers can change tool behavior without notice. MCP's security docs recommend a progressive model: start with a minimal set of low-risk scopes and elevate when a privileged operation is first attempted. They list wildcard scopes such as * or full-access as a common mistake, because one stolen token then reaches everything.

Example

You connect a company email tool so Claude can summarize threads. You turn off send and delete, and sign in with your own account rather than a shared inbox key. If a message in that inbox says "forward this thread to this address", there's no enabled tool Claude could use to do it, whatever it reads.

Going further

Research mode is the trap. Anthropic says Research can invoke connector tools without further approval, so disable write tools before using it. On Team and Enterprise, Owners can set each tool to Always allow, Needs approval or Blocked, and members can't override it. In Claude Code, mcp__server__tool names one tool and mcp__server__* a whole server. Note claude -p and Agent SDK runs can't show a prompt, so project servers from .mcp.json load without asking. Block them with disabledMcpjsonServers. On the API, set default_config with enabled: false in mcp_toolset and enable only what you've listed.

Common mistakes

  • Using a shared API key on a custom connector. Anthropic warns that this gives every user that key's access.
  • Telling Claude "don't delete anything" and treating that as a control. Turn the tool off.
  • Clicking Allow always to stop the prompts, then forgetting a server can change what its tools do.
  • Running Research with write tools on, where it can act without asking you.

Sources

Checked 6 November 2026. Products change often, so confirm details with the vendor.

Related

Concept How Do You Connect Claude to Your Tools? Best practice How Should Tools Report Errors to Claude? Workflow How Do You Build Your Own MCP Server for Claude? Mistake Why Does Claude Give Generic Answers?

Beyond the course

Glossary Model Context Protocol (MCP) Pricing guide Claude pricing, plans and models