How does AI reach your email, files and apps?

20 min · as of Oct 2026

You will be able to

Say in one sentence what a connector and MCP are, connect one app safely in Claude, ChatGPT or Gemini, say for each connection whether it can only read or can also change things, and switch off what you do not use.

Part of Safe by designTime about 20 minutes, with the try-itChecked 16 Oct 2026

Three things to take away

1
A connector is a signed-in link from your AI to another app, such as your email, calendar, files or customer system. It works as you, so it can reach only what your own account can reach.
2
MCP is the shared standard those links are built on. Think of a USB-C port: one shape of plug, so one AI app can plug into many services. You will rarely set it up yourself.
3
One question decides most of the risk: can it only read, or can it also change things (send, edit, move, delete)? Keep changes behind your yes, and connect only what the work needs.

In plain words

One idea, several names

Each company uses its own word for the same thing.

	Claude	ChatGPT	Gemini
The link to another app	Connector	App (installed inside a plugin)	Connected app (one you add yourself is a "custom app")
A box of links plus skills	Plugin	Plugin	No name for it
Where you add one	Customize > Connectors	Settings > Plugins	Customize, or Settings > Connected Apps

In this lesson, "connector" means all three.

MCP in plain words

MCP stands for Model Context Protocol. It is a shared standard for plugging an AI app into other software. Its own site says: "Think of MCP like a USB-C port for AI applications."

Four parts, from your side to theirs:

Part	What it is	The everyday picture
Your AI app	Claude, ChatGPT or Gemini	Your laptop
The connector	A ready-made link from your AI to the service, signed in as you	The cable
The MCP server	A doorway on the other service's side, usually run by that service itself. It lists what an AI may do there, such as search files, read a message or create a record	The port on the other device
MCP itself	The shared standard that all of the above follow	The USB-C shape, so any cable fits any port

So MCP is the standard, and a connector is one plug built on it. A plugin is a box that holds connectors and skills together.

You do not need to know more than that to use connectors well. When someone says "it has an MCP server", they mean "your AI can plug into it".

Skill or connector?

They do different jobs, and you often want both.

A connector gives the AI access to a tool or a source of data: your mail, your files, your sales system.
A skill teaches the AI how to do a task: your team's way of writing the weekly update (lesson: What is a skill, and why is it replacing the prompt pack?).

Anthropic puts it this way: "MCP connectors give Claude access to a tool or data source, and skills teach it how to do a task." OpenAI says the same: use a skill when instructions and templates are enough, and add MCP when you need live data or actions.

Start to end

Check before you connect anything

Nine checks. Run them every time.

Is it allowed? Use what your company approves. On Claude's Team and Enterprise plans, an owner adds connectors first.
Who made it? Prefer the official or verified one. Anthropic says custom connectors connect to services that "haven't been verified by Anthropic". Google says it "does not control, monitor, or secure third-party MCP servers".
What can it read and change? Read the access screen before you approve.
Start careful. Choose "Needs approval", "Always ask" or read-only. Avoid "Allow all actions".
The right account. Connect your work account for work data, never a personal one.
Only what the task needs. Switch connectors off in chats that do not need them.
Watch for hidden instructions. Review what the AI proposes before it acts on outside material.
Know where data goes. Connected services handle your data under their own terms.
Disconnect when you are done.

As of Oct 2026 · read 16 Oct 2026

In your assistant

Menus move often. If a setting is locked on a work account, write it down and ask your IT team.

Claude

Connect one, start to end

Go to Customize > Connectors and select Discover.
Search for the service, and check its Verified or Community label.
Select Connect to Claude. On Team or Enterprise you may see Request until an owner adds it.
Sign in to the service, read what access it asks for, and approve.
In a chat, select +, then Connectors, and switch it on for that chat.
When Claude asks to use a tool, choose Allow once until you trust it.

Read or write, tool by tool: each tool of a connector can be set to Always allow, Needs approval or Blocked. In a chat, Claude asks with Allow once or Always allow. Keep anything that sends, edits or deletes on Needs approval.

Your own MCP link (for advanced users): select Add, then Custom > Web, and paste the server address. Free plans are limited to one. Add one only if your company approves it.

ChatGPT

Connect one, start to end

Open Settings > Plugins and select the app, or the plugin that includes it.
Select Install plugin, then Connect, and sign in to the right account.
Review the permissions, then finish the sign-in.
In a chat, type @ or select + to pick the app.
Set its permission to Always ask or Allow read actions while you learn.

Read or write, as a setting: the four choices are Always ask, Allow read actions, Allow low-risk actions and Allow all actions. Start with the first two. Avoid Allow all actions.

Your own MCP link (for advanced users): Developer mode (beta), on Plus and up. Add one only if your company approves it.

Gemini

Connect one, start to end

Open the left menu and click Customize to discover and connect apps. There are more than 40, mostly in the US and in English.
For Gmail, Drive, Docs and Calendar, connect the Google Workspace app. On a work account, your admin decides which apps are allowed.
Mention an app with @ to make Gemini use it.
Remove apps you no longer use from Connected Apps.

Read or write: Google says Gemini asks you to confirm every write action in a custom app, and in a task it asks before it sends messages, makes purchases or submits forms. It does not promise this for every connected app, so read what each app can do before you connect it.

Your own MCP link (for advanced users): a custom app, added by its MCP server address, on the web only. For now it needs the US, age 18 or over, a personal account and English.

On your own work · nothing private

Try it (10 minutes)

You only look at settings in this one. Nothing gets pasted anywhere.

Open the list (2 minutes). Claude: Customize > Connectors. ChatGPT: Settings > Plugins. Gemini: Customize, or Connected Apps.
Make a three-column note (5 minutes), on paper or in a document of your own, not in the chat: the app; read only, or can change things (check its access screen or its tool settings); used in the last month, yes or no.
Set the brake (2 minutes). For each app that can change things, ask three questions: can it be undone easily, does it leave the team, and does it read outside content? If the first answer is no, or either of the others is yes, set it to ask first (Needs approval in Claude, Always ask in ChatGPT) where your tool lets you.
Switch one off (1 minute). Disconnect one app you have not used in a month, after checking that no scheduled task uses it. On a work account where your admin manages it, add it to a note for IT instead.

Three questions · pick one answer each

Quick check

1What is MCP, in one line?
The answer: B Its own site compares it to a USB-C port for AI applications.
2Which question decides most of a connector's risk?
The answer: C Changes act in your real systems, with your access. Keep them behind your yes.
3A website offers a custom MCP connector that "connects your AI to everything". What do you do?
The answer: B Anthropic says custom connectors connect to services that "haven't been verified by Anthropic", and Google says it "does not control, monitor, or secure third-party MCP servers".

0 of 3 answered

Read the whole lessonThe idea in full, the worked examples, common mistakes and what to check

The idea

Without a connector, your AI knows only what you paste or attach. With one, it can find last week's emails from the finance team, read the latest product deck in your file store, check your calendar for Thursday, or create a task in your project tool.

Read or write: the question that decides the risk

A connector can be able to read (look things up) or write (change things). Writing is where mistakes cost more, because it acts in your real systems.

Some everyday examples (made up for this lesson):

You ask	What it needs
"Summarise this week's emails from the finance team."	Read
"Find the latest version of the product deck."	Read
"Draft a reply to the supplier."	Read, then a draft that only you send
"Send the reply."	Write
"Accept Thursday's meeting and move my 3pm."	Write
"Move last year's files into the archive folder."	Write
"Update the deal stage in the customer system."	Write

It works with your access, all of it

The AI can reach only what your own account can reach, and only what the connector allows. That cuts both ways. If you can delete the shared project folder, a connector that can write may be able to as well. So every tool you connect is a decision about what this thing can reach, and every tool you leave out is a door that stays shut. One broad tool, such as a browser or control of the whole computer, opens many doors at once.

Outside words, no power

Files, emails and web pages can carry hidden text that tries to steer the AI. An AI that reads outside content (the web, email from outside, files others sent you) should not also be free to send, pay or delete without asking. Before you let a connector change things without asking, ask three questions:

Can it be undone easily?
Does it leave the team?
Does it read outside content?

If the first answer is no, or either of the others is yes, keep that action on "ask first", set in the tool.

Common mistakes

Connecting everything "just in case". Each connection is a door. Connect what this month's work needs.
Thinking "connected" means "read only". Many connectors can send, edit and delete. Look at the tool list or the permission setting.
Choosing "Always allow" or "Allow all actions" to stop the prompts. The prompt is the brake. "Allow once" is the safe answer for anything that sends.
Letting it read outside email and send freely. Outside words, no power: if it reads mail from strangers, sending waits for your yes.
Connecting a personal account for work. Work data belongs on the work account, under your company's settings.
Adding a custom MCP link because it sounds clever. A custom link may be a doorway run by someone other than the service itself, and nobody has verified it. Ask IT first.
Mixing up a skill and a connector. A skill says how; a connector decides what it can reach.

What to check before you trust it

Open the sources. When the AI answers from your email or files, open the items that matter and check they say what it claims.
Is it the latest? It may pick an older email or file when a newer one exists. Say the date range you want.
Is it complete? A broad search can miss items. For a count or a "list of all", narrow the search and check a sample.
After any change, look where it acted: the Sent folder, the calendar, the file's version history, the record's change log.

Keep it safe

Never type a password, security code or card number into the chat to make a connector work. Sign in through the connector's own sign-in screen.
Connect only what your company approves, and prefer official or verified connectors.
Keep anything that changes things on "ask first", especially on a connection that reads outside content.
Review your list once a month, and disconnect what you no longer use.

Checked against · read 16 Oct 2026Every claim, its source and the date read

As of: product steps as they were on the vendors' own pages on 16 Oct 2026.

Every product line in this lesson comes from Neosaipien's platform reference (checked on the vendors' own pages, 16 Oct 2026).3, 3.4, 3.5 and 4.4. Its sources were each read on 16 Oct 2026. The pages behind this lesson:

Model Context Protocol, What is the Model Context Protocol ("Think of MCP like a USB-C port for AI applications")
Anthropic, Connectors, skills, and plugins (the plugin box; skill or connector)
Anthropic, Get started with connectors (the six steps; Request on Team and Enterprise; per-tool settings)
Anthropic, Use the connectors directory (custom connectors reach services that "haven't been verified by Anthropic"; your own access; custom connector steps)
Anthropic, Use Claude for Excel (hidden instructions in files)
OpenAI, Connected apps in ChatGPT (the five steps; the four permission choices; the right account)
OpenAI, Skills and plugins (apps inside plugins)
OpenAI, Build skills (skill or MCP)
OpenAI, ChatGPT agent (hidden instructions; switch off what a task does not need)
OpenAI, ChatGPT plans (Developer mode on Plus and up)
Google, Connect and manage custom apps for Gemini Apps (custom apps by MCP server; "does not control, monitor, or secure third-party MCP servers")
Google, Use apps connected to Gemini with a work or school account (admin decides)
Google, Gemini Apps release notes (13 Oct 2026: Customize, more than 40 apps)

Where next

Next lesson · level 4 · 20 min

What should an agent be allowed to touch?

Choose the apps, websites and approval setting for an agent in Claude, ChatGPT or Gemini, so anything that reads outside content must ask before it sends, pays or deletes.

Open the next lesson

The kit · free download

The Agent Playbook. Its "set the brakes" cards walk through each assistant's connected apps, read or write, and its approval setting.

Bring this to your team

AI implementation. I can work with your admin to choose the connectors your team needs, keep changes behind an approval, and write down who owns each one.

Book a 20-minute call

Back to level 3, Power features