This lesson is part of Learn MCP, our free course on the Model Context Protocol, within The MCP Guide.
In this lesson you will:
- See which admin controls Claude, Claude Code, VS Code and Cursor document for MCP.
- Choose how tightly to control servers, from a denylist to a fixed approved set.
- Plan a six-step rollout, from a small pilot to a regular review.
One person connecting a server is a personal choice. A team connecting servers is a company decision about data, accounts and risk. This lesson turns the skills from lessons 8 to 10 into a team process.
Key Takeaways
- Decide who can add servers before anyone adds one.
- In Claude Team and Enterprise plans, Owners add custom connectors and members sign in individually.
- Claude Code supports organization-wide allowlists, denylists and fixed server sets.
- Allowlists should match servers by URL or command, not only by name.
- Log which servers and tools people use, and review the list on a schedule.
- Start with a small pilot and a short approved list, then expand.
1. Decide who can add servers
There are two basic models. In the open model, anyone can add any server and IT reviews later. In the controlled model, only admins add servers, and everyone else picks from an approved list.
Most companies should start controlled. Lesson 9 showed how much there is to read before trusting a server. Doing that review once, centrally, is faster and safer than asking every employee to do it.
2. Claude Team and Enterprise
Anthropic's custom connector guide splits the work between Owners and members.
Owners go to "Organization settings > Connectors," click "Add," hover over "Custom," then select "Web." They enter the server URL and authentication settings. Members then go to "Customize > Connectors," find the connector, and click "Connect" to sign in. On Enterprise, the guide says Owners, Primary Owners and people with a custom role that includes Manage access to Libraries can add connectors.
Two details matter for planning:
- Credentials. Members connect individually, so Claude only reaches data each user can access. A connector with a shared credential gives everyone that credential's access.
- Network reach. The server must be reachable over the public internet from Anthropic's IP ranges. Private or VPN-only servers need those ranges allowlisted.
Owners can also disable specific tool calls that render interactive connectors.
3. Claude Code managed MCP
Claude Code is used by developers, so it has the most detailed controls. The managed MCP docs say that by default anyone running Claude Code can connect any server. They also note Anthropic reviews directory connectors against listing criteria but "doesn't security-audit or manage any MCP server."
Admins choose a pattern:
| Pattern | What it does | How |
|---|---|---|
| Disable MCP | Almost no servers load | managed-mcp.json with an empty server map |
| Fixed deployment | Everyone gets the same servers and can't add others | managed-mcp.json with your servers |
| Provided servers | Everyone gets your remote servers and keeps their own | managedMcpServers in managed settings |
| Approved catalog | Users add approved servers; others are blocked | allowedMcpServers + allowManagedMcpServersOnly: true |
| Denylist only | Block known-bad servers, allow the rest | deniedMcpServers |
The managed-mcp.json file lives at a system path, such as /Library/Application Support/ClaudeCode/managed-mcp.json on macOS or /etc/claude-code/managed-mcp.json on Linux. It is usually deployed with device management tools.
Three rules from the docs prevent common mistakes:
- Match by URL or command. A
serverNameentry "is not a security control," because users choose server names. UseserverUrlorserverCommand. - Deny wins. A server that matches any denylist entry is blocked, and nothing overrides it.
- Keep secrets out of shared files. Any user on the machine can read
managed-mcp.json, so don't put API keys in itsenvblocks.
For smaller teams, the Claude Code MCP docs describe a lighter option. Project-scoped servers live in a .mcp.json file at the project root and are shared through version control. Claude Code asks each user to approve them before first use.
4. VS Code and Cursor
The VS Code MCP docs say, "Your organization can restrict which servers are available." The page links to enterprise allowlists but does not describe them, so check with your GitHub Copilot admin.
Cursor's MCP docs let users turn whole servers on or off. Tool-level restrictions are documented as an enterprise feature (tool allowlists). Our page on AI apps that support MCP covers admin controls in other apps.
5. Log and monitor
You cannot manage what you cannot see. The MCP tools specification says clients SHOULD log tool usage for audit purposes.
For Claude Code, the managed MCP docs describe OpenTelemetry export. Setting OTEL_LOG_TOOL_DETAILS=1 includes MCP server and tool names in tool events, so you can see which servers people actually use. For what to record, see MCP audit logging.
Larger companies sometimes route all MCP traffic through a gateway for central logging and access control. Our explainer on MCP gateways covers when that is worth it.
6. A six-step rollout plan
- Pick a pilot. Choose one team, one AI app and one or two official servers for tools you already use.
- Review each server. Use the Lesson 9 worksheet and keep the results.
- Publish an approved list. Include the server, the URL or command, who owns it, and the allowed tools.
- Write the policy. Cover who can add servers, the allow/ask/deny tiers from Lesson 10, and what data is off limits. Our AI and MCP acceptable use policy template is a starting point.
- Enforce and train. Turn on admin controls, then show people how approvals look and when to say no.
- Review on a schedule. Check logs and the approved list quarterly, and re-review servers when they update.
For the wider governance picture, read MCP for IT leaders. If your team uses Claude Code, our Claude Code consulting team can help set up managed settings.
Try it
Draft a one-page approved-server list for a pilot. Use this template:
| Server | Where it runs | URL or command | Owner | Allowed tools | Ask tools | Denied tools | Reviewed |
|---|---|---|---|---|---|---|---|
| Example: GitHub (official) | Remote | https://api.githubcopilot.com/mcp/ | Engineering lead | get, list | create, update | delete | 28 Oct 2026 |
The GitHub URL is the one used in the managed MCP docs example. Fill in two more rows for servers your team wants. If you use Claude Code, turn each row into an allowedMcpServers entry with serverUrl or serverCommand.
Recap
Rolling MCP out to a team starts with deciding who can add servers. Claude Team and Enterprise let Owners add connectors while members sign in as themselves. Claude Code offers fixed sets, allowlists and denylists, matched by URL or command. Log tool use, start with a small pilot, and review on a schedule. Lesson 12 compares remote and local servers in practice.
Course navigation
Previous lesson: Lesson 10: Permissions and Approvals.
Next lesson: Lesson 12: Remote vs Local Servers in Practice.
Back to the Learn MCP course outline.
Frequently asked questions
Can members of a Claude Team plan add their own custom connectors?
According to Anthropic's guide, only Owners and Primary Owners can add connectors on Team plans. Members find the connector in "Customize > Connectors" and click "Connect" to sign in.
Should we use one shared account for a connector?
Usually not. Anthropic's guide notes that a shared-credential connector gives everyone the credential's access. Individual sign-in keeps each person limited to their own permissions and makes logs clearer.
Is blocking servers by name enough in Claude Code?
No. Claude Code's docs say a serverName entry is not a security control, because a user can give any server any name. Use serverUrl for remote servers and serverCommand for local ones.
How often should we review our approved server list?
Pick a fixed schedule, such as quarterly, and also review a server whenever it updates. Servers can add or change tools without notice, so a list that was safe in spring may not be safe in fall.
Do we need an MCP gateway?
Not to start. Built-in admin controls cover many small teams. A gateway helps when you need central logging, many servers or many AI apps. See our MCP readiness audit if you want help deciding.
