On November 10, 2026, Anthropic expanded Claude's interactive connectors to open supported apps beside the conversation or full screen. Claude can work in those apps through new app tools; developers can also embed their websites. Organizations that already allow all of a connector's tools receive its new features as they roll out.
A person can now reach the same document by asking Claude to edit it, clicking an app action, or typing in an embedded editor. An approval prompt on the Claude-requested edit leaves the other paths to review.
Follow the operation through to the service that stores the change. The reviewer needs the initiating user, executing identity, and permission for that destination. The checks below are recommendations based on the documentation; General Analysis has not tested these integrations.
Establish which capabilities the pilot actually has#
The announcement describes developer support as public preview. The getting-started reference adds requirements: app tools and embedded websites need a remote connector; directory-installed embedded sites require a Verified listing. A Community installation does not receive that capability even if it worked through a custom connector during development.
Record the connector URL, installation route, organization, client, and visible capabilities. App tools reach only a limited set of organizations, so a missing action may indicate rollout status rather than a successful restriction. Use the Chat/Cowork migration review for the surrounding account settings.
Choose one harmless operation for the pilot, such as editing a sample document that belongs to a test team. Define which account may edit it and whether that change requires fresh human approval. Keep unrelated documents outside the pilot account's access.
See how your AI systems hold up under real attacks
General Analysis maps AI applications and agents, red teams prompts, retrieval, tools, MCP servers, browser actions, permissions, and business workflows, then turns findings into evidence your team can reproduce and retest.
Map the action before judging its approval#
Anthropic's app-tools reference distinguishes two directions. Claude can call a tool registered in a loaded app view. That call asks for approval unless a saved choice or the conversation setting already applies. When the view calls its own server with app.callServerTool, the user does not see that prompt.
The absence of that prompt does not establish an authorization failure. The MCP tools specification requires server input validation and access controls. The application must decide whether the authenticated caller may perform the requested operation on the target resource.
Use this review map for the sample document. Its evidence requirements are our recommendations.
| Action path | Approval boundary to inspect | Evidence to retain |
|---|---|---|
| Claude asks the loaded view to edit | App-tool prompt, saved choice, and conversation mode | Requested document, arguments, decision, and resulting revision |
| The view calls its server | Server authorization; no app-tool prompt on this call | Caller identity, target document, policy decision, and operation ID |
| A person edits inside the embedded site | The site's authenticated session and write policy | Site identity, document permissions, and change record |
A single user gesture can trigger several backend requests. Review the resulting effects together: editing a document and sharing it externally are separate permissions even if the interface presents them as one workflow. For the wider dependency review, use the MCP server security guide.
Keep view access separate from write access#
Team and Enterprise owners can disable the tool calls that render interactive views without disabling the connector's text-based tools. To stop edits, check the remaining write tools too. Hiding the editor leaves that work unfinished.
Anthropic's connector controls support Always allow, Needs approval, and Blocked choices. Organization restrictions narrow source-system permissions; they do not grant permissions the person lacks at the source. Check shared credentials separately: their access may exceed an individual user's permissions.
For the pilot, ask the connector owner to name the server operation behind each write-capable button or app tool. Identify where that operation checks the caller, tenant, document, and approval requirement. Keep a write disabled if the owner cannot explain that path.
Review the embedded site's session and origins#
An embedded editor has another authentication boundary. Anthropic's embedded-site documentation says Claude passes no session to the site; developers cannot rely on a login in another tab. Its documented sign-in flow uses a short-lived, single-use token exchanged for a site session.
Check which site account receives that session. In the sample workflow, an editor signed into a broader service account would defeat the intended narrow pilot even if the Claude account was restricted.
Review framing in both directions. The same reference requires permitted embedded origins and, where the site restricts framing, frame-ancestors entries for https://claude.ai and the connector's exact sandbox host. A wildcard over *.claudemcpcontent.com would let other connectors frame the site. Read the host-reported frameDomains after connection; the resource's declaration alone does not establish the effective set.
An allowed origin can host an editor whose account has excessive access. Check the site's write permissions before adding real documents.
Run the acceptance checks against destination evidence#
Use authorized test accounts and sample content. These are proposed checks, not results from an experiment:
- Allow the intended edit and confirm the destination revision and executing identity. Compare a Claude-requested edit with the equivalent UI action.
- Decline a fresh app-tool approval. Confirm the requested edit did not occur; separate any manual edits made during the same interval.
- Remove the test identity's write permission in the destination service. Attempt the same harmless operation through every available path. Retain the denial and unchanged document state.
- Disable the render tool while leaving the intended read-only connector tools available. Confirm that the remaining tools cannot perform the prohibited edit.
- Repeat the relevant case after changing the connector version, installation route, or approval settings. Keep the earlier evidence so the reviewer can see what changed.
For your own integration, log enough to correlate a request with the destination operation without storing tokens or document contents. This illustrative record is an internal review format, not a Claude API payload.
Code source: illustrative.
{
"case_id": "sample-document-write-denied",
"path": "view-to-server",
"connector_url": "https://connector.example.com/mcp",
"installation": "custom",
"source_identity": "pilot-reader",
"target": "sample-document-01",
"expected_effect": "no revision created",
"observed_effect": "unverified",
"authorization_evidence": null,
"destination_operation_id": null,
"reviewed_at": null
}
Also reconcile uncertain outcomes before retrying. Anthropic documents a 45-second app-tool response limit, excluding approval time. A timeout can mean the action happened without a response. Check the destination operation or revision before issuing another write.
Keep the destination evidence alongside the Claude compliance records your organization can retrieve. A conversation transcript alone cannot establish what happened to the sample document. If a denied edit creates a revision, stop that write path and investigate the executing identity and policy decision before expanding the pilot.
Frequently asked questions
- Does every action in a Claude MCP App show an approval prompt?
No. Claude's app-tool approval can be satisfied by a saved choice or conversation setting. The developer documentation also says a view's app.callServerTool call does not show that prompt. Review server authorization and destination permissions separately.
- Does disabling an interactive view revoke the connector?
No. Team and Enterprise owners can disable tools that render interactive views while text-based connector tools continue working. Review the remaining tools and source-service access before treating a connector as disabled.
