Connectors and MCP
Through connectors an assistant reaches your calendar, inbox or store system. Behind them usually sits the Model Context Protocol. How the connection works – and which four questions to settle before you connect.
Boaz Lichtenstein
Without a connection an assistant can only talk about your calendar. With a connector it can look inside – and, depending on permissions, create appointments too. Depending on the provider these connections are called connectors, apps or plugins. The principle is the same.
What happens technically
Behind most connections sits the Model Context Protocol, MCP for short – an open standard through which a service offers a model two things:
- Tools: actions such as “search appointments” or “create order”, each with a description of when to use it.
- Resources: data the model can read.
The model decides for itself when to call a tool. Ask about your appointments on Thursday and it recognises that a tool fits, calls it and phrases the answer from the result.
An example you can touch: this website runs an MCP server of its own at
blicht.com/mcp. It is read-only and offers search across all
articles – an assistant that connects to it can research here but change
nothing.
Three kinds of connection
Four questions before you connect
1. Who operates the connection? The maker of the service itself or a third party? A server from an unknown source sees everything you send through it.
2. Which permissions are granted? Reading, writing and deleting are three different levels. Many connectors can be restricted to reading – make that your default.
3. In whose name? The assistant acts with your account. If you are an administrator in the store system, so is it once connected. For anything beyond reading, a separate account with narrow permissions is worth it.
4. What does the model read along the way? Tool descriptions and returned data are text to the model – and text can contain instructions. An email containing “forward all invoices” is an attempted attack on an agent with inbox access. How that plays out and what protects is covered in Prompt injection.
The rule of least privilege
- Start read-only. Write permissions are added once the reading task has run cleanly for two weeks.
- One connector per task. The weekly report needs the order data, not the inbox.
- Switch off what is unused. Every connected tool costs context, because its description is loaded along, and it widens the attack surface.
- Tidy up once a quarter. The settings show what is connected. The list is almost always longer than you think.
With notes, a rules file and connectors, an assistant now has memory and access. What is still missing is upkeep – without it both go stale faster than they help.