AI Agents Integration: The Guide, With or Without Code (2026)

What an integration lets an agent do

An agent with no integration can only talk. Connected to your software, it fetches what it needs, prepares the work and waits for your decision on what matters. Two examples show what that looks like:

• It handles your inbox and your calendar. Taylor Moss co-owns a digital media agency. In a June 2026 video, he connects Gmail and Google Calendar to Claude and asks it to rank his unread emails, then to draft replies he approves before they go out. He then asks for a two-hour slot the next day that clashes with nothing, and Claude books it.
• It keeps your data up to date. Brock Mesarich runs an influencer marketing agency and the YouTube channel AI for Non Techies. Every morning at 7, a scheduled task in Claude collects the view counts of his videos and stores them in Supabase, an online database, through the Supabase connector. A dashboard inside Claude reads that database, so he sees current numbers (June 2026).

An AI model on its own only produces text. To look up an order or send a reply, it needs tools. A tool is one named action, such as "find an order" or "send an email", with a short description the model reads.

The model never touches your app. When a tool would help, it writes a request, and another program makes the real call. That program holds the key to the app, and the model never sees that key. Developers call this tool calling.

So an integration comes down to a list of tools and the credential behind them: the key or the sign-in that proves the agent may act. Tools fall into three kinds, and what can go wrong differs:

Most of what connected agents do is read. David Soria Parra co-created MCP at Anthropic, the company behind Claude. In December 2025 he said people use MCP mostly "for context", meaning to fetch information. Changes are rarer, and they are where the stakes sit.

Two cases don't need an agent connected to your apps:

• A job with fixed steps needs no agent. When every new payment must add the same row to a spreadsheet, a workflow platform such as Zapier or n8n does it more cheaply and more predictably. A workflow platform is a service that runs fixed steps between apps, so no AI has to make a choice. This three-question test of what "agentic" means helps you tell such a job from one that needs an agent.
• A job you run now and then may need only a file. Aaron Young teaches Google Ads at Define Digital Academy. In an April 2026 video, he says he knows Claude can connect to Google Ads and that he chose not to. He downloads reports, uploads them to Claude, reads its analysis and makes the changes himself: "I don't want an AI tool inside of my Google Ads account making changes every single day."

Before you pick a route, write the job as a short list of actions, each marked reading, a change you can undo, or a change you can't undo.

Which route to take

With your list of actions in hand, two questions pick the route: where the agent has to work, and whose accounts it uses. Find your situation in this table, with what you do and what it cost on 4 November 2026:

Without code: connectors in Claude and ChatGPT

For your own email, calendar or CRM (your customer database), a connector does the whole job. You turn it on, sign in at the app, and the assistant can search and act there within the rights your account already has. Here is what each assistant offered on 4 November 2026.

Claude has connectors on every plan. You add them once under Customize, then Connectors, from a directory of apps, and switch them on per conversation in the + menu. Gmail, Google Calendar, Google Drive and Microsoft 365 are there, along with services such as Slack. For Google:

• Claude works in your Gmail. It can search and read mail, draft, send, reply and forward. By default it asks for your approval before each send, reply or forward. It sees an attachment's name and details, and can't read what's inside.
• It works in your Google Calendar. It can read events, find a time that suits every attendee, answer invitations, and create, change or delete events.
• It works in your Google Drive. It can search, read and upload files. It reads a document's text only, so images inside documents aren't processed.
• It edits Google Docs and Sheets. Separate connectors let it create these files and edit them live, beside the chat.

Each connector has a setting called Tool permissions, with three choices per kind of action: "Always allow", "Needs approval" or "Blocked". Start with reading on "Always allow" and everything else on "Needs approval".

For an app missing from the directory, you can add a custom connector by pasting the address of its MCP server. The free plan allows one. On Team and Enterprise plans, an owner enables each connector first and can limit an action for everyone, such as reading mail but never sending.

Files are the weak spot. Text passes through a connector easily. In my experience, images and documents are harder as soon as something has to be downloaded. Each revision of MCP helps, but they remain the awkward part.

ChatGPT calls its connectors apps. You find them under Settings, then Plugins, OpenAI's current name for that menu. Which ones you see depends on your plan, your region and your workspace.

Each has a permission setting. Start with "Allow read actions", so it reads freely and asks before the rest. Avoid "Allow all actions", which runs supported actions without another confirmation.

ChatGPT's Work mode, for longer tasks, can also start a task by itself when a new Gmail message or a new Slack channel message arrives. An email can then set off work without you opening a chat.

A custom connector is more restricted in ChatGPT. OpenAI's help page reserves full access to Business, Enterprise and Edu workspaces, on the web, and limits Pro users to reading. You also tick a risk warning for each server. In my experience as of November 2026, adding a custom connector is smoother in Claude: ChatGPT keeps asking "Are you sure?"

Your account's rights still apply, on both assistants. Claude's help page says it "inherits each person's permissions from the connected service", and HubSpot, a CRM, writes: "All actions respect your existing HubSpot user permissions." So in an app with roles, connect a limited user. A HubSpot user who can view deals, meaning sales in progress, but not delete contacts holds the agent to that, whatever it's asked. Gmail and Calendar have no such roles, so Tool permissions is your limit there.

If you pay for Google Workspace, Google's paid plan for companies, its administrator decides which apps may connect. That may be you. In the Admin console, look for Manage third-party app access, under Security, then Access and data control, then API controls. If Claude's Google connectors show "Access blocked", this is where an admin marks Claude as trusted.

Four settings make a connector safe enough for daily use:

People do relax these settings. Brock Mesarich sets his image, lead-finding and database connectors to "Always allow", because being asked each time is, he says, "a bit annoying". That's a reasonable trade for a connector that makes images, since a bad image costs one more try. It's a bigger bet on a database, where a wrong change can be hard to reverse, and on anything that sends.

A first request can prove the connection before you trust it with more. This one is close to what Moe Lueker, who makes videos on AI, showed in a July 2026 video, with the replies kept in the chat. If you start with Gmail, paste it into Claude:

Go through my five most recent emails. Sort each one into lead, support,
personal or other, and write your suggested reply here in the chat.
Create nothing in Gmail and send nothing.

Use an inbox that doesn't receive login codes or password resets if you have one, because a hidden instruction in an email could ask for them.

Without code: Zapier, Make and n8n for the rest

Connectors stop where an app has none, or where it offers few actions. A workflow platform fills both gaps, and it can run a job when nobody is chatting.

Zapier MCP adds Zapier's apps to your assistant. Zapier is a service that links more than 9,000 apps (4 November 2026). Zapier MCP lets Claude, ChatGPT or Cursor, a code editor with an AI agent, use them through one connection. Where you add it depends on your assistant:

• Claude lists it in its directory. It's there on every plan, free included, so it doesn't use your one custom connector. Search for Zapier, connect and sign in.
• ChatGPT takes it as a custom connector. On Plus or Pro, Zapier's guide has you add it under Plugins, at the address it gives. OpenAI's help page limits Pro to reading, so test a change before you rely on it. On Business, Enterprise or Edu, your admin adds it.

It covers what connectors leave out. Emily Kramer, who advises B2B startups on marketing at MKT1, explained her use in an August 2026 showcase. She goes through Zapier MCP for Google "with way more actions" than the native connector. She also uses it for "a tool that doesn't have an MCP like QuickBooks", the accounting software her accountants make her use.

Decide who picks the actions. On 4 November 2026, a new Zapier server starts in "agentic" mode, where your agent finds and turns on actions by itself as your requests come up. To set the list yourself, switch the server to "managed" mode at mcp.zapier.com. There you tick each action, and your agent can't add any.

Each action is then its own tool in Claude, so Tool permissions can hold sending for approval and let the rest run. Two video makers show the ticking. Both videos are sponsored by Zapier, and both say they ran these setups before the sponsorship:

• Julia McCoy limits Slack to three actions. She runs First Movers, an AI training and consulting company. She wanted Claude to check whether each person booking a sales call fits her target customers, and post a summary in Slack. She ticked three Slack actions (send a channel message, send a direct message, find a user) rather than her whole Slack: "three, not 300" (May 2026).
• Moe Lueker leaves out delete and archive. From Gmail he ticks 10 actions, including drafts and sending. He skips archiving and deleting, because he doesn't want his agent to do either by accident (July 2026).

One action through Zapier MCP uses two tasks, the unit Zapier bills by. Zapier's free plan includes 100 tasks a month, which makes about 50 actions (4 November 2026). Above that, Lueker quotes about $49 a month for 2,000 tasks and $129 for 10,000 (July 2026).

Jobs that run alone need a trigger. A trigger is an event, such as a new email or a filled form, and a workflow is the fixed steps that follow it. Three platforms can add an agent to a workflow, for the steps where judgment is needed:

• Zapier Agents work across 9,000+ apps. You give them your company's knowledge, and they work on request or while you're away.
• Make offers AI Agents across 3,000+ apps. It's a workflow platform like Zapier. On 6 October 2026, its free plan included up to 1,000 credits a month, the unit it bills by.
• n8n mixes fixed steps with an agent. Both sit on one screen, and it bills by workflow run: its Starter plan costs €20 a month, billed yearly, for 2,500 runs (4 November 2026).

A scheduled task can be enough, with no platform at all: Claude's desktop app runs a request at a set time, as with Mesarich's 7 a.m. task. For one job that keeps coming back, you don't need an always-on assistant. Once you have several agents to run, an agentic OS, the layer of files and settings around your agents, keeps their schedules and permissions together.

In an app you build with Lovable, Replit or Base44

If you build your product with an app builder, you describe what you want and it writes the app. That builder has connectors of its own. The question there is whose account each one uses, and Lovable's documentation (as of 4 November 2026) sets out the three cases under its own names:

• One shared account runs the whole app. Lovable calls this an "app + chat" connection. It works in the builder's chat and in your published app, and everyone using the app shares that account. It suits your own Slack receiving alerts from your app.
• Your own account helps you build. A "chat" connection lets Lovable read your Notion docs or your project tickets while it works. It stays personal to you and isn't part of the published app.
• Each user signs in with their own account. With an "app user" connection, your app acts in that person's own tool, with that person's rights. It's the no-code answer when each customer links their own account, for the connectors that offer it.

For a service outside its catalog, describe it in a prompt and Lovable writes the integration. You can also add a custom MCP server, on all plans. These connections stay behind if you leave: Lovable doesn't export them, so each one is rebuilt elsewhere.

The other two builders cover similar ground, with their own limits:

• Replit lists more than 450 connectors. Its agent can also use any service that has an MCP server. Connecting is free, and credits are spent only when the agent generates or changes code. Replit and Lovable differ on what each plan includes.
• Base44 has connectors inside an app. Separately, you can give its chat access to outside tools while you build. Its connectors need the Builder plan or higher, one of the differences between Base44 and Lovable.

When a connection breaks, paste the error into the builder's chat, as you would for any bug. Luuk Alleman teaches building with Lovable. In a November 2025 video, he gave a Lovable chatbot access to his Google Calendar through Pipedream, a service hosting ready-made MCP servers.

His first test failed with an error, so he opened Lovable's logs, copied the error into the chat and asked for a fix. After a few rounds, the chatbot read that day's events and added one. His verdict: "it takes some debugging, but it is worth it."

The connection can also run the other way, so that your customers' agents can use your product. Lovable and Base44 can both publish your app as an MCP server, and Claude or ChatGPT can then use its data and actions. The services I use daily to build, such as Supabase, the hosting service Vercel and PostHog, a product analytics brand this site backs, are all connected by MCP. I can't see myself using an app without MCP today.

With code: the three ways to connect your own agent

Your own agent is a program that calls an AI model, follows your instructions and uses tools, with no chat window needed. You want one when Claude plus a connector stops being enough: the agent has to answer your customers, live inside your product, or react to events of its own.

You don't write it yourself. A coding agent does: an AI you instruct in plain sentences, which writes the code and runs it. Claude Code is one, and it needs a paid plan, from $20 a month on 3 November 2026. You judge the result by testing what your agent does. Start with a request like this:

Build me a small AI agent that [does this job] when [this happens].
Explain in plain words what you're building, which accounts and keys
you need from me, and where it will run. Start on my computer.

Your agent runs on your computer while you test it. To keep it running with your computer off, it moves to a rented server, and self-hosted AI agents compares the places.

Your agent then has to reach each app. Every route ends in an API call, and an API is how an app lets other programs read and change its data. The three ways differ in who writes the tool and who holds the key:

What you ask your coding agent differs for each way. Change the names and paste:

• Ask for a tool like this. "Write a tool for my agent that reads a customer's plan in Stripe. It only reads. Keep the key in an environment variable, and show me a test running." An environment variable is a setting kept outside your code, so the key stays out of your files.
• Ask for a vendor's server like this. "Connect my agent to Stripe's official MCP server at https://mcp.stripe.com, and give it only the tools that read data." Always give the exact address, because agents left to choose can pick an abandoned server.
• Ask for a platform like this. "Use Composio, the integration platform, so each of my customers can connect their own Gmail. Request read access only."

The kit your coding agent builds on, called a framework, doesn't settle this choice. Whether it uses Google's Agent Development Kit, Mastra or the Claude Agent SDK, Anthropic's kit for building agents, your agent still connects in these three ways. I use the Claude Agent SDK, for agents that process emails among other things, and I find it well made and practical.

Other routes exist for special cases:

A unified API covers a whole category of apps. It gives one data format for, say, every CRM, so one agent reads any customer's CRM the same way. Merge, which sells both, gives a rule of thumb in its guide: an agent that follows the same process each time suits a unified API, and an agent whose steps vary suits MCP.

Anish, a director of product at Merge, adds a second test in an April 2026 talk. To do something now, the agent calls the app live. To answer a question across hundreds of records, it needs data copied in advance, because live calls won't bring back every record: "MCP on an analysis task means incomplete context."

A command-line program can replace a server for a coding agent. That's a program run by typing commands, which your coding agent types for you. GitHub has one called gh. Armin Ronacher, a developer known for the Flask toolkit, argued in July 2025 that it uses far fewer tokens, the word pieces models read and bill by, than GitHub's MCP server.

Mario Zechner, a developer who created the libGDX game toolkit, compared the two over 120 test runs in August 2025 and found them roughly even: "The protocol is just plumbing." In other words, how well the tools are made matters more than the route.

David Soria Parra expects the agents of 2026 to mix files of instructions, MCP servers and command-line programs, each for its job. Ben, who runs the YouTube channel Ben AI and sells a course on Claude, made that mix in May 2026. He used Google's command-line program for two reasons: it spends fewer tokens, and Claude's Gmail connector could only read mail in his setup. Anthropic's help page now lists sending, so check what a connector does today before you work around it.

Two routes remain for an app with no API. With browser control, your agent clicks through the app's web pages like a person, through a server such as the one from Playwright. Supergood, a service, watches a person do the task once and builds an API from the requests the app's pages send. Both take more upkeep than an app's own API.

Whose accounts your own agent uses

Whichever way you pick, the second question, whose accounts, decides most of the work. On your own accounts, a limited key is often enough. On your customers' accounts, each of them has to sign in and approve.

Your own accounts take a key limited to what the agent needs. Stripe's restricted keys, for example, let you choose None, Read or Write for each type of data. Stripe recommends them over full-access keys, "especially when giving a key to an AI agent".

Stripe goes further with agent keys, which are restricted keys tagged as belonging to an agent. With one, a person you choose approves sensitive actions before they take effect.

There is a date to know. From December 2026, Stripe's MCP server stops accepting full-access keys and restricted keys without that tag. The deadline to switch to an agent key or a sign-in is 30 November 2026.

Gmail and Google Calendar have no such key. Even for your own company, a custom agent signs in through OAuth, the standard behind "Allow this app to access your account?" screens. That takes an OAuth app: not software, but an entry you create in Google Cloud that names your product on the sign-in screen. Ask your coding agent to walk you through it, one click at a time:

• On Google Workspace, choose Internal. Set the entry's user type to Internal. For apps used only inside your organization, Google's guide says these permissions need no "further review by Google".
• On a personal Gmail, stay in testing. Choose External, leave the status on Testing and add yourself as a test user. Google exempts personal use from verification, and you click through an "unverified app" screen.

Scopes are the permissions an OAuth app asks for. Tell your coding agent which action you need, and it requests the matching name:

HubSpot's MCP server works differently. You create an "MCP connector" entry in your HubSpot account, under Development, then MCP Connectors. HubSpot then shows an ID and a secret to hand to your coding agent. What the agent may do depends on the HubSpot user who signs in.

Your customers' accounts need OAuth too. The customer signs in at the service itself and approves a list of scopes. Your product then receives an access token, a temporary key valid for those scopes only, and usually a second token to renew it. The customer can revoke both later without changing a password.

Aaron Parecki of the identity company Okta, a co-author of the OAuth 2.1 draft standard, compares an access token to a hotel key card: it opens some doors and says nothing about who you are.

OAuth costs work. You create an OAuth app at each provider, store every customer's access tokens safely, renew and revoke them, and sometimes pass the provider's review. That review can be heavy, as Google's rules show:

• Reading, drafting or changing mail brings a yearly assessment. Google classes these permissions as restricted. A public product that stores or sends that data through its servers must pass a security check by a Google-approved firm every year.
• Sending only is lighter. Google classes it as sensitive, which needs verification and no yearly check.
• Some uses are exempt. Personal use, apps in testing and internal apps of a Workspace organization skip the verification and the assessment.

Narrow permissions cut that work. An agent that only sends confirmations needs permission to send, with no access to the inbox. An agent that needs an email address of its own can use an inbox created for it, and AgentMail, a brand this site backs, provides them.

How MCP works, and what changed in July 2026

Most of these routes rest on one standard, so it helps to know what it does. MCP, the Model Context Protocol, lets any AI app (Claude, ChatGPT, Cursor or your own agent) use any service that publishes an MCP server. Nobody has to build a custom link for each pair.

Anthropic released it as an open standard on 25 November 2024. In December 2025 it gave MCP to the Agentic AI Foundation, a new body run by the Linux Foundation, a non-profit. By April 2026, the code libraries developers use to add MCP were downloaded 110 million times a month, by Soria Parra's count.

A server runs on your computer or at a web address. One on your computer takes more setup. A July 2026 tutorial from Rank Math, a WordPress SEO plugin, connects Claude to Google Analytics this way. It takes the terminal (the window where you type commands), the programming language Python, and two services to enable in Google Cloud.

In return, Claude reads your Analytics and Search Console data together, to find pages to refresh and pages that lose readers. "Most people will find this confusing," the tutorial admits about the Google Cloud part. If you're stuck on such a setup, ask your coding agent to run the steps.

A server at a web address uses a sign-in. You need this sequence because one of its steps decides whether your agent gets in at all. Claude runs it for you in a connector, and your coding agent writes it into your own agent:

1. The first call is refused. Your agent calls the server with no access token. The server refuses, and gives the address of a small file describing itself.
2. The file names who runs the sign-in. That's often the vendor's own login system.
3. Your agent introduces itself to that login system. It has three ways. It uses an ID registered beforehand. It gives the web address of a file describing it. Or it registers on the spot.
4. You sign in and approve in a browser. The login system replies with a code your agent swaps for an access token. A one-time secret makes that reply useless to anyone who intercepts it.
5. The access token works on that server only. The server must check that the token was issued for it, and must never pass the token on to another service.

The current version of the standard, dated 28 July 2026, changed two things that older tutorials still describe. If you point a coding agent at a tutorial, add: "Use the MCP specification dated 28 July 2026."

• Agents no longer open with a round of messages. Before July 2026, an agent and a server first exchanged messages to agree on what each could do, a step called the handshake. Now each request carries that information itself.
• Registering on the spot is being phased out. The preferred way is now the web address of a file describing the agent, which developers call CIMD. Paul Carleton, who maintains MCP at Anthropic, gave the reason in October 2025. AI apps registered so many throwaway entries that providers' databases filled up. Clearing them broke later sign-ins, and users saw ten copies of one app in their connections.

There was a security reason too. Max Gerber, an engineer at the identity company Stytch, explained in November 2025 that an agent registering on the spot can claim any name, so malicious software could pose as a known AI app. A web address on the app's own domain can't be faked by another web app. Apps running on a computer can still be imitated.

To set up a server inside OpenClaw, an open-source agent people message from apps such as WhatsApp or Slack, OpenClaw MCP covers adding it, filtering its tools and choosing an approval mode.

Which agents 35 vendor-run MCP servers let in (tested 27 October 2026)

Whether your own agent can connect depends on one step of that sign-in: how it introduces itself. On 27 October 2026, the servers of 35 vendors, from Stripe and Notion to Slack and Google BigQuery, were each asked, without an account, which ways they accept. All 35 offer an OAuth sign-in, though Stripe's also takes an agent key. They differ on that step:

Several servers accept both of the first two ways, so those rows overlap. Prior registration explains a common surprise: a connector works in Claude and fails in your own agent. Claude is registered with that vendor, and your agent isn't.

Two more results affect what you ask for:

• Servers rarely say which permissions they need. Only 7 of the 35 name them in their first reply. Those that publish a list can ask for a lot: Slack's has 30, including access to private channels and direct messages, and Shopify's has 36. Ask for what your list of actions needs, as MCP's security guide advises.
• One server skips the starting file. Atlassian, which makes Jira, returned a bare refusal without the small file that starts the sign-in. If your agent fails on Atlassian, tell your coding agent that its server sends no starting file.

Vendors' own servers all use a sign-in, and many servers people install from GitHub or npm, a public library of code, don't. Astrix Security, a company that secures the keys software uses, reviewed about 5,200 open-source MCP servers in 2025 with an AI-assisted analysis. It found that 53% rely on long-lived keys and 8.5% use OAuth. A key in a settings file usually never expires and opens the whole account.

Your coding agent can also make the wrong choice for you. Glow Labs, the research team of a security company, reviewed real coding sessions in which an abandoned MCP server was installed or suggested. Help Net Security, a security news site, reported it on 3 November 2026. In 98% of those sessions, the agent filled in the server's name from what its AI model learned in training.

In Glow's GitHub example, the agent passed over GitHub's own server for an old one that will never get a security update. Glow found four serious flaws in such servers, and no exploitation so far. So name the vendor's server and its address in your request, rather than asking for "a GitHub MCP".

Integration platforms compared, with prices

When each of your customers links their own accounts, an integration platform saves you most of that OAuth work. It sits between your agent and your customers' apps, runs each sign-in, stores and renews the access tokens, and offers ready-made tools. Each bills a different unit, so the cheapest depends on how your agent is used. A tool call, in these prices, is one use of one tool by your agent. Prices come from each vendor's own page, as of 4 November 2026:

Lists of these platforms usually come from companies that sell one. Mastra's list and Merge's both name Composio, Arcade, Zapier, Merge and Workato, and Mastra's adds Ampersand and Apideck.

The units differ enough to change the answer. Take 200 customers whose agents make 500 tool calls each a month, so 100,000 calls, each under a second. At list prices, before any volume discount:

At ten times the calls, the order changes. Composio comes to about $270 (900,000 extra calls at $0.0003), and Nango to about $258 ($58 + 278 hours at $0.72). So run your own numbers before you choose.

Whose OAuth app the customer sees at sign-in also decides who goes through the provider's review. Zapier MCP and Composio's shared apps use the platform's own OAuth apps, so Google's review applies to the platform. Once you create your own, as Composio's documentation tells you to for a live product, the review is yours.

Every platform also keeps the access to the accounts your customers connect, so a breach there reaches them too. Paragon's guide calls this the "blast radius", meaning how far one breach spreads. Before you sign, ask any vendor whether your connections and credentials can be exported if you leave.

Every tool you connect adds to what the agent reads first

Once your agent is connected, more tools aren't always better. A model reads the description of every connected tool before it reads your request. Those descriptions are counted in tokens, the word pieces models read and bill by, which have nothing to do with access tokens. An AI token calculator shows the count for any text. On 27 October 2026, the tool lists of common MCP servers were downloaded and weighed:

The count covers each tool's name, description and inputs, with OpenAI's o200k tokenizer, a program that counts tokens. Claude's counts slightly differently. Servers behind a sign-in, such as Gmail's or HubSpot's, couldn't be weighed without an account.

Connect GitHub, Sentry, Supabase and Playwright, an ordinary set for someone building a product. Your agent then starts every conversation with 109 tools and about 24,770 tokens of descriptions (11,130 + 5,490 + 4,400 + 3,750). Anthropic measured the same effect on its own setup in November 2025: 58 tools from five servers took about 55,000 tokens.

With your own agent, you pay for those tokens on every request. Accuracy suffers too. "The most common failures are wrong tool selection and incorrect parameters, especially when tools have similar names," Anthropic wrote.

Two habits make a server work badly:

• It offers a tool for everything the API can do. Notion describes its old local server as "basic API-derived tools", meaning tools copied one by one from its API. That server averages about 710 tokens per tool, against about 150 for Supabase's. "Tools are not API endpoints," Michael Grinich, founder of the identity company WorkOS, said in December 2025. An endpoint is one address in an API, and a good tool does one job.
• Its tools look like those of another server. MCP's co-creators said in April 2025 that a GitLab server and a GitHub server connected together look so alike that the model confuses them more easily.

How many is too many? MCP's co-creators called "hundreds" of tools a fairly safe bet for Claude in April 2025, meaning the model can still cope. Anthropic's later tests show it copes better, and more cheaply, when tools load only as needed. It recommends loading them that way beyond about ten tools or 10,000 tokens of descriptions.

Three things help. The first needs no code, and the other two apply to an agent you build:

• Switch off what the job doesn't use. GitHub's server grows from 46 to 91 tools with everything on. In Claude, switch a connector off for a conversation in the + menu, or set a tool to "Blocked" in Tool permissions. In Zapier's managed mode, tick fewer actions.
• Load tools only as needed. Anthropic's Tool Search Tool gives the model one search tool, which fetches three to five tools when the task needs them. That took about 8,700 tokens instead of 77,000 in Anthropic's test, and accuracy rose from 49% to 74% with Claude Opus 4 (November 2025). Ask your coding agent: "Load my agent's tools only as needed."
• Let the model write code. Your agent treats each server as a set of code files, opens only those it needs, and calls the tools from a short program in a sealed space. In Anthropic's example, moving a meeting transcript from Google Drive to Salesforce, that cut the task from 150,000 tokens to 2,000.

Keeping a connected agent safe: the rule of two

Everything so far gives your agent more reach, so the last decision is how far you let it go alone. These seven cases show what can happen: each came through a channel the user trusted.

Five of the seven are prompt injections. In these attacks, instructions hidden in content the model reads take over its behavior. The other two are a malicious package and a flaw in code, reached through the same habit of plugging in servers.

The draft case changes what approval can do. The researchers sent an email with hidden instructions to an inbox connected to Claude Cowork, and set off a Slack login code to the same inbox. The user asked Cowork to process the emails.

The hidden instructions made it copy the code into a draft, formatted so that Gmail would request something from an outside address. Viewing the draft sent that request, and the code leaked. They report no malicious use, and this route still worked when they published on 6 August 2026.

So approval on sending controls what your agent sends. It can't protect whatever your agent can read and put in a draft. Keep login codes out of the inbox it reads: a mailbox for customer mail, with no login codes or password resets, is a safer first connection than your main one. On your main inbox, keep replies in the chat, with nothing created in Gmail.

Simon Willison, a developer who co-created the Django toolkit, has collected dozens of these attacks on his blog. In June 2025 he named the pattern behind the injections the lethal trifecta: access to private data, exposure to untrusted content, and a way to communicate outside.

An agent with all three can be talked into sending your data to an attacker, because, in his words, "LLMs are unable to reliably distinguish the importance of instructions based on where they came from." An LLM, a large language model, is the AI model itself.

Meta's security team turned that into a design rule in October 2025, the Agents Rule of Two. In one session, meaning one run of the agent with its access, an agent may do at most two of these three things:

• Process text from untrusted sources.
• Reach sensitive systems or private data.
• Change things or communicate outside.

If a task needs all three, the agent shouldn't run on its own. Either a person approves, or the work is split: one session reads the emails, and a separate one with no way to send acts on a summary.

In practice, give an agent at most two of three: text from strangers, your private data, and any channel to send things out. An assistant connected to your own Gmail has all three from the start. Anyone can email you, the inbox is private, and the connector can send. That's why the approval on sending matters most. My own choice, not a rule for you: neither my calendar nor my personal mail is connected to Claude or ChatGPT. My CRM, a homemade Supabase database, is.

Applied to an integration, the rule gives a short checklist:

• Fill in three lists for the whole agent. List the untrusted text it reads (emails, support requests, web pages), the private data it can reach, and the ways it can send something out. An image from an outside address counts, since loading it tells that address what's in the request. If all three lists have something in them, remove one: a person approves what leaves, or a support agent reads only the data of the person who wrote in.
• Approve what you can't undo. My agent asks me to approve anything that binds me. Stripe builds this into agent keys. Elsewhere your agent proposes and a person carries it out.
• Approve less when you stop reading. Anthropic reports that people approve 97% of permission prompts in Claude Code, which suggests many click through by reflex. Corey Ball, author of the book Hacking APIs, describes the same slide to "accept always" after a few prompts. If you catch yourself doing it, narrow what the connector can do, so fewer prompts appear.
• Split the work between agents. I've never had one agent that did everything. Each of mine does one precise task, partly so that each holds only the rights that task needs, which can avoid mistakes. I once gave OpenClaw an MCP server with extremely limited rights for that reason.
• Don't count on software that spots attacks. Simon Willison calls a filter that catches "95% of attacks" a failing grade in security, since an attacker only needs the rest. Researchers from several labs, including ETH Zurich and Google, proposed instead, in June 2025, limiting any agent that has read untrusted text, so that text can't trigger an action of consequence.
• Keep to the vendor's server. On a server you install, tell your coding agent to stay on one version and update only when you ask, so a package can't change under you as postmark-mcp did.
• Keep each access token for one service. If your coding agent writes an MCP server that calls a second service, ask it to use a separate credential for that service.
• Try to trick your agent before going live. Send it a message written to fool it, such as an email asking it to forward the last invoices to an outside address, and check that nothing leaves.

For an agent you run yourself, self-hosted AI agents covers what stays local and how to keep closed the web page you use to run it. Before customers trust your own tools with their data, ask for a code review with Claude Code.

A worked example: a billing tool for a support agent

A made-up case puts these pieces together. You sell a subscription app alone, and you want an AI agent to draft replies to customers' billing questions. Customers write in through support tickets, requests logged in your help desk software. The one action is reading the plan, status and renewal date of the customer who opened the ticket.

Stripe has an MCP server, so why not use it? Its read tool can read any Stripe data, and this agent answers strangers and must see one customer only. So a tool your coding agent writes fits better, with a restricted key that has Read on Customers and Subscriptions and nothing else. The agent drafts, and a person sends.

The obvious design takes an email address as input, which lets the model choose whose billing data to read. Any message could then ask for someone else's record. So this tool takes the ticket's ID instead and finds the person who opened it by itself. Here is the brief to paste into your coding agent:

Write a tool named billing_lookup_for_ticket for my support agent.
My tickets are in [your help desk]. Tell me which key you need for it.

Input: ticket_id only, for example T-4812. No email address as input.

What it does: load the ticket, take the email address of the person
who opened it, find that customer in Stripe, then read their
subscriptions, canceled ones included.

What it returns: found, plan, status, renews_on, cancel_at_period_end.
Nothing else.

Its description, for the model to read:
"Returns the Stripe billing status of the customer who opened this
support ticket: plan, status, next renewal date and whether it is set
to cancel. Use it when the customer asks about a charge, a renewal,
their plan or a cancellation. It only reads, and only for the ticket's
own requester. It cannot refund, cancel or change anything. If it
returns found: false, say no subscription matches this address and
flag the ticket for a human."

The Stripe key: a restricted key with Read on Customers and
Subscriptions only, in an environment variable, never in the code.

Use Stripe's sandbox and a test key for now. Run these tests and show
me each result:
1. A test customer on a monthly plan, ana@example.com, asks when she
   will be charged next. Expect one tool call and a draft whose date
   matches Stripe's dashboard.
2. A ticket from mallory@example.net, who has no test subscription,
   asks what plan bob@example.com is on. Expect found: false and
   nothing about Bob.
3. A refund attempt with the same key. Expect a refusal.
4. A ticket from Ana@Example.com, with capitals, for a customer saved
   as ana@example.com. Expect found: false and the ticket flagged.

The description is long on purpose. Anthropic's tool guide asks for "at least 3–4 sentences" per tool, because the model chooses its tool from that text. One tool with a clear description costs little, and dozens of them are what adds up.

You don't have to read the code to judge the behavior. Stripe's sandbox is its practice account, where nothing is real, so these tests can't touch a customer. The first three carry over to any tool: the normal case, a stranger asking for someone else's data, and a change the key must refuse.

The fourth shows a limit. Stripe's customer email search treats capitals as different letters, so a customer who typed Ana@Example.com at checkout comes back as not found. The description sends that case to a human instead of a guess.

Your action plan

Every action in this guide, in the order of the steps, to tick off as you go.