Preflight Checklist
Problem Statement
When an org admin enables an MCP connector at the organization level (Organization Settings > Connectors) in claude.ai, that connector becomes visible to every member's Claude Code session, regardless of whether that member has ever used it or has any need for it. Each unauthenticated org-wide connector shows a persistent "needs authentication" warning in the member's session.
There is currently no way to:
- Scope a connector to specific users or groups within the org, or
- Suppress/dismiss the authentication warning for a connector a given user doesn't intend to use
This means every member is nagged about every connector the org has ever enabled, even ones added for a single team or a one-off integration test. As the number of org-wide connectors grows, this becomes persistent UI noise for the majority of users who have no reason to authenticate.
This is related to but distinct from #46207 (shared OAuth token across all users for a connector). That issue is about data/security scoping once a user authenticates. This issue is about members who never intend to authenticate at all still being warned as if action is required of them.
Proposed Solution
Make org-wide connectors opt-in rather than opt-out at the member level:
- When an admin enables a connector for the org, it's added to a connector catalog but is not automatically surfaced or nagging in any member's session.
- Members browse the catalog and explicitly "add" a connector to their own workspace when they actually need it.
- Only after a member adds a connector does it appear in their session, and only then does the authentication warning apply to them.
- This keeps admin control over what's available org-wide while eliminating nag noise for members who never intend to use a given connector.
Alternative Solutions
- Per-user dismiss/mute: Instead of opt-in visibility, let each member individually dismiss or mute the authentication warning for a specific connector in their own session, without disabling it org-wide. Lower engineering lift, but the connector still clutters the list even after being dismissed.
- Usage-based auto-hide: If a member hasn't interacted with a connector after N sessions, stop surfacing the authentication badge for them (still discoverable via a full connector list, just not nagging).
- Admin group-scoping: Admin scopes a connector to specific users or groups (e.g., via existing org group membership) at enable time, similar to how enterprise-managed auth already scopes credential access by IdP group. Members outside that scope don't see the connector at all. More admin overhead than opt-in visibility since it requires the admin to know who needs what in advance.
Priority
Medium - Would be very helpful
Feature Category
MCP server integration
Use Case Example
Our org enabled connectors for various for a subset of users who needed them for specific projects. Every other member of the org, including people with no relationship to those tools, now sees both connectors listed with a "needs authentication" warning in every Claude Code session. There's no way for those members to make the warning go away short of asking an admin to disable the connector org-wide, which would break it for the people who actually need it. A per-user/group scoping or dismiss option would let the org enable niche, team-specific connectors without creating noise for everyone else.
Additional Context
No response
Preflight Checklist
Problem Statement
When an org admin enables an MCP connector at the organization level (Organization Settings > Connectors) in claude.ai, that connector becomes visible to every member's Claude Code session, regardless of whether that member has ever used it or has any need for it. Each unauthenticated org-wide connector shows a persistent "needs authentication" warning in the member's session.
There is currently no way to:
This means every member is nagged about every connector the org has ever enabled, even ones added for a single team or a one-off integration test. As the number of org-wide connectors grows, this becomes persistent UI noise for the majority of users who have no reason to authenticate.
This is related to but distinct from #46207 (shared OAuth token across all users for a connector). That issue is about data/security scoping once a user authenticates. This issue is about members who never intend to authenticate at all still being warned as if action is required of them.
Proposed Solution
Make org-wide connectors opt-in rather than opt-out at the member level:
Alternative Solutions
Priority
Medium - Would be very helpful
Feature Category
MCP server integration
Use Case Example
Our org enabled connectors for various for a subset of users who needed them for specific projects. Every other member of the org, including people with no relationship to those tools, now sees both connectors listed with a "needs authentication" warning in every Claude Code session. There's no way for those members to make the warning go away short of asking an admin to disable the connector org-wide, which would break it for the people who actually need it. A per-user/group scoping or dismiss option would let the org enable niche, team-specific connectors without creating noise for everyone else.
Additional Context
No response