Choose the connector you want to review
Each checker is preconfigured for a specific connector angle. Google Drive focuses on files, folders and sharing. Slack focuses on messages and channels. GitHub focuses on code, secrets and release paths. The point is not a generic security score; it is a practical review of the exact system your agent will touch.
OAuth scopes, shared drives, client files, RAG indexing and document actions.
Live Slack MCP Connector Risk CheckerPrivate channels, DMs, message history, internal discussions and bot actions.
Live Gmail MCP Connector Risk CheckerPersonal data, attachments, outbound email, impersonation and retention.
Live GitHub MCP Connector Risk CheckerRepo access, secrets, code leakage, PRs, workflows and release actions.
Live Notion MCP Connector Risk CheckerWorkspace pages, client wikis, databases, comments and internal knowledge leakage.
Live HubSpot MCP Connector Risk CheckerCRM records, sales notes, lifecycle changes and outbound automation.
Live Jira MCP Connector Risk CheckerProject permissions, internal tickets, customer escalations and issue mutation.
Live Dropbox MCP Connector Risk CheckerShared folders, external collaborators, sync history and file exports.
Live SharePoint MCP Connector Risk CheckerTenant sites, document libraries, Microsoft 365 permissions and organization-wide search.
Live OneDrive MCP Connector Risk CheckerPersonal drives, shared files, Graph scopes, file writes and sharing links.
Live Linear MCP Connector Risk CheckerWorkspace issues, roadmap data, comments, status changes and team priorities.
Live Salesforce MCP Connector Risk CheckerCRM objects, reports, customer data, field updates and automation triggers.
Live Intercom MCP Connector Risk CheckerSupport conversations, contacts, companies, outbound replies and message exports.
Live Zendesk MCP Connector Risk CheckerTickets, requester data, internal notes, macros, public replies and status changes.
Live Airtable MCP Connector Risk CheckerBases, tables, records, linked fields, attachments and automation-triggering writes.
The risk model behind every check
Most AI connector incidents are not exotic. They come from ordinary design mistakes: a tool can read too much, modify too much, log too much, or reuse content outside the boundary where the user expected it to stay.
Which files, messages, records, tickets, repos, folders or objects can the agent reach?
Can it only read, or can it send, post, edit, share, delete, merge, invite or change state?
Does connector content stay temporary, enter logs, become RAG context, or persist in long-term memory?
Which actions are automatic and which require a human approval record before production impact?
Use this before connecting AI to production systems
For internal AI assistants
- Limit sources to approved folders, channels, labels, projects or objects.
- Show users which sources were accessed.
- Avoid full-content logs unless retention is intentional.
For client-facing workflows
- Separate tenants, clients and external collaborators.
- Require approval before outbound or destructive actions.
- Audit every connector call with source identifiers.
For SaaS features
- Split read, draft, write and delete into separate tools.
- Enforce OAuth scopes and app-level allowlists.
- Define deletion, retention and RAG reindexing behavior.
Related resources
A deeper audit framework for connector permissions, tool calls, logs and release gates.
ResourceAI Agent Tool Permission BoundariesHow to split AI tools by action risk instead of exposing one broad integration surface.
ServiceBuild secure AI workflowsDesign production AI systems with clear permissions, audit logs, approval gates and practical workflows.
FAQ
What is an MCP connector risk checker?
An MCP connector risk checker helps review what an AI agent can read, search, modify, send, delete, log or index through a Model Context Protocol connector before the workflow is deployed.
Why do MCP connectors need separate risk pages per app?
Each connector has a different risk shape. Google Drive risk is mostly files, folders and sharing. Slack risk is messages and channels. GitHub risk is code, secrets and release actions. One generic checklist misses those differences.
Should MCP connectors be read-only by default?
Most connector rollouts should start read-only or draft-only. Write, send, share, delete, invite, merge or permission-changing actions should usually require separate tools, explicit approval and audit logs.
What should be measured before scaling AI agents with connectors?
Measure connector scope, data class, write capability, approval coverage, logs, retention, RAG indexing, tenant boundaries and whether users can see which sources or tools shaped the output.
