The Connector Playbook.

A connector is a door into your business. Some you click to install. Some you build by pasting a URL and a token. And some hand the key to a developer you've never met. The tool list looks the same either way — the trust isn't. This is how to tell which door you're opening, and how to open the useful ones safely.

The Three Tiers

Tier	What it is	Example
1 · Directory	Click-to-install from the in-app list	Gmail, Slack, Drive · one click + sign-in
2 · Official custom	You paste an official MCP server URL	Meta Ads, GoHighLevel · paste + a little auth
3 · Community / 3rd-party	Someone else's server, deeper access	Open-source GHL (269+ tools) · more setup, more trust risk

Tier 1 is safe by default. Tier 2 is safe if the URL is genuinely official. Tier 3 is where you slow all the way down.

When It's Not In The Directory — Find Or Build The MCP

Your tool isn't in the click-to-install list? It probably still has an MCP server — you just have to go find it. And if it genuinely doesn't exist, one can be made.

Finding one that exists

Check the tool's own docs for "MCP" or "API." Check the official MCP directory. Or just ask Claude: "Does [tool] have an MCP server, and is it official or community?" Most major tools have one now — first-party is what you want.

When one doesn't exist

If a tool only has a regular API, a developer can wrap it into an MCP server. That's a real service you can commission. You don't build it — you know it's buildable, and you know what to ask for.

The operator's edgeBuilding MCP servers is developer work — Python, the whole thing. You don't need to build them. You need to know they exist, how to find the official one, and that a custom one can be commissioned when a client's tool isn't supported yet. That knowledge alone is sellable.

The Safety Beat — Who's Opening The Door?

A third-party connector means you handed the key to a developer you've never met. Connect it to WhatsApp or Telegram and that server sits in the path of your actual conversations. 2026 made this the defining risk:

The numbers

The MCP standard has no built-in auth. 492 servers found exposed with zero authentication. 40+ vulnerabilities in four months. A marketplace seeded with 1,100+ malicious tools.

The two attacks to know

Rug pull — looks clean at approval, turns malicious later. Typosquatting — a fake named almost like the real one ("g0highlevel," "Telegrm"). What's stolen: email, Slack, messages, CRM.

The Vetting Rule — Four Questions

Ask	Green	Red
Who made it?	Anthropic, or the actual company	A random repo, an unknown dev
Where'd I find it?	The in-app directory, the company's docs	A YouTube comment, a Telegram group, a "paste this URL" tweet
What's it reaching?	One thing I chose, minimum permissions	"All permissions," more than the task needs
Is it official?	Named, documented, a company behind it	"Community / unofficial" with deep access to private data

Default to first-party. The moment it's a third party — especially anything carrying private conversations — slow all the way down. If you can't answer who built it, don't open it.