Connectors in Claude and ChatGPT: connect Gmail, Drive, Slack and Notion safely

1. 1

   What is a connector, in one sentence?

   Anthropic’s help centre defines it this way: "Connectors let Claude access your apps and services, retrieve your data, and take actions within connected services." Without one, you copy an email or a document into the chat. With one, the AI goes and gets it, and its answer links back to the email or file it used.

   Under the hood a connector is an MCP server: a small program, usually run by the app’s maker, that offers the AI a list of tools such as search_threads or create_draft. The AI app decides which tool to call, the connector runs it with your permissions, and the result comes back into the conversation. The AI can only see what you can already see in that app.

   1. You ask a question↓→
   2. AI picks a connector tool↓→
   3. Connector runs it with your login↓→
   4. Result enters the chat↓→
   5. Answer with links to sources

   Key idea

   A connector is a door from the chat into one of your apps. It opens with your key, so it can see and do what you can.

2. 2

   How do you turn one on in Claude and in ChatGPT?

   In Claude, go to Customize > Connectors, find the app (Gmail, Google Drive, Slack, Notion and many more in the directory) and select Connect, then sign in to that app. In a chat, select + at the lower left, then Connectors, and switch on only the ones this conversation needs. On Team and Enterprise plans an Owner must first add the connector for the organisation; each person then connects their own account. Connectors also work in the Claude iOS and Android apps.

   In ChatGPT the same thing is now a plugin. OpenAI launched "apps" in ChatGPT in October 2025 and in July 2026 moved them into one plugins directory. Open Plugins, select + on the one you want, connect your account if asked, then start a new chat and type @ followed by the plugin name to use it. Installing a plugin does not by itself give it your data or approve its actions.

   Anthropic and OpenAI help pages · checked 12 Nov 2026

   Claude and ChatGPT do the same job with different names and menus

   Question	Claude	ChatGPT
   What it is called	Connector	Plugin (earlier connector, then app)
   Where to add one	Customize > Connectors	Plugins directory, then +
   Use it in a chat	+ > Connectors, switch it on	Type @ and the plugin name
   Free plan	Web connectors for all users; 1 custom connector	Select plugins on all plans; some need a paid plan
   Add your own MCP server	Add custom connector (paste URL)	Add custom MCP server (paste URL)
   Approval controls	Per tool: Always allow, Needs approval or Blocked	Always, before changes, or before big ones

   Key idea

   Connect once in settings, then switch connectors on per chat. Fewer switched on means fewer ways for the AI to go wrong.

3. 3

   Worked workflow 1: an interview-prep brief from Gmail, Calendar and Drive

   Here is a task most job seekers do by hand: before an interview, dig out the recruiter’s emails, the invite and your resume, and turn them into one page of notes. The people and company below are made up; the steps work the same in Claude, and in ChatGPT with its Gmail, Google Calendar and Google Drive plugins.

   One thing to know first. As of 12 Nov 2026, two Anthropic pages disagree about Gmail. The help centre says Claude can send, reply to and forward email, and asks your approval before each of these actions by default; the Gmail docs page still says the connector only reads. The connector’s own page lists both kinds of tools. So check the tool list on your screen, and in this workflow ask only for a draft.

   Worked workflow

   Worked workflow: one-page interview brief with sources

   Input

   An email thread with a recruiter at Northwind Analytics (fictional), a calendar invite for Thursday 3 pm, and resume.pdf in Google Drive.

   1. 1

      Switch on only three connectors for this chat

      Select + > Connectors and turn on Gmail, Google Calendar and Google Drive. Turn the rest off so the AI cannot wander into Slack or Notion. Before the first run, set send, forward and delete to Needs approval (see the permissions step below). In ChatGPT, type @Gmail, @Google Calendar and @Google Drive in the message instead.

   2. 2

      Ask with names, a time window and a format

      Name the company, the file and the date range, and ask for citations. Say what it must not do.

      Copy

      Search my Gmail for the thread with Northwind Analytics from the last 30 days,
      and my Calendar for the interview invite. Then open resume.pdf in my Drive.
      Write a one-page brief: role, interviewers and time, what the recruiter asked
      me to prepare, three resume lines that match the job, two questions to ask.
      Cite every email or file you used. Do not send or create anything.

   3. 3

      Check every citation

      Open each linked email or file. Delete any line in the brief that has no source; that line is a guess.

   4. 4

      Approve one small action

      Ask: "Draft, do not send, a two-line reply confirming Thursday 3 pm." Read the draft in Gmail and send it yourself.

   Output

   A one-page brief where every fact links to an email, invite or file, plus one unsent reply waiting in your Drafts.

   Key idea

   Good connector prompts name the source, the time window and the output, and say what the AI must not do.

4. 4

   Worked workflow 2: a weekly update from Slack and Notion, as a draft

   The second pattern is "read many places, write one draft". Slack’s own MCP server can search messages, read channel history, and also send messages, and Slack says workspace admins can approve and manage every MCP client, so yours may need to allow it first. Notion says its connector can read from and write to your pages with your permissions. That is useful and risky at once, so the output goes to a draft you check, never straight to the team channel.

   Worked workflow

   Worked workflow: Friday update from #launch and the launch tracker

   Input

   A Slack channel #launch with this week’s messages and a Notion page called "Launch tracker" (both fictional).

   1. 1

      Connect Slack and Notion once

      Customize > Connectors > Slack, then Notion (in ChatGPT, type @Slack and @Notion). Set Slack’s send tools to Needs approval or Blocked. If Slack refuses, your workspace admin has not approved the connector yet; ask them.

   2. 2

      Read, then write in one place only

      Tell it where to write and where never to write.

      Copy

      Read #launch messages since Monday and the Notion page "Launch tracker".
      Write a 150-word update under three headings: Done, Blocked, Next.
      Link each line to the message or page it came from.
      Create it as a new Notion page "Week 46 update" inside "Launch tracker". Do not post in Slack.

   3. 3

      Approve the one write

      When it asks to create the Notion page, check the title and the parent page, then approve.

   4. 4

      Edit and post it yourself

      Fix anything wrong, then paste the update into Slack. You stay the person who speaks for the team.

   Output

   A linked, 150-word update in Notion that you checked, and nothing posted in Slack without you.

5. 5

   Which tools should you let a connector use without asking?

   A connector is not one switch. It is a bundle of tools, and in Claude you can set each tool to Always allow, Needs approval or Blocked. We counted the tools on Google’s Gmail connector page in Claude’s directory (24 shown of 29): only a quarter just read your mail. The rest label, file, draft, send or delete.

   Why care? Simon Willison, who coined the term prompt injection, warns about a "lethal trifecta": an AI with access to your private data, exposure to text an attacker controls, and a way to send data out. Your inbox has all three. A stranger’s email can contain hidden instructions, and if the AI may read mail and also forward it without asking, those instructions can leak your data.

   • Read tools: Always allow is fine; they cannot change anything.
   • Draft, label, create page: Needs approval, so you see each one.
   • Send, forward, share, delete: Needs approval, or Blocked if the task never needs them.
   • In ChatGPT, set plugins to ask before changes, or before every action for email.

   Gmail connector (made by Google) · 24 tools shown

   Only 6 of the 24 Gmail tools just read; 18 change your mailbox

   • Read only6search_threads, get_thread, get_message, list_labels, list_drafts, list_filters
   • Labels, filters, spam12label_message, create_filter, mark_thread_spam and 9 more
   • Write or send4create_draft, reply, forward, send_message
   • Delete2trash_message, trash_thread

   View as table

   Item	Value	Note
   Read only	6	search_threads, get_thread, get_message, list_labels, list_drafts, list_filters
   Labels, filters, spam	12	label_message, create_filter, mark_thread_spam and 9 more
   Write or send	4	create_draft, reply, forward, send_message
   Delete	2	trash_message, trash_thread

   Key idea

   Let it read freely, make it ask before it changes anything, and block what the task never needs.

6. 6

   Worked workflow 3: add a custom connector, and keep the list short

   If a tool you use is not in the directory but its maker publishes an MCP server address, you can add it by URL. Claude’s Free plan allows one custom connector; ChatGPT has the same idea under Add custom MCP server. Custom servers are not verified by Anthropic or OpenAI, so only add ones from a maker you trust.

   More connectors is not better. Each connector’s tool list takes room in the AI’s context, and results such as a long transcript pass through it too. Anthropic’s help page suggests switching tool access to On demand once you have 10 or more connectors active. Its engineers described one example where loading only the tools needed, instead of every definition up front, cut token use by 98.7%.

   Worked workflow

   Worked workflow: connect a tool by its MCP URL, safely

   Input

   The MCP server address your tool’s maker publishes, for example https://mcp.example.com/mcp (placeholder).

   1. 1

      Add it

      Claude: Customize > Connectors > Add custom connector, paste the URL, then Add. ChatGPT: Plugins > + > Add custom MCP server, read the risk warning, then Create as a plugin.

   2. 2

      Sign in with the narrowest account

      Choose the sign-in the server offers and read the permission scopes. Use a read-only or test account if the tool has one.

   3. 3

      Set each tool’s permission

      Open the connector, then set read tools to Always allow, and anything that writes, sends or deletes to Needs approval or Blocked.

   4. 4

      Test with a question that only reads

      Ask something you already know the answer to, such as "list my three most recent projects", and compare with the app itself.

   Output

   One new connector that can read without friction, cannot change anything without your click, and is switched on only in the chats that need it.

   Anthropic Engineering · one agent task

   Loading only the tools a task needs used 2,000 tokens instead of 150,000

   • All tools up front150,000 tokens
   • Only needed tools2,000 tokens

   View as table

   Item	Value	Note
   All tools up front	150,000 tokens
   Only needed tools	2,000 tokens

From the people who built it

Straight from the source

The original idea, then the same idea taken apart, then how you use it today.

Simon Willison

Co-creator of the Django web framework; named the prompt injection attack in September 2022

The lethal trifecta for AI agents (blog post, 16 June 2025)

1 · Understand

An AI tool becomes easy to turn against you when it has three things at once: access to your private data, exposure to content an attacker controls, and a way to communicate outside.

2 · Break it down

• Private data: the reason you connect Gmail, Drive or Slack in the first place.
• Untrusted content: any email, shared doc or web page someone else wrote can carry instructions.
• A way out: send, forward, share, post, or even load a link with your data in it.
• Telling the AI to ignore instructions inside emails does not hold up reliably, so the fix is to break the set, not to hope the AI notices.

3 · Use it

Before you switch on a connector, ask which of the three it adds. If a chat already reads untrusted mail, keep every send or share tool on approval or blocked.

5 terms

Words to know

Connector

A ready-made link that lets an AI app search, read and act in another app with your login. ChatGPT calls it a plugin; Claude’s own skills and plugins are separate things.

MCP server

The program behind a connector. It lists the tools the AI may call and runs them. MCP is the open standard both Claude and ChatGPT use.

Custom connector

A connector you add yourself by pasting an MCP server URL, for a tool that is not in the official directory.

Tool permission

Whether a single connector tool may run on its own, must ask you first, or is blocked.

Lethal trifecta

Simon Willison’s name for the risky mix: private data, untrusted content and a way to send data out, all in one AI.

2 videos · plays here

Watch

Hand-picked from the people who explain this best. The video loads only when you press play.

Hands-on · 10 minutes or less

Try it

Connect one app and run a read-only question (10 minutes)

1. 1Pick the app you copy from most often: Gmail, Google Drive, Notion or Slack.
2. 2Connect it in Claude (Customize > Connectors) or ChatGPT (Plugins).
3. 3Open its tool list and set anything that sends, shares or deletes to Needs approval or Blocked.
4. 4Ask a question you already know the answer to, for example "What did the last email from my manager ask me to do?", and ask for links to sources.
5. 5Open each link. If every fact matches, try workflow 1 before your next interview.

Claude Help: Use connectors

Practise this lesson with an AI tutor

It checks what you understood, then gives you a small real task to try.

Open in Claude Open in ChatGPT Copy prompt

Read the prompt

Be my patient tutor. I just studied this lesson: "Connectors: Gmail, Drive, Slack in AI". Summary: A connector lets an AI app such as Claude or ChatGPT search, read and act inside another app you use, like Gmail, Google Drive, Slack or Notion, with your own login. Claude calls them connectors; since July 2026 ChatGPT calls them plugins. Both are built on MCP, both can ask before they act, and the safe habit is simple: turn on only the connectors a task needs, let read tools run, and make anything that sends, shares or deletes wait for your approval.
Key terms: Connector, MCP server, Custom connector, Tool permission, Lethal trifecta.

Do this, one step at a time, waiting for me each time:
1. Ask me to explain the main idea in my own words. Correct me kindly with one concrete example.
2. Ask 4 questions, easy to hard. After each answer, say what was right and what was missing.
3. Give me one small workflow I can try in 10 minutes that uses this idea in real work or study. Walk me through it step by step and check my result.
4. End with 3 lines: what I now know, what I should practise, what to learn next.

3 questions · instant feedback

Check yourself

Pick an answer to see if you are right, and why.

Question 1

Question 1 of 3

You connect Gmail and want the AI to prepare a reply. What is the safest request?

AReply to the recruiter for meBDraft a reply, do not send itCForward the thread to my personal email firstDTurn on every connector so it has full context

Question 2

Question 2 of 3

Why can a stranger’s email be a risk once an AI can read your inbox?

AEmails use too many tokensBThe AI cannot read attachmentsCThe email can contain hidden instructions, and if the AI can also send, it may leak dataDGmail blocks AI tools

Question 3

Question 3 of 3

You have 12 connectors switched on and answers are getting slower and vaguer. What does Anthropic’s help page suggest?

ASwitch tool access to On demand, and turn off connectors the chat does not needBWrite longer promptsCAdd a thirteenth connectorDSwitch to a smaller model

Lesson 20 of 42

Done? Keep going

Mark this lesson complete to keep your place. Progress is saved on this device, no login.

Mark lesson complete

Up next · Lesson 21 · 9 minWhat is an API?An API (application programming interface) is a set of requests one program can make to another, plus the rules for asking. When an app uses Claude, ChatGPT or Gemini behind the scenes, it sends a request to the model’s API over the internet and gets a response back. You prove who you are with a secret API key, and you pay for the tokens you send and receive.

Roles that need this lesson · 3

• Chief of Staff interview guideBriefs and weekly updates pulled from email, Slack and docs are core chief of staff work. Connectors do the gathering.Open the guide
• Founder's Office interview guideFounder’s office work spans every tool. Knowing which connector permissions are safe is expected.Open the guide
• GTM Engineer interview guideConnecting the CRM, inbox and Slack to an AI is the first GTM automation most teams try.Open the guide

← Previous: AI for Excel and Google Sheets

People also ask

Questions people ask

Can Claude send emails from my Gmail?+

As of 12 Nov 2026, Anthropic’s help centre says the Google Workspace connectors can send, reply to and forward email, asking your approval before each by default, and that the Calendar connector can create events. An older Anthropic docs page still describes Gmail as read-only, so check the tool list on your own connector page.

What happened to connectors in ChatGPT?+

ChatGPT first called them connectors. On 6 October 2025 OpenAI launched apps in ChatGPT, built on MCP, and on 9 July 2026 it brought them into one plugins directory. You now add them from Plugins and call one in a chat by typing @ and its name.

Does Claude train on my Gmail, and how do I disconnect a connector?+

Anthropic says: "We do not train our models on your Gmail, Drive, or Calendar connector data." On consumer plans, if you opted in to training, chats that quote that content may be used. To disconnect, open Customize > Connectors, select the connector and choose Disconnect. In ChatGPT, uninstall the plugin; a separately connected MCP server stays connected until you disconnect it too.

16 sources · checked Nov 2026

Sources and further reading

• Claude Help: Use connectors to extend Claude’s capabilities
• Claude Help: Use Google Workspace connectors
• Claude docs: Gmail connector (describes a read-only version)
• Claude connectors directory: Gmail (made by Google, added March 2026)
• Claude docs: Add a connector that isn’t in the directory
• ChatGPT: Plugins
• OpenAI: Introducing apps in ChatGPT and the new Apps SDK (6 Oct 2025)
• ChatGPT docs: Plugins
• OpenAI: ChatGPT is now a partner for your most ambitious work (9 Jul 2026)
• OpenAI plugins changelog (permission controls, 12 Jun 2026)
• OpenAI Apps SDK quickstart: add a custom MCP server
• Slack: Slack MCP server
• Notion Help: Notion MCP
• Model Context Protocol: What is MCP?
• Anthropic Engineering: Code execution with MCP (4 Nov 2025)
• Simon Willison: The lethal trifecta for AI agents (16 Jun 2025)

Related on this site

Previous: AI for Excel and Google SheetsNext: What is an API?What is MCP?What is an agent harness?Prompt injection and AI securityContext engineeringPractise the interview: free mock interview