APIs & MCP: Getting the Most Out of Claude
An MCP (Model Context Protocol) connection is the right way to plug Claude into your real tools — Clio, HubSpot, Figma, GitHub, Notion, case-law databases, anything. In this lesson you'll understand what an MCP is, where to find trustworthy connectors, how to wire one up, and — most importantly — how to judge whether a connection is safe before using it on real client work.
What you'll get: a clear grasp of what an MCP is and the three connection types you'll encounter, the trustworthy places to find connectors (the official registry and the six reference servers), and a 6-point safety checklist — plus a copy-ready audit prompt — to evaluate any connection before it touches client data.
What an MCP is, in one sentence
An MCP is a bridge: it gives Claude a set of concrete actions on an external tool (search, create, read, write), instead of Claude just "knowing how to talk about" that tool from its training. Without MCP, Claude can explain how HubSpot works. With MCP, Claude can create the contact in your real HubSpot — or read your GitHub issues, query a database, fetch a live web page, update a Notion doc. You add a connector once; from then on, Claude uses it whenever a task needs it.
The three connection types you'll find
Official / native connector
Anthropic or the provider (HubSpot, Google Drive, Figma, CourtListener) publishes the connector. It lives in Settings → Connectors in Claude, or in the Claude Code plugin marketplace. It's the safest option: official maintenance, clear permissions.
GitHub, Notion, Slack, Postgres and others now ship as official vendor connectors, maintained by the vendors themselves.
Bridge via Zapier (or similar)
For when the tool you use (e.g. Clio, Centerbase, PracticePanther) has no native connector. Zapier acts as a translator between Claude and that tool.
Easier to set up, but each user needs their own connected account.
Community MCP
An independent developer published an MCP server on GitHub for that tool.
More flexible, but you decide whether it's safe to install — that's exactly what this lesson's checklist is for.
The official registry and the six reference servers
Browse everything that exists at the official registry: registry.modelcontextprotocol.io. Names and packages change over time, so always confirm the current name in the registry before installing anything. (Verified July 2026.)
Alongside the vendor connectors, the MCP project maintains six core reference servers — small, official, general-purpose tools worth knowing by name:
| Server | What it's for |
|---|---|
| Filesystem | Read and write files, but only in folders you explicitly allow — scoped, secure file access. |
| Git | Read, search, and work with local Git repositories. |
| Fetch | Pull a live web page and convert it into clean text Claude can work with. |
| Memory | Persistent memory (a knowledge graph) that survives between conversations. |
| Sequential Thinking | A scaffold for careful step-by-step reasoning on complex problems. |
| Time | Current time and timezone conversions. |
How you connect one
In the Claude Desktop app, most connectors are one click away under Settings → Connectors. For advanced ones, you paste a small config into claude_desktop_config.json (in Claude Desktop: Settings → Developer → Edit Config). For example, enabling the Filesystem server on a single folder looks like this:
{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/you/Documents"]
}
}
}
Start with the connectors your track actually needs — you don't need them all.
The 6-point checklist before installing a non-official MCP
This is the most important part of the lesson. Before connecting any community MCP to client data, review:
| # | Question | Why it matters |
|---|---|---|
| 1 | Data residency — where does your data travel? Local, or does it bounce through a third-party server? | Some MCPs round-trip your data through someone else's server before reaching the tool. |
| 2 | Credential storage — is your API key in plain text in a config file, or encrypted? | A plain-text key on your disk is a real risk if the machine is lost or shared. |
| 3 | Audit trail — can you see a log of which call was made, when, with what data? | Needed for compliance (ABA Opinion 512 on AI makes it nearly mandatory in the US). |
| 4 | Supply chain / code review — is the code open? When was it last updated? Is it maintained by someone identifiable? | You wouldn't install a Chrome extension from a stranger with no reviews; an MCP is the same. |
| 5 | Scope minimization — do you grant only what it needs, or full access to your account? | Never give Claude full write access to your CRM if it only needs to read contacts. |
| 6 | Liability if something fails — if there's a leak or a wrong write, who is responsible? | Zapier has a contract that covers it. A random GitHub repo does not. |
Rule of thumb: official connectors meet all 6 by default. Zapier usually meets 5 of 6. A community MCP can meet all 6 if you do the verification work — that responsibility is yours.
How to get your first API key (generic step-by-step)
- Go to the provider's site (e.g. courtlistener.com, hubspot.com, figma.com) and create an account if you don't have one.
- Look in your account settings for a section called API, Developer, or Integrations.
- Generate a new token/key. Give it a recognizable name ("Claude — [your firm]").
- Never paste that key directly into a chat prompt that will be saved in a shared place. It goes in an environment file (
.env.local) or the Connectors settings — never in plain text inside a scheduled task or a persistent message. - After the initial setup, consider rotating the key if you shared it via chat with anyone (including your own AI assistant) during setup.
What it looks like once connected
Once an MCP is active, you simply ask Claude in natural language: "find all this client's overdue invoices in Clio", or "create the contact in HubSpot with this info". Claude decides on its own which MCP tool to use — you write no code, you just describe the task.
Find all overdue invoices for this client in Clio, and draft a short, friendly payment-reminder email for each one.
Worked example: audit an MCP before you install it
Claude can also run the 6-point checklist for you as a first pass. Paste this with the actual repository you're evaluating:
I'm evaluating the community MCP server at https://github.com/[owner]/[mcp-repo] before connecting it to client data. Review it against my 6-point checklist: (1) data residency — does it run locally or route my data through a third-party server? (2) credential storage — plain-text config or encrypted? (3) audit trail — is there a log of calls made? (4) supply chain — is the code open, when was the last update, is the maintainer identifiable? (5) scope — what permissions does it actually request, and can I narrow them? (6) liability — who is responsible if something leaks or writes wrong data? For each point, tell me what the repo shows and what I still need to verify myself.
Claude gives you the first pass; the final call — and the responsibility to verify — is still yours.
What's next
The next lessons take this same principle and apply it to your field: Legal (CourtListener + Clio), Marketing (HubSpot and friends), and Web Design (Figma). Each gives you the specific connection and real prompt examples that get the most out of it.
10-minute practice. Open registry.modelcontextprotocol.io and search for a tool you use every day. Identify which connection type it is (official, bridge, or community). If it's a community one, hand Claude the audit prompt above with the real repo and read the result point by point. Finish by answering one question: would you connect it to client data?