Claude connector setup is easiest when you separate two cases:
- Claude web or organization connectors use a remote MCP URL.
- Claude Desktop can use a local stdio MCP config during development.
OpenAPI can generate both starting points.
What Sourced generates
From one OpenAPI spec, Sourced emits:
- a TypeScript MCP server
- a Claude remote connector review file
- a Claude Desktop/local MCP config
- an agent readiness report
- default-enabled tools
- tests that prove sensitive and destructive tools are not enabled by default
The remote file is a review artifact. The local config is the thing a developer can use for Desktop testing after building the generated package.
Remote Claude setup
Remote Claude connectors need a hosted MCP endpoint. That endpoint must be public HTTPS, but it does not have to expose your upstream API credentials to Claude. The generated server keeps those credentials in its own environment.
For authenticated APIs, protect the MCP endpoint too. Use a separate MCP_SERVER_ACCESS_TOKEN and keep it out of generated files. The connector output can say where the token belongs without committing the secret value.
Desktop fallback
Local Desktop testing is useful before you deploy anything. The generated package can expose stdio with:
{
"mcpServers": {
"your-api": {
"command": "node",
"args": ["/absolute/path/to/dist/index.js"]
}
}
}
That is not the final team rollout, but it is a good smoke test. It proves the tool list, schemas, and auth errors are understandable before a remote host is involved.
Review checklist
Before adding a Claude connector for a team, review:
- whether OAuth/OpenID Connect needs consent screens and callback URLs
- whether the API base URL is public and HTTPS
- whether tool names are stable
- whether write tools need confirmation
- whether destructive tools are excluded
- whether the generated README explains auth and rate limits
Use the same checklist for ChatGPT and Grok. The host differs, but the underlying API risk is the same.
Better UX principle
The user does not have to choose between "Claude web", "Claude Desktop", "MCP stdio", and "remote MCP" before they understand what is missing. Sourced asks for the hosted URL only when the selected target needs one. Desktop config stays available without blocking on deployment.