Are ChatGPT Connectors Safe? The MCP Permissions Guide for Non-Developers (2026)

Key Takeaways

• Storyflow's MCP server has the safest permission design for a person or small team in our comparison: you pick the projects, you choose read-only or changes, access ends within a minute of disconnecting, and every connection expires after 30 days.
• A connector is safe or unsafe because of three things you control: who runs the server, how much it can reach, and how fast you can cut it off. The assistant's brand matters less than those three.
• Read-only is the single most useful switch. A read-only connection can expose information, but it cannot change, move or overwrite your work.
• Prompt injection is the risk you cannot see: text hidden in a page, a file or a tool result that tells the assistant to do something you never asked for. Anthropic, OpenAI and Google all say it is not solved.
• ChatGPT, Claude and Gemini each put a human check in front of write actions, but none of the three vendors verifies a custom server for you. Their own pages say so.
• For an organisation, weight admin controls first. Under that weighting Google Workspace in Claude, Miro and Notion all score above Storyflow, which has no admin console for connectors.
• Audit your connectors once a month: one table, five questions per row, about 15 minutes for a handful of connections. The template is at the end of this guide.

The Short Answer: Safe Under Three Conditions

A connector is a door into one of your accounts. Whether the door is safe depends on who holds the key, which rooms it opens and how quickly you can change the lock. Every vendor's guidance comes back to the same three conditions.

Condition 1: you trust who runs the server

When you add a connector, your assistant starts talking to a server run by another company. Anthropic's custom connector guide states plainly that custom connectors reach services Anthropic has not verified, and advises connecting only to servers built and hosted by organisations you trust. OpenAI's MCP documentation says the same about custom servers in ChatGPT, and Google's custom apps page says Google does not control, monitor or secure third-party MCP servers.

The practical test is the address. A connector for a tool you already use should live on that tool's own domain: mcp.storyflow.so for Storyflow, mcp.linear.app for Linear, mcp.figma.com for Figma. If the address is on a domain you do not recognise, stop there.

Condition 2: the connection reaches only what the job needs

A connector that can read two projects is a smaller risk than one that can read forty. A connector that can only read is a smaller risk than one that can write. The MCP project's own security best practices call this scope minimisation: a broad grant makes any leak or mistake bigger, and it makes the grant harder to take back without breaking everything that depends on it.

Condition 3: you can end it fast

Ask before you connect: where is the off switch, and how long does it take to work? A connection you can remove in one click that stops working within a minute is a different risk from one that needs a support ticket. A connection that expires by itself is safer again, because the ones you forget about do not stay open forever.

What a Connector Actually Is, and What It Can Touch

You do not need to read code to judge a connector, but you do need the right picture of what is talking to what.

The four parties in every connection

1. You, signed in to an assistant such as ChatGPT or Claude.
2. The assistant (the MCP client), which decides when to call a tool.
3. The connector's server (the MCP server), run by the tool's vendor, which exposes a list of tools such as "list projects" or "create a table".
4. Your account in that tool, which holds the actual work.

MCP, the Model Context Protocol, is the shared language between parties 2 and 3. That is why one Storyflow address works in ChatGPT, Claude, Gemini and Grok. If the vocabulary is new, our explainer on ChatGPT apps, connectors and MCP servers defines each term in one sentence.

What "on your behalf" means

After you sign in, the assistant acts as you, inside the limits you approved. It does not become an administrator and it cannot reach what your own account cannot reach. Notion's help page puts it directly: its MCP tools act with your full Notion permissions, so they can access everything you can access. Atlassian's setup guide says MCP clients can act on all connected products with your existing permissions.

That sentence is both the reassurance and the warning. The connector cannot exceed you, and by default it can do most of what you can.

Directory connectors versus custom connectors

A directory connector is one the assistant's maker lists and has reviewed in some way. A custom connector is any server you add yourself by pasting its address. Custom is not unsafe by definition: it is how every new connector starts, including Storyflow's. It does mean the trust decision is yours alone. On ChatGPT a custom server needs ChatGPT Plus or above with Developer mode. Claude lets every plan add custom connectors, with one on the Free plan.

Remote servers versus local servers

A remote server runs on the vendor's infrastructure and you reach it over HTTPS. A local server is a program you install on your own computer. The MCP security guidance treats local servers as the riskier kind for non-developers, because installing one means running someone else's code with your own access to your files. Everything in this guide is about remote connectors. If a guide tells you to paste a command into a terminal and you do not know what it does, that is a local server, and it deserves more caution than a sign-in page.

What You Grant at Sign-In: OAuth and Scopes in Plain English

The sign-in page is the only moment you set the rules, and it is easy to click through without reading.

OAuth: the assistant never sees your password

OAuth is the standard behind every "Sign in with" button. You type your password on the tool's own page, the tool hands the assistant a token (a long random string that stands in for you), and the assistant uses the token from then on. Anthropic's guide notes that this lets Claude work with the application without ever seeing your actual password. If a connector asks you to paste your password into the chat itself, close the tab.

Scopes: the list of what the token may do

A scope is one line of permission attached to the token. Storyflow's sign-in page shows three: read your projects, boards and documents; create and edit content; and reach your documents outside projects. Linear's MCP page describes a read scope that produces a token unable to reach write functions at all. Other servers offer a single all-or-nothing grant. The fewer and narrower the scopes, the less a stolen or misused token can do.

What the MCP specification requires of every server

The MCP authorization specification sets rules that a well-built remote connector follows. You cannot check most of them from the outside, but they explain why a connector that follows the standard is safer than a homemade one.

What the specification asks of the assistant

The same project's tools specification says there should always be a human in the loop who can deny a tool call, that the app should show which tools are exposed and when they run, and that tool labels such as "read-only" are untrusted unless the server itself is trusted. That last point matters: a server describing its own tool as harmless proves nothing. OpenAI's documentation makes the same point, warning that a write can happen even when a server has tagged the action as read-only.

Read-Only vs Write: The Switch That Decides the Damage

Every connector risk sorts into one of two kinds: information leaving, or work changing. Read-only removes the second kind entirely.

Two rules follow. First, start read-only on anything a client can see, and move to write only for the project you are building. Second, treat "write, everything" as a temporary state: if a task needed it, reconnect with picked projects when the task is done.

One honest caveat: read-only is not harmless. A read connection still places your content in the conversation, and from there it is governed by your assistant's own data settings, not the connector's.

Prompt Injection in Plain English

Prompt injection is the reason "safe" is conditional. It is also the part most guides explain badly.

What it is

An assistant reads instructions and content through the same channel: text. If a web page, a PDF, an email or a tool result contains a sentence written as an instruction, the assistant may follow it. Anthropic's research post on the subject describes it as adversarial instructions hidden within the content an AI model processes, and says it is far from a solved problem. OpenAI's MCP documentation describes the same attack and its consequence: a model that obeys injected text can take actions neither you nor the developer intended.

The three ingredients an attack needs

An injection only causes harm when three things are present in one conversation.

1. Untrusted content: something written by a stranger, such as a public web page, an inbound email or a shared document.
2. Access to something private: a connector that can read your files, boards or mail.
3. A way to act or send: a write tool, a send tool or a link the assistant can load.

Remove any one and the attack has nowhere to go. A read-only connector scoped to two projects, used in a chat with no web browsing and no inbound mail, has ingredient 2 and almost nothing else.

What the vendors say they do about it

Anthropic says Claude has built-in protections that try to block these attacks, and still tells you to watch tool inputs and outputs. OpenAI says ChatGPT asks for manual confirmation before write actions. Google says Gemini requires manual confirmation for any write action and adds that Gemini can make mistakes. None of them claims the problem is closed.

What actually limits it

Your scoping does. A hijacked assistant can only misuse what the connection allows. That is why this guide spends more words on permissions than on model safety: the permission is the part you control.

Three habits cover most of the risk. Keep write connectors out of chats where the assistant is also browsing the open web. Read the confirmation prompt before approving a write, especially the destination. And when a tool result contains anything that reads like an instruction to the assistant, treat that as a red flag about the source.

What ChatGPT, Claude, Gemini and Grok Each Do to Protect You

Each assistant puts its own checks around connectors. This table reports only what each vendor's documentation says today.

Two details worth knowing about Claude

Anthropic advises choosing Allow always only for a server and tool you trust to run unsupervised. It also notes that during Research, Claude can call connector tools automatically without further approval, and recommends switching off any tool that can take write actions first. If you use Research with a write connector attached, turn the write tools off in the Search and tools menu before you start.

One detail worth knowing about ChatGPT

OpenAI's guidance for people building apps, its security and privacy guide, tells developers to assume prompt injection will reach their server and to require human confirmation for irreversible operations. That is advice to the server's builder, which means the quality of a given connector still depends on who built it.

How We Scored Connectors on Permission Design

"Safest" needs a definition, so here is ours, with the weights published. We scored the permission design of each connector, meaning what you can restrict, see and undo, using only what each vendor's own documentation states on the pages linked in this guide. We did not penetration-test any server, and a control that a vendor has but does not document on those pages scores as not documented.

Why these weights

They are set for a freelancer or a team of up to about ten people who connect tools themselves and have no IT department. For that reader, what they can restrict at sign-in matters more than a console they do not have. A security team at a 500-person company should weight admin controls first, and we show that result too.

What we did not weigh

We did not score certifications such as SOC 2 or ISO 27001, data residency, encryption design or incident history. Those matter for procurement, and none of them can be judged from a help page. If your organisation requires them, ask each vendor for its current reports directly.

Connector Permission Designs Compared: Storyflow, Google Workspace, Linear, Miro, Notion and Atlassian

Scores are out of 10 per criterion and weighted into a total out of 10.

The same connectors under an organisation's weighting

Change the weights to admin controls 40%, track record 15%, scope 15%, exit 15%, read-only 10% and sign-in clarity 5%, and the order turns over.

Storyflow is last under the organisation weighting, and that is the honest reading: its controls belong to the person connecting, not to an administrator. Pick the weighting that describes you before you read the ranking.

The Connectors Compared on Permission Design

Each review covers what you can restrict, what you cannot, and who the design suits. For the wider question of which connectors are worth adding at all, see our rankings of the best ChatGPT connectors and the best Claude connectors.

1. Storyflow

The verdict: the most control at the moment of sign-in, and the shortest track record.

Best for: freelancers and small creative teams who connect ChatGPT or Claude themselves and want to decide project by project what the assistant may touch.

Storyflow is a visual project planning workspace for creative work, and its MCP server (launched October 2026) lets an assistant read and build boards, tables, documents and slide decks. The server lives at https://mcp.storyflow.so/mcp.

What you choose at sign-in:

• Which projects: all of them, or only the ones you tick. A project you did not pick returns a refusal, not content.
• Whether it may make changes. Without that, the write tools are not offered to the assistant at all, so it can only read.
• Whether it may also use documents outside projects (your private documents and ones shared with you). This starts on when you allow all projects and off when you pick projects, and you can set it either way.

What the sign-in page does for you:

• If Storyflow does not recognise the app asking to connect, it shows a warning naming the address the app will send you back to and the date the app registered, and the Approve button stays disabled until you tick "I trust this app".
• Allowing changes requires a sign-in no older than five minutes, so a stale browser session cannot grant write access.
• When you choose all projects, the page states that this includes projects other people have shared with you.

How you get out: open Settings, then Connected apps. Each connection shows whether it is Read or Read and write, how many projects it covers, whether documents outside projects are included, when it was last used and the date it must be re-approved. Revoke removes one; Revoke all removes every assistant and key. Access ends within a minute. Every connection also ends by itself after 30 days, and personal keys last 30 days too.

Other limits built in: under a picked-projects connection the assistant cannot create new projects, because a new project would sit outside what you approved. The connector adds and edits; it has no general tool for removing elements from a board, although it can remove deck slides and clear table cells. Storyflow stores a one-way hash of each connection token, not the token itself.

Where it loses points:

• The defaults are broad. All projects is preselected, and the changes box starts ticked when the assistant asks for write access. Narrowing takes two clicks, but you have to make them.
• There is no admin console for connectors. On the Max plan a team workspace has roles and permissions, but nothing lets an owner allow or block assistants for the whole team.
• You cannot switch individual tools on or off from the Storyflow side; that control lives in your assistant.
• The server is weeks old. It has no public track record to point to, and this guide makes no certification claims for it.

Try it: connect from the Storyflow MCP page or follow the help article. Step-by-step versions are in our guides to connecting ChatGPT and connecting Claude.

2. Google Workspace in Claude

The verdict: the best-governed option here, with the widest reach per connection.

Best for: organisations on Claude Team or Enterprise that need an owner to switch connectors on and off for everyone.

Anthropic's Google Workspace connectors let Claude search and read Gmail, read and manage Calendar events, and search, read, share, move and trash Drive files.

What protects you:

• By default Claude asks for your approval before sending, replying to or forwarding an email, and before sharing, moving or trashing a Drive file.
• On Team and Enterprise, an Owner or Primary Owner must enable the connectors for the organisation before anyone can sign in, and owners decide whether members may let those actions run without asking each time.
• Disconnecting takes two steps you fully control: Disconnect in Claude under Customize, Connectors, and a full revocation from your Google Account's connections page.

Where it loses points: each connector covers a whole product. The documentation describes no way to limit Claude to one Drive folder or one mailbox label, so the scope is your entire Gmail, Calendar or Drive. And the write actions include sending mail and trashing files, which is a wider blast radius than adding a table to a board.

3. Linear

The verdict: the cleanest read-only design of any connector we read.

Best for: product and engineering teams who mostly ask questions of their issue tracker.

Linear's MCP documentation gives you three separate ways to stay read-only: a dedicated address ending in /mcp/readonly that only ever exposes read tools, a read scope on the standard address that produces a token unable to reach write functions, and an API key with only the Read permission enabled.

What protects you: the read-only address is the strongest form of the idea, because the write tools do not exist on it. The documentation says each workspace is authenticated separately, so one sign-in does not span every workspace you belong to. Organisations using Okta can turn on enterprise-managed authentication so supported clients sign users in through the identity provider.

Where it loses points: read and write is the default on the standard address, so read-only is something you have to know to ask for. The page describes no per-team or per-project choice inside a workspace and no steps for revoking a connection, though both may exist elsewhere in Linear's settings. It also supports pasting an API key, which is convenient and long-lived unless you rotate it.

4. Miro

The verdict: sensible team-level scoping and a strong Enterprise default.

Best for: teams already working on Miro boards, especially on Enterprise.

Miro's MCP server uses OAuth 2.1 and respects existing board permissions. In the Claude connector flow you select the team the connection applies to after signing in, and according to its setup guide, on an Enterprise plan the server is disabled by default until an admin enables it for the organisation.

What protects you: team selection keeps a connection out of other teams you belong to. Off-by-default on Enterprise is the right posture for a company. The server works on every Miro plan, including free teams, so the security controls are not locked behind a tier for individuals.

Where it loses points: the pages describe no read-only mode and no per-board choice at sign-in, so inside the chosen team the connection can do what you can do, including creating board items and resolving comment threads. They also do not describe how to revoke a connection.

5. Notion

The verdict: strong governance for Enterprise, an all-or-nothing grant for everyone else.

Best for: Enterprise workspaces that want an approved list of AI tools.

Notion is direct about its model. Its help page says MCP tools act with your full Notion permissions and can access everything you can access. On the Enterprise plan, admins can approve specific AI apps and MCP clients and block everything not on the list.

What protects you: the approved-list control is the strongest admin feature in this comparison, and Notion publishes security best practices for MCP that tell users to treat tool results as untrusted, enable confirmation before changes and verify the server address.

Where it loses points: there is no page-level or teamspace-level choice at sign-in and no read-only option described. Notion's own page also states two exit limits: removing a single tool is not directly supported (the workaround is to disconnect all users and reconnect), and Notion cannot revoke existing tokens for previously connected tools. For a solo user outside Enterprise, the connection is simply as wide as your account.

6. Atlassian (Jira and Confluence)

The verdict: a mature vendor that tells you plainly how wide the grant is.

Best for: companies already standardised on Jira and Confluence with an admin who manages app access.

Atlassian's remote MCP server uses OAuth 2.1 and respects your existing access controls. Its disclaimer says MCP clients can perform actions on all connected products with your existing permissions, and advises least privilege, reviewing high-impact changes before confirming and monitoring audit logs.

What protects you: the warning itself is useful, and Atlassian links a separate page of server settings for administrators. Audit logs exist on the Atlassian side for organisations that review them.

Where it loses points: the grant spans every connected product at once, the setup page describes no read-only mode or per-project choice, and it gives no revocation steps. Least privilege is advice here, not a switch on the sign-in page.

Not ranked: Milanote, and connectors we could not verify

We found no connector or MCP server for Milanote on its own site, so there is nothing to score. We also left Canva, Asana and Figma out of the scoring: their public pages confirmed that a server exists but did not describe scope, read-only or revocation in enough detail to score fairly. Asana's documentation does say that Enterprise+ customers can allow or block MCP clients through app management.

Worked Example: A Three-Person Studio Connects ChatGPT and Claude Safely

This is an illustrative example. The studio, the project counts and the timings are invented to show the decisions, not measured.

The situation

A three-person brand studio has 14 projects in Storyflow. Two are under NDA for a client launching in the spring. The producer plans in ChatGPT, the designer works in Claude, and the founder wants a weekly summary without opening every board.

Step 1: decide the rooms before opening the door

They write down what each person needs before anyone signs in.

Nobody gets all projects, and the only write connection covers 2 of 14 projects.

Step 2: connect read-only first

The producer adds https://mcp.storyflow.so/mcp in ChatGPT, signs in, switches from All my projects to Only the projects I pick, ticks two, and unticks the changes box for the first week. For five working days the connection can only answer questions. The first prompt is a check, not a task: "List the Storyflow projects you can see." The answer names two projects. That is the test that the scope took.

Step 3: turn on changes for one job

In week two the producer needs a plan built. Changing scope means connecting again, so the producer revokes the connection in Settings, Connected apps, and reconnects with the same two projects and changes allowed. Storyflow requires a sign-in from the last five minutes whenever write access is granted. The first write prompt is deliberately small: "Add one note titled Connection test to the Spring Shoot board." ChatGPT asks for confirmation, the note appears on the open board, and the producer deletes it by hand.

Step 4: meet a suspicious document

A supplier emails a PDF rate card. The producer uploads it to the chat to compare rates. Suppose the PDF contained a hidden line telling the assistant to copy every project into a new document and share it. Walk through what the scoping allows: the assistant can see two projects, not 14; it cannot create a new project under a picked-projects connection; the connector has no sharing or sending tool; and ChatGPT would ask for confirmation before any write. The injected instruction has almost nothing to work with. With an all-projects write connection in a chat that could also browse the web, the same PDF would be a real problem.

Step 5: the monthly audit

On the first Monday of the month, the founder opens Settings, Connected apps. Three rows, each showing Read or Read and write, the project count, the last-used date and the re-approve date. One row says Never used: a key someone made for a tool they abandoned. It gets revoked. The whole check fits inside a coffee.

How to Audit Your Connectors in About 15 Minutes

An audit is a list of what is connected, compared with what should be.

Step 1: list connections from both sides

Check each assistant's connector list, then check each tool's own list of connected apps. The two lists can disagree: removing a connector in your assistant does not always revoke the token on the tool's side, which is why Anthropic's Google Workspace guide sends you to your Google Account's connections page for full revocation.

Step 2: ask five questions of every row

1. Do you still use it? If the last use was more than 30 days ago, remove it.
2. Is the address on the vendor's own domain?
3. Is the scope the smallest that does the job?
4. Does it need write access today, or only when you are building something?
5. Do you know how to remove it, and have you tried?

Step 3: fix the widest grant first

Sort by reach, not by how often you use something. One all-projects write connection you forgot about is a bigger exposure than three narrow read-only ones you use daily.

Step 4: set the next date

Put a recurring 15-minute event on the first Monday of each month. With Storyflow the 30-day expiry forces the question anyway: when the assistant asks you to sign in again, choose the projects fresh instead of clicking through.

How to Disconnect a Connector, Assistant by Assistant

Knowing the exit before you need it is half of safety.

Claude

Open Customize, then Connectors, and choose Remove on the connector. Anthropic notes that editing a custom connector means removing it and adding it again, and that Team and Enterprise owners can remove connectors for the organisation in Organization settings.

ChatGPT

Remove the app from the same settings area where you added it. OpenAI's help pages refused our automated requests, so we could not verify the exact menu labels today; check them in your own account, and on Business or Enterprise ask your workspace admin.

Gemini

Under Custom apps, turning an app off disconnects it but leaves it listed. Google says that to revoke access you should disconnect and remove the app, which also unlinks the server from your Google Account. Setup and its limits are in our guide to connecting Gemini to a project board.

Grok

Manage connectors at grok.com/connectors. xAI's connectors page does not describe removal steps, so confirm the result from the tool's side as well. Our guide to connecting Grok covers the admin step on Business and Enterprise.

The tool's side

Always finish on the tool's own page. In Storyflow that is Settings, then Connected apps, then Revoke, and access ends within a minute. Removing a connection there works no matter which assistant created it, including one you can no longer sign in to.

Admin Controls: What Changes on Team, Business and Enterprise Plans

If you manage other people, your question is different: not "what did you grant" but "what can my team grant without asking".

In the assistant

On Claude Team, only Owners and Primary Owners can add custom connectors; on Enterprise, owners and people with a suitable custom role can. On ChatGPT Business and Enterprise an admin turns on Developer mode. On Grok Business and Enterprise an admin provisions a connector in the xAI console before members see it. The Gemini app does not accept custom apps on work or school accounts for now.

In the tool

Notion Enterprise can restrict members to an approved list of AI apps. Miro Enterprise keeps its MCP server off until an admin enables it. Asana Enterprise+ can allow or block MCP clients through app management. Storyflow has no equivalent switch: each member decides for their own account, within the projects they can already reach.

What a small team can do without a console

Write a one-page rule and agree it: which assistants are allowed, read-only by default on client projects, write only on picked projects, and a shared monthly audit. A rule everyone follows beats a console nobody configured. Our guide to AI connectors for agencies and client work has a version written for client contracts.

Prompts You Can Copy to Test a Connection Safely

Run these in order the first time you connect anything. The examples use Storyflow; swap the nouns for other tools.

The last line of the boundary test matters most. If the assistant can open a project you did not pick, disconnect and connect again.

What Safety Costs: Plans That Gate the Controls

Some controls come with every plan. Others sit behind a paid tier. This table lists what we could confirm.

Storyflow is paid-only during early access; its Free plan launches before the end of 2026, and anyone a paid member invites to a board joins free now. An invited free account gets 25 connector actions a week, counting every read and change, and the permission controls are the same as on paid plans.

Where the real cost is

It is time, not money. Narrow scoping costs you a reconnect when a new project starts. A monthly audit costs 15 minutes. Those are the prices of the controls that work on every plan.

Decision Rules: Which Setup Fits Your Situation

Use the first rule that matches.

You work alone on your own material

Connect with picked projects and changes allowed on the one you are building. Read-only on the rest. Audit monthly.

You hold client work under NDA

Never include NDA projects in a write connection. Prefer leaving them out entirely; if you must query them, use a separate read-only connection and remove it when the job ends. Check your contract: some forbid sending client material to any AI service, and no connector setting changes that.

You run a team of three to ten

Agree the one-page rule above, and give each person their own connection with their own scope. Do not share one login or one personal key across the team, because you lose the ability to revoke one person.

You run a company with an IT function

Start from admin controls: pick tools whose connectors can be allowed, blocked or switched off centrally, and pilot with read-only connections. Storyflow is the wrong first choice on that criterion.

You are trying a connector you have never heard of

Check the domain, connect read-only with the smallest scope offered, run the first four test prompts, and remove it the same day unless it earned a place.

Common Mistakes That Make a Safe Connector Unsafe

Each of these is a permission mistake you make yourself, with no attacker involved.

Mistake 1: accepting the default scope

Defaults favour convenience. On Storyflow's sign-in page All my projects is preselected. On other tools the default is everything your account can reach. Change it before you approve.

Mistake 2: clicking Allow always on a write tool

Allow always turns a per-action check into no check. Anthropic's advice is to reserve it for a server and tool you trust to run unsupervised. Keep it for read tools.

Mistake 3: mixing web browsing with a write connector

Browsing brings in untrusted text; a write connector supplies the means to act. That is two of the three injection ingredients in one chat. Use separate conversations.

Mistake 4: trusting a tool's own label

A tool that describes itself as read-only is making a claim. The MCP specification tells clients to treat such labels as untrusted unless the server is trusted, and OpenAI warns that writes can occur from tools tagged read-only. Trust comes from the vendor, and the limit comes from your scope.

Mistake 5: removing the connector in only one place

Removing it from the assistant hides it from your chats. Revoking it in the tool ends the access. Do both.

Mistake 6: sharing a personal key

Personal keys exist for tools that cannot run a sign-in. In Storyflow they last 30 days and are shown once. A key pasted into a shared document is a connection anyone with that document can use until it expires.

Mistake 7: treating read-only as private

Read-only stops changes. It does not stop what was read from appearing in the conversation, where your assistant's own retention and training settings apply. Check those settings once per assistant.

When Storyflow Is Not the Right Choice

Storyflow ranks first on our small-team weighting. Several real situations call for something else.

You need an admin to control what the team connects

Storyflow has no organisation-level switch for connectors. Google Workspace in Claude, Miro Enterprise, Notion Enterprise and Asana Enterprise+ all document one.

You need certifications and a long record

The server launched in October 2026. If procurement requires a multi-year track record or published audit reports, this guide makes no such claim for Storyflow, and the incumbents have had years longer to build theirs.

You need per-tool switches on the server side

You cannot disable individual Storyflow tools from Storyflow. The choice there is read-only or changes. Finer control lives in your assistant's tool menu.

You need a free setup today

Storyflow is paid-only during early access. A Free plan launches before the end of 2026; until then the only free path is being invited to a board by a paid member.

Your work is not visual planning

Storyflow holds boards, tables, documents and decks for creative projects. It does not send email, publish or schedule posts, send call sheets, invoice or run formal approvals. If the job is issue tracking, Linear's read-only address is the better-matched tool; if it is mail and files, Google Workspace is.

You need native apps or offline work

Storyflow runs in the browser only.

Template: A Connector Permission Register You Can Copy

Paste this into a Storyflow table, a spreadsheet or a document, and fill one row per connection.

The register

The one-page team rule

1. Allowed assistants are named here, and nothing else is connected to client work.
2. Client projects are read-only by default.
3. Write access is granted per project, for the length of the job.
4. NDA projects are never in a write connection.
5. Nobody shares a login or a personal key.
6. The register is reviewed on the first Monday of each month.
7. Anything unused for 30 days is removed.

You can ask your assistant to build the register for you once Storyflow is connected: "Create a table on the Studio Ops board with these ten columns and add one row for each connector I describe." It will use the table tools and the result appears on the board while you watch.

The Bottom Line

ChatGPT connectors are as safe as the permission you give them. Trust the vendor by checking the domain, grant the narrowest scope that does the job, prefer read-only until you are building something, and know where the off switch is before you need it. No assistant maker claims prompt injection is solved, so the limit you set at sign-in is the protection that holds when everything else fails.

On permission design for a person or a small team, Storyflow's MCP server came first in our comparison because the three choices that matter (which projects, read or write, and when it ends) are on its sign-in page, and the exit works within a minute. For an organisation that needs central control, Google Workspace in Claude, Miro Enterprise and Notion Enterprise are the stronger designs, and Storyflow says so itself by not having that console. Connect it from the Storyflow MCP page, pick two projects, leave changes off for a week, and run the test prompts above.