The MCP connector lets the Messages API call tools on a remote MCP server without you running an MCP client. Send the mcp-client-2025-11-20 beta header, describe the server in mcp_servers, and add a matching {"type": "mcp_toolset", "mcp_server_name": ...} entry in tools.
How it works
Each mcp_servers entry has type: "url", a url starting with https://, a unique name and, if needed, an authorization_token. Every server must be referenced by exactly one mcp_toolset in tools, and every toolset must name a server that exists. Declaring the server without the toolset is a validation error.
The API calls the server during the turn. The response holds an mcp_tool_use block and an mcp_tool_result block, not a tool_use block, so your code has nothing to execute or return. Each call names its server_name.
Choosing which tools Claude sees
Tool settings live on the toolset. default_config applies to every tool on the server, and configs overrides it per tool name. To allow only search_events and list_events, set default_config: {"enabled": false} and enable those two in configs. For a denylist, leave the default and set enabled: false on the tools you want hidden. You can also set defer_loading: true here to use tool search across large servers.
The deprecated mcp-client-2025-04-04 version put tool_configuration and allowed_tools on the server entry. Under the current header that configuration moves to the mcp_toolset.
Limits
Only MCP tool calls are supported, not prompts or resources. The server must be reachable over HTTP, using Streamable HTTP or SSE; a local STDIO server cannot be connected directly. You obtain and refresh OAuth tokens yourself. The connector is in beta on the Claude API, Claude Platform on AWS and Microsoft Foundry, and it is not covered by zero data retention. For local servers, prompts or resources, run your own MCP client and use the SDK's MCP helpers.
Where the exam catches people
Believing mcp_servers alone is enough: each server also needs a matching mcp_toolset entry in tools.
Believing a local STDIO server can be reached: the connector needs a public HTTP server.
Believing your loop must answer MCP calls: they arrive as mcp_tool_use with the mcp_tool_result already present.
Believing the allowlist goes on the server entry: under mcp-client-2025-11-20 it is default_config and configs on the toolset.