Abdur R Sayeed (@Abdur_sayeed) on X

What it claims

Abdur R Sayeed's post on X describes plugin auto-connect for Claude Team and Enterprise plans. An admin sets up a connector once for the whole organization. Each teammate is then connected automatically the first time they use the plugin, with no per-tool sign-in screen. The post lists 14 launch partners, citing ClaudeDevs: Amplitude, Apollo, Atlassian, Datadog, Dropbox, Figma, Granola, HubSpot, Linear, Mixpanel, Notion, PagerDuty, Semrush and Supabase. It quotes Boris Cherny of Anthropic on the goal: teammates are connected automatically the first time they use the plugins.

How it works

Claude issues a signed identity assertion itself (in beta), so no identity provider sits in the path. The connector's authorization server validates the assertion and returns an access token. The MCP server receives the same kind of token it would get after a normal OAuth flow. When the token expires, Claude renews it without the user signing in again.

sequenceDiagram
    participant C as Claude (org member check)
    participant A as Connector auth server
    participant M as MCP server
    C->>A: Signed identity assertion (beta)
    A->>A: Validate assertion, match user by email
    A-->>C: Access token
    C->>M: Call with standard OAuth-style token
    Note over C,A: Renewal repeats without user sign-in

How to use it

The post's advice to MCP server builders is to support enterprise-managed auth and keep access tokens short-lived. Because the MCP server gets an ordinary OAuth-style access token, the server-side change is in the authorization server: it must accept and validate Claude's assertion. The post gives no API shape, endpoint names or setup commands.

Limits

With Claude-issued auth, Claude checks only organization membership. It does not enforce SSO, MFA or the connector's own sign-in rules, and users are matched by email. A connector that relies on its own login policy loses that policy on this path. Tokens already issued stay valid after a user leaves the organization, so the access token lifetime sets how long a removed user keeps access. Anthropic's docs give one hour as an example of a short lifetime. Silent renewal means users never re-authenticate against the connector. The assertion feature is marked beta. The post is a short social summary of Anthropic's docs and does not link to or quote the specification.