Claude Connector Directory Submission: Requirements, Annotations, and How to Pass Review (August 2026)

TL;DR: Submit remote MCP servers and MCP Apps through Claude.ai organization settings. You need a Team or Enterprise organization plus Directory or Libraries permission. Every tool needs a title and the correct readOnlyHint or destructiveHint; authenticated services need a supported OAuth flow; MCP Apps need three to five reproducible screenshots. Test every tool with MCP Inspector and as a custom connector in Claude, using a populated reviewer account. Most accepted servers start as community connectors, and Anthropic may later select them for verified review.

---

Publishing a Claude Connector is now an in-product release process, not a form you fill out after a quick MCP smoke test. The Claude.ai portal connects to your production server, reads its tools, prompts, resources, and annotations, collects the listing and compliance data, and asks you to confirm that every tool works.

The requirements also cover more than protocol validity. Anthropic checks who owns the API, how users authenticate, what data the connector handles, whether tools match their descriptions, whether write actions are marked correctly, and whether a reviewer can use the product with the account you provide.

This August 2026 guide covers the current portal, review labels, OAuth modes, tool metadata, MCP App assets, automated tests, and post-publish operations.

Choose the Right Distribution Type

Claude has related distribution paths, but they are not interchangeable.

What you built	Where it runs	Submission path
Remote MCP server	Claude.ai, Desktop, mobile, Cowork, and Claude Code	Claude.ai Directory portal
Remote MCP server with MCP App UI	The same remote surfaces, with interactive UI where supported	Claude.ai Directory portal plus MCP App screenshots
Local MCP server packaged as MCPB	Claude Desktop	Desktop extension submission form
Plugin with Skills, commands, or connector references	Claude Code and Cowork	Plugin directory

A package published only to npm or PyPI is not a directory-ready local connector. Package a local server as MCPB or include its configuration in a plugin. A Skill cannot be submitted as a standalone connector; Skills ship inside plugins.

Anthropic currently recommends a remote MCP server for the live tool surface and, when useful, a plugin that wraps that server with Skills and commands. If users install both, Claude still sees one tool surface because the plugin points at the same MCP server URL.

Get Access to the Submission Portal

Remote MCP submissions now happen inside Claude.ai under organization admin settings. Before starting, you need:

• A Team or Enterprise organization. Individual plans do not have the required admin settings.
• Directory management access. Owners and Primary owners have it by default.
• On Enterprise, a custom role with Directory permission or the broader Libraries permission if an owner delegated the work.

This access requirement is separate from testing. Any Claude account can add a custom connector, so engineers can run real-host checks before someone with directory permission handles the release.

The portal saves progress within the browser session and walks through ten areas:

1. Introduction and distribution scope.
2. Production HTTPS URL, Streamable HTTP or SSE transport, and URL tenancy model.
3. Tools, prompts, resources, titles, and annotations synced from the server.
4. Public listing metadata and permanent slug.
5. Use cases and user prerequisites.
6. Company and review contacts.
7. Authentication mode.
8. Data handling, API ownership, health data, and sponsored content.
9. Test account, launch instructions, and completed test confirmation.
10. Policy and directory-term compliance.

The listing fields have practical limits: the server name can be 100 characters, the tagline 55, the description 2,000, and you can choose one to five categories. Prepare the documentation URL, privacy policy, support contact, icon, and test credentials before opening the portal. For an MCP App, prepare the screenshot set too.

Understand Community and Verified Review

The directory now distinguishes community connectors from verified connectors.

When you submit a server, Anthropic scans it for policy compliance. A passing server normally enters the directory as a community connector. Anthropic may then identify highly useful listings for a slower, higher-touch verified review. In that review, testers exercise every tool.

You do not apply separately for the verified label. The label is a directory trust signal and does not change the MCP runtime, available tools, or authorization model.

Every listing still has to meet the same published review criteria. Build to the verified bar even if the first listing is community, because accurate tools, stable auth, and clear errors are product requirements, not badge requirements.

Make Tool Metadata Pass the First Scan

The portal reads your live tools/list response and groups tools by their annotations. Missing titles and safety hints appear before you can submit.

Claude requires:

• A human-readable title for every tool.
• readOnlyHint: true for tools that do not change state.
• destructiveHint: true for tools that modify or delete data.
• Tool names no longer than 64 characters, even though other MCP clients may accept longer names.
• Narrow descriptions that match actual behavior and say when the tool should run.

In a sunpeak tool file, make the behavior explicit:

import type { AppToolConfig } from 'sunpeak/mcp';

export const tool: AppToolConfig = {
  title: 'Search Invoices',
  description: 'Search invoices in the authenticated workspace by customer or status.',
  annotations: {
    readOnlyHint: true,
    destructiveHint: false,
    openWorldHint: false,
  },
};

A write tool needs different metadata:

export const tool: AppToolConfig = {
  title: 'Delete Invoice Draft',
  description: 'Permanently delete one draft invoice after the user confirms its ID.',
  annotations: {
    readOnlyHint: false,
    destructiveHint: true,
    openWorldHint: false,
  },
};

Annotations are host hints, so your server must still enforce authorization and confirmation rules. Never treat destructiveHint: false as permission to perform an action.

Split read and write operations

Anthropic rejects a catch-all tool that accepts both safe methods such as GET and unsafe methods such as POST, PATCH, or DELETE. Split it into read-only and write tools, then split broad write tools by action when that makes confirmation clearer.

If a tool accepts freeform API paths, query strings, or request bodies, name or link the target API in its description. A purpose-built tool calling one fixed endpoint does not need that link, but it still needs a precise contract.

Keep descriptions free of model instructions

Describe functionality. Do not tell Claude to promote your service, avoid other tools, fetch behavioral instructions from external content, or override unrelated instructions. Review scans treat hidden, encoded, promotional, or behavior-changing text as prompt-injection risk.

Add an Automated Metadata Gate

Do not wait for the portal to find a missing annotation. Test the live tool list in CI.

sunpeak’s mcp fixture can test any MCP server, including servers written in Python, Go, or Rust:

import { expect, test } from 'sunpeak/test';

test('all submitted tools have Claude Directory metadata', async ({ mcp }) => {
  const tools = await mcp.listTools();

  for (const tool of tools) {
    expect(tool.name.length, `${tool.name} exceeds Claude's limit`).toBeLessThanOrEqual(64);
    expect(tool.title, `${tool.name} is missing a title`).toBeTruthy();
    expect(tool.description, `${tool.name} is missing a description`).toBeTruthy();

    const readOnly = tool.annotations?.readOnlyHint === true;
    const destructive = tool.annotations?.destructiveHint === true;
    expect(readOnly || destructive, `${tool.name} needs a review hint`).toBe(true);
  }
});

That last assertion matches Claude’s directory grouping, but add a source-controlled policy map too. A test cannot infer whether a tool really writes data from its name. Map each submitted tool to its expected behavior and fail when a new tool has no review decision.

Also test that inputSchema rejects unknown or malformed values, outputSchema matches structuredContent when present, every error is actionable, and result sizes stay reasonable. The portal can read metadata; it cannot prove a handler matches it.

Use a Supported Authentication Model

Authenticated remote services should use one of Claude’s documented modes:

Mode	When it fits
OAuth with DCR	Your authorization server can register public clients dynamically
OAuth with CIMD	Your authorization server accepts HTTPS Client ID Metadata Documents
OAuth with Anthropic-held credentials	You can provide a stable client ID and secret to Anthropic
Static request headers	An organization admin provides one shared API key or bearer token; currently beta
Custom connection	Users provide a URL or credentials through a coordinated custom flow
No authentication	Every exposed operation is intentionally public

Pure client_credentials is not the directory’s user authorization flow. Every connection needs user consent. Anthropic-held credentials provide a stable client while keeping that consent step.

For hosted Claude surfaces, register:

https://claude.ai/api/mcp/auth_callback

Claude Code uses localhost and 127.0.0.1 loopback callbacks with an ephemeral port. If you support Claude Code, accept both registered loopback hosts with port-agnostic matching.

Make discovery unambiguous

Return an actual 401 Unauthorized with a WWW-Authenticate challenge. Claude does not honor the challenge on a 200 response.

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Bearer resource_metadata="https://mcp.example.com/.well-known/oauth-protected-resource/mcp",
                         scope="invoices:read"

The resource in protected resource metadata must match the MCP server URL exactly as users enter it, including its path. List the primary authorization server first because Claude currently uses the first entry. The identity provider’s discovery endpoints must be reachable from Anthropic’s egress network, not only from your office or browser.

Claude supports S256 PKCE. Its token exchange and refresh requests use application/x-www-form-urlencoded, while Dynamic Client Registration uses JSON. Test both parsers. Claude refreshes reactively after a 401 and can refresh shortly before stored expiry, so return standard OAuth error codes and rotate or sender-constrain refresh tokens for public clients.

Directory connectors share one OAuth application across customer organizations. User permissions still scope the data, but do not assume each enterprise gets a separate client ID. A custom connector can use organization-specific static OAuth credentials, which is a different deployment model.

Verify Transport and Network Security

The production URL must use HTTPS. Prefer Streamable HTTP; Claude still supports legacy HTTP+SSE, but documents it as being deprecated.

Test the transport at the exact URL submitted to the portal:

• initialize, tools/list, and every tools/call complete through the public proxy.
• The server handles the Accept values Claude sends.
• OAuth metadata and token endpoints respond quickly; Claude’s testing guide recommends keeping metadata endpoints under five seconds.
• The CDN, WAF, and identity provider allow Anthropic egress.
• Redirects preserve method, body, and authorization behavior.
• Logs correlate initialize, auth, tool, and resource failures without recording secrets.

The MCP transport requires Origin validation. If an Origin header is present and invalid, return 403 Forbidden. Test allowed, missing, malformed, and disallowed cases. Do not write a browser-only rule that rejects legitimate Anthropic requests, because an overstrict Origin allowlist is a documented cause of Claude initialize failures.

Meet Data and Policy Requirements

The portal asks whether the MCP server calls your own API, a partner API you may proxy, or a third-party API you do not control. Your server domain should match your service, and you need a legitimate basis for every upstream connection.

Review also checks that tools:

• Collect only data needed for their stated function.
• Do not query Claude’s memory, chat history, conversation summaries, or user files.
• Return scoped, paginated results instead of large unfiltered dumps.
• Validate input and return useful errors rather than generic 400 or 500 messages.
• Do not transfer money, cryptocurrency, or other financial assets.
• Do not generate AI images, video, or audio. Tools that produce diagrams, charts, or UI mockups are allowed.

Publish documentation by the listing’s launch date. A help-center article or blog post is enough if it covers setup, required plans, auth, example prompts, expected outcomes, known limits, privacy, and support.

Local MCPB submissions have additional privacy packaging rules: a Privacy Policy section in README.md, a privacy_policies array in manifest.json, manifest version 0.2 or later, and HTTPS policy URLs. The policy needs to cover collection, use, storage, sharing, retention, and contact information.

Prepare MCP App Assets and UI

An MCP App submission needs three to five PNG screenshots. Each must be at least 1000 pixels wide, cropped to the app response, and paired with the exact prompt separately in the portal. One set covers all surfaces; do not submit video or GIF assets.

Generate screenshots from deterministic data so reviewers can reproduce them with the supplied account. Show the main use cases, not five cosmetic variants of the same state.

The app itself should meet Claude’s current design guidance:

• Reflow from 320 pixels through fullscreen without horizontal scrolling.
• Keep inline cards focused, avoid nested scrolling, and expose no more than two bottom actions.
• Make touch targets at least 44 points.
• Honor hostContext.safeAreaInsets so controls stay clear of mobile navigation and the composer.
• Avoid deep navigation, breadcrumbs, clipped popovers, and duplicate chat inputs.
• Declare external origins in _meta.ui.csp; external origins are blocked by default.
• Expect frameDomains to require Claude security review.
• Keep useful model-readable output for clients or states where UI is unavailable.

If the app calls ui/open-link, list HTTPS origins and custom schemes you own as allowed link URIs. Claude matches an HTTPS entry by scheme and hostname, ignores paths and ports, and does not include subdomains automatically. Undeclared links still work, but the user gets a confirmation prompt.

Build the Reviewer Test Matrix

There is no separate Claude staging runtime. Add the server as a custom connector under Settings > Connectors, which uses the same runtime as a directory connector. Any Claude plan can run this test.

Before that live pass, use MCP Inspector to check protocol and OAuth, then automate repeatable behavior with sunpeak’s MCP testing framework. For any existing MCP server:

npx sunpeak test init --server https://staging.example.com/mcp
npx sunpeak test

For each tool, cover:

Case	Expected behavior
Valid, typical input	Correct scoped result and useful model-readable text
Boundary input	Valid empty, first, last, or maximum-size behavior
Invalid input	Actionable tool error that helps Claude correct arguments
No matching data	Honest empty state, not a server failure
Missing permission	Clear authorization error with no leaked data
Upstream timeout or rate limit	Bounded retry and a useful failure message
Repeated write	Idempotent outcome or an explicit duplicate guard
Different user or tenant	No cross-user or cross-tenant data

For MCP Apps, add simulation fixtures for loading, populated, empty, error, denied, reconnect, and post-action states. Run E2E and visual tests across the Claude runtime, light and dark themes, inline and fullscreen where supported, and mobile widths. Keep a live Claude smoke test for connection, OAuth, model tool choice, host-specific UI, and reviewer prompts.

Give Reviewers a Real Account

Directory submission requires credentials and setup instructions for a fully populated test account. An empty shell makes correct search and list tools look broken.

Prepare an account with:

• Realistic but non-sensitive sample records.
• At least one object for every read, update, and delete path.
• The roles and scopes needed to test allowed and denied behavior.
• Stable IDs referenced by your example prompts.
• A reset procedure for destructive tests.
• No production customer data or reusable production secrets.

Write the instructions for someone who has never seen your product. Include every URL, credential field, workspace choice, consent step, and prompt. Run those exact instructions from a clean browser profile before submission.

After You Submit

Track status and reviewer feedback in the Claude.ai submissions dashboard. Review timing depends on queue volume, and mcp-review@anthropic.com is the escalation contact.

Choose the URL slug carefully. It becomes the permanent listing URL after publication:

https://claude.ai/directory/connectors/your-slug

You can edit listing metadata in the dashboard, but the slug does not change. The MCP server itself remains a live API: add, change, or remove tools by deploying the server, with no resubmission and no scheduled re-review. Claude reads the new tool surface on the next connection.

That flexibility makes regression tests more important after approval. Keep annotation, auth, tenant-isolation, result-size, UI, and live smoke tests as release gates. Monitor server health and usage in the directory dashboard, respond to security reports promptly, and keep public documentation accurate.

Submission Checklist

• Team or Enterprise organization and directory permission are ready
• The submitted URL is production HTTPS and Streamable HTTP works
• Every tool has a title, accurate description, and 64-character-or-shorter name
• Read-only and destructive annotations match actual behavior
• Read and write operations are separate tools
• Input, output, errors, pagination, and result sizes are tested
• Origin validation rejects invalid origins without blocking Claude
• OAuth discovery, PKCE, callback URLs, token exchange, and refresh work
• User and tenant authorization is enforced by the server
• Documentation, privacy policy, support contact, icon, and categories are ready
• Allowed link URIs include only origins and schemes you own
• MCP App screenshots meet count, width, crop, and prompt requirements
• MCP App UI works at mobile widths, in safe areas, themes, and display modes
• Reviewer credentials contain realistic sample data and reset instructions
• Every tool passed MCP Inspector, automated tests, and a custom Claude connection
• The permanent directory slug is approved internally
• Monitoring, security response, and regression ownership are assigned

Where sunpeak Helps

sunpeak is an MCP testing framework and MCP App framework. It can scaffold protocol, E2E, visual, and live tests around any MCP server, so a connector does not need to use sunpeak’s application framework to use its tests.

Use the local Inspector to render deterministic tool results in replicated Claude and ChatGPT runtimes, switch hosts, themes, display modes, and devices, and turn the same reviewer states into Playwright checks. That reduces manual reloads in Claude, avoids spending host credits on each code change, and gives CI a stable release gate.

Start with the Claude Connector framework, then use the pre-submission testing guide to turn this checklist into tests before opening the directory portal.