What changes here
How Claude Code creates this exposure
Claude Code is a local or cloud coding agent with file, command, network, MCP, and editing capabilities governed by permissions, sandboxing, trust, and account settings.
A connector does not create data, but it can make existing account permissions available through a new interface. The safe question is not only whether the connector is trusted; it is whether the connected account is broader than the task requires.
MCP servers and hooks can expose local commands, files, APIs, tokens, and external services to the agent.
The exposure path
Three steps from useful context to avoidable risk
- 1
Context enters
MCP servers and hooks can expose local commands, files, APIs, tokens, and external services to the agent.
- 2
Access carries it
Claude Code may use repository and local file reads, edits and Bash commands, or network access, MCP servers, hooks, and cloud environments, depending on the surface and settings.
- 3
A real consequence becomes possible
A personal connector may expose private mail, files, contacts, calendar details, browsing context, or shared documents that were never intended for the current conversation. A business connector can turn an over-privileged account into a broad retrieval or action surface spanning customers, employees, projects, and internal operations.
Who should care
Why this matters for individuals and teams connecting AI to email, storage, messaging, calendars, workspaces, or internal systems
A personal connector may expose private mail, files, contacts, calendar details, browsing context, or shared documents that were never intended for the current conversation.
A business connector can turn an over-privileged account into a broad retrieval or action surface spanning customers, employees, projects, and internal operations.
This page does not claim that Claude Code has exposed your information. It shows the access conditions that make a review sensible before the next sensitive task.
Warning signs
Pause before adding more access
The authorization screen requests broad scopes and nobody recorded why each one is needed.
Read, create, edit, share, send, and delete actions are enabled together by default.
A connector remains active after a project ends or after the user’s role changes.
Five-minute safe check
Check Claude Code without exposing more data
Review .mcp.json, managed settings, hooks, server commands, scopes, transports, and trust prompts.
Review the connector’s exact scopes in both the AI tool and the source service.
Test with a limited account containing synthetic data before connecting a primary mailbox or drive.
Confirm how to disconnect, revoke tokens, remove indexed copies, and review prior actions.
Reduce the risk
Controls to apply now
Remove unknown servers and sandbox each remaining integration with narrow paths and network destinations.
Use a least-privilege account or service identity created for the specific workflow.
Separate read-only retrieval from write, send, share, delete, and financial actions.
Set a recurring owner and expiry date for every connector rather than leaving access permanent.
Review permission mode and deny rules.
Review filesystem and network sandbox.
Review trusted directories, mcp servers, hooks, and unsandboxed escape paths.
Decision rule
When CapitalGuard is the right next step
If the assistant has no connectors, document that and keep it true. If it can retrieve or change business data across services, create an access map before adding another integration.
CapitalGuard focuses on repository and tool-connected exposure: what an AI workflow can read, change, execute, trust, or transfer. It does not inspect your private Claude Codeaccount from this page, replace the provider's privacy controls, or guarantee that an incident can never happen.
Primary references