Claude plugin auto-connect goes live: no more authorization pop-ups, but the hassle is pushed to developers

Claude MCP plugins can now connect automatically when users sign in. On November 3, the Claude developer account announced this update: as long as an MCP server accepts Claude as a trusted issuer, users can automatically connect to plugins after signing in to Claude, without having to search for, sign in to, and authorize each one individually.

MCP is the protocol that lets Claude connect to external tools and data. In the past, for an enterprise member to use a plugin, they usually had to find it themselves and go through an OAuth authorization flow. Now admins can set up plugins for the entire organization.

This mechanism is called Enterprise Managed Auth, or EMA. It is built on an open extension to MCP. Admins can connect plugins for the entire organization through the company's identity provider. Members do not need to search for, sign in to, and authorize each plugin themselves.

If the organization's identity provider does not support EMA, Claude can also vouch directly for each signed-in member. After an admin configures a plugin, eligible members in the organization can connect automatically. Claude's ability to issue its own identity assertions is also in beta.

Currently, this auto-connect feature is in beta on Team and Enterprise plans. The support list includes Amplitude, Apollo.io, Atlassian, Datadog, Dropbox, Figma, Granola, HubSpot, Linear, Mixpanel, Notion, PagerDuty, Semrush, and Supabase.

For developers, this is not just adding a switch. For a plugin to support this auto-connect, the authorization server needs to accept JWT bearer grant, i.e. RFC 7523, and verify identity assertions issued by Claude or the customer's identity provider. The developer docs list the checks: issuer, signature, typ, audience, client_id, subject, time window, and jti replay protection.

In replies, one developer noted that MCP servers that require no authorization at all do not need this. Servers using lazy authentication can return 401 and WWW-Authenticate on protected tools; Claude will perform a silent exchange and retry, and no longer show the Connect card.

Regular users are not covered for now. Someone said outright that this brings nothing new for most people using Claude today, because the feature is only for Enterprise and Team customers. Others asked whether users can see which servers are connected or whether they just appear. Others raised a more practical need: please allow one connector to be bound to multiple accounts.

Claude is becoming a sign-in entry point. At least in Team and Enterprise plans, it not only hosts plugin execution but is also starting to be responsible for sending members into other tools. For admins, this change saves work; for developers, it is an overhaul of the authorization chain; for regular users, they will still have to wait.

Update frequency was also joked about. Two cat images kept appearing in replies, with captions roughly saying: you wake up, and Claude has updated again.

Cat wearing a tinfoil hat, with caption saying you wake up and there is another Claude update

Gray cat standing in a loop of arrows, with caption saying another Claude update has just been released