These pages describe PrivacyFence 7.0.2. Download it · What changed

Connect claude.ai¶

claude.ai works with organization mode only. claude.ai connects to MCP servers from Anthropic's servers, not from your computer, so it needs a PrivacyFence it can reach over public HTTPS. A local install listens on localhost only and is unreachable from outside your computer, on purpose. Which deployment you have is explained in Local mode and organization mode.

Local mode¶

Not available. On your own computer, use Claude Desktop or Claude Code instead: both work with a local install on every platform they run on.

Organization mode¶

Your administrator gives you the deployment's URL, for example https://pf.example.com.

1. In claude.ai's connector settings, add a custom connector with the URL https://pf.example.com/mcp. Leave the optional OAuth client ID and secret empty: claude.ai registers itself.
2. Make sure the deployment's host, pf.example.com, is on claude.ai's domain allowlist. Without it, every file larger than about 75 KB and every upload fails after you approve it; see Files for where the list is and who can change it.
3. Click Connect on the connector and sign in with your organization account.
4. Connect your services at https://pf.example.com/connect.

On Team and Enterprise plans an owner adds the connector once for the whole organization, and each person connects it with their own sign-in. Access tokens last one hour and are refreshed silently; after 30 days you sign in again. Setting up the deployment itself is Organization deployment.

The connector always signs in as you, so it cannot use a scoped token. A scheduled Claude Code cloud routine that should run under a scoped token's rules uses its own cloud environment instead; see A cloud routine with a scoped token.

Files¶

A local path means nothing to the server, and claude.ai does not run PrivacyFence's Claude Desktop extension. Files travel through one-time links instead (ADR 0028):

• Upload (for example drive_upload_file, or an email attachment): claude.ai calls privacyfence_create_upload_slot, sends the file to the returned URL with an HTTP PUT, and passes the returned upload_id to the tool.
• Download (for example drive_download_file): a file of up to about 75 KB comes back in the tool result; a larger one becomes a short-lived, one-time link. claude.ai truncates a tool result over about 150,000 characters, which is why the default inline limit is well below that (ADR 0092).

Both need the host on claude.ai's domain allowlist. claude.ai opens a link and sends an upload from its own sandbox, not through the connector. That sandbox reaches only the domains on claude.ai's domain allowlist. If the deployment's host is not on the list, the approval goes through and claude.ai then reports that it cannot reach the site. PrivacyFence never sees the attempt (ADR 0097).

The allowlist is a claude.ai setting, not a PrivacyFence one, and it belongs to the claude.ai account, not to the connector:

• Team and Enterprise plans: a claude.ai Owner or admin sets it once for the whole organization, under Admin settings → Capabilities: turn on Code execution and file creation, allow network egress to additional domains, and add the host. Members cannot add a domain from their own settings, so ask your claude.ai admin.
• Pro and Max plans: you set it yourself under Settings → Capabilities, the same way.

The list appears only once Code execution and file creation is on.

To read a document, no download is needed. drive_get_file_content returns a PDF, Word, PowerPoint or Excel file's text, so claude.ai can read it whatever its network settings. A scanned PDF has no text; figures and layout are not in the text either.

Sizes, lifetimes and the organization settings are in Files and File delivery.

Confirmations¶

Two things can ask you before a tool runs:

1. claude.ai's own tool prompt. claude.ai can ask before it calls a tool from a connector, and decides from the tool's annotations. On the Team plan, a tool marked as a write prompts on every call and cannot be allowed for the whole task, and an organization cannot pre-approve it (ADR 0086).
2. PrivacyFence's approval card. A gated call waits for you at /approvals, whatever claude.ai was told or allowed. This is the confirmation that decides; see Approvals and policy.

PrivacyFence always tells the client what each tool does: reads are read-only, writes are writes, and the tools that delete something (calendar_delete_event, drive_sheets_delete_dimensions and peek_delete_page) are destructive (What the AI system is told). So claude.ai may ask before a write, in front of PrivacyFence's own card. There is no switch that advertises writes as read-only (ADR 0089). Where claude.ai offers to always allow a tool, allowing PrivacyFence's tools leaves PrivacyFence's card as the only confirmation; every call still goes through PrivacyFence's gate.

What we observed (claude.ai web, PrivacyFence 5.0.0a2, 2026-09-28, evidence): claude.ai asked before calendar_create_event. Choosing to always allow the tool stopped it asking, and PrivacyFence's approval card was still shown for the call.

How the client is identified¶

Every approval card and audit entry names the AI system that asked. claude.ai gives a name when it registers with PrivacyFence and again in the MCP handshake; the registered name is the one used when PrivacyFence recognises it. claude.ai registers as Claude, so the card says the caller says it is Claude. That name is a claim: the card says the caller says it is that system and marks it Not verified, because any program that can reach the deployment can register under the same name. When the registration carries only claude.ai's own callback (https://claude.ai/api/mcp/auth_callback), PrivacyFence shows it as Verified instead, with no administrator step. See Which AI system is asking and AI systems.

Troubleshooting¶

Deployment problems are in the organization guide's Troubleshooting.