Integrations

Connect Haven to Claude

Connect your Haven team to Claude, then manage members, seats, Protected sites and policy by asking for it in plain language. Claude acts as you, on your team only, using the Haven account you already sign in with.

For Haven team owners and admins Time About 5 minutes You need Owner or admin on a Haven team
On this page
  1. Before you start
  2. The address you need
  3. Connect in Claude
  4. Connect in Claude Code
  5. What you can ask for — people, policy, groups, directory, reporting
  6. If you run several teams
  7. Access and disconnecting
  8. Troubleshooting

Before you start

Worth two minutes so the connection behaves the way you expect.

Haven publishes an MCP server — a standard way for an AI assistant to use a service on your behalf. Connecting it lets you run your Haven team from a Claude conversation instead of clicking through account.starthaven.com. Everything it can do, the portal's admin pages can do too.

You need to be the owner or an admin of a Haven team, and you sign in with the same Haven account you use for the account portal — Google, or email and password. Both work.

Haven not set up yet? Start with Set up your Haven organization first — everything below assumes a team already exists.

What Claude can do

  • See and manage your members, seats, roles and invitations
  • Add seats to your subscription, which increases what you pay if your seats are billed
  • Change your protection policy and enforcement mode, which affects every member's browser
  • Manage your groups, Protected sites and allowed extensions
  • Read your security reporting, such as which sensitive sites were visited and by whom
  • Disconnect your Workspace directory, and map and sync its groups

What it cannot do

  • Touch any other organization's data. It can only act on teams you already administer
  • Read your full browsing history or the contents of pages. The reporting it can see is the same coarse telemetry your console already shows you — a site name, a category, a verdict
  • Give itself access you do not have. It acts as you, with your role
  • Change your plan, cancel your subscription, or delete your account
  • Change your Haven password, or sign anyone in

The address you need

One value. Both setup paths below use it.

Haven MCP server Production
https://account-mcp.starthaven.com
Connector name Haven
Transport HTTP
Sign in with Your Haven account — Google, or email and password
Sign-in page account.starthaven.com
Claude sends you here to approve the connection. Haven never asks for your password inside Claude.
Use the address exactly as written

Paste the address with no extra path on the end. The server publishes that exact hostname as its own identity, so a connection registered at any other address is refused during setup rather than half working.

Connect in Claude

Claude on the web or the desktop app. Custom connectors need a paid Claude plan.

  1. Open Claude and go to:

    Settings › Connectors › Add custom connector

  2. Name it Haven and paste the server address:

    https://account-mcp.starthaven.com

  3. Click Add, then Connect. Claude opens Haven's sign-in page in your browser.

  4. Sign in with your Haven account, the same way you sign in to the account portal.

  5. Read the approval screen — it names the account Claude will act as and lists exactly what it will be able to do — then click Connect Claude.

  6. You land back in Claude with the connector enabled. Ask "which Haven team am I signed in to?" to confirm it works.

Connect in Claude Code

Same server, same sign-in, from the terminal.

Register the server once:

claude mcp add --transport http haven https://account-mcp.starthaven.com

Then start Claude Code and run /mcp. Pick haven and choose to authenticate — your browser opens on the same Haven sign-in and approval screen as above. Once it says connected, the Haven tools are available in that session.

Where the connection lives

The approval is tied to your Haven account, not to a device. Connect from Claude on the web and from Claude Code separately if you use both.

What you can ask for

Ask in your own words. These are the areas behind the answers.

You do not need any of the names below — "invite jo@acme.com as an admin" is enough. They are here so you know the reach. Anything you can configure in the Haven console, you can ask for here.

People and seats "who is on my team?"
See your team Members, roles, seat numbers, email aliases, and invitations that have not been accepted
Invite and remove Invite by email as a member or admin; invitations expire in 7 days. If every seat is taken, inviting adds a seat automatically, which increases what you pay if your seats are billed, and Claude tells you when it does. Removing someone does not reduce your seat count, and the owner cannot be removed
Fix mistakes Change someone's role, correct their display name, or correct a mis-typed invitation address — which reissues it, so the original link stops working
Seats and aliases Add seats, which increases what you pay if your seats are billed. Register a teammate's other email so Haven recognizes mail from it as internal — they confirm it themselves, and it is not a way to sign in
Protection policy "what are we enforcing?"
See everything at once Your enforcement mode, the categories and sites your organization requires, allowed extensions, and which optional features are on
Enforcement mode Switch between Monitor-Only and Active Enforce — see the warning below
Required Everything on your Protected sites list is Required by your organization: always Protected for everyone it reaches, and members cannot switch it off
Protected sites Read and change your Protected list, for the organization or one group: add or remove a category or a site Haven knows, or untick single sites inside a category. Everything on it is Required for your members. Add or remove your own sites too, up to 30
SaaS and AI usage reporting Turn SaaS and AI usage reporting on or off for a site Haven already knows about. A site you do not change keeps Haven's setting
Optional features Turn an optional feature on or off for your team or for one group, or set it back to Haven's default. A feature you have never set follows Haven's default, which is not the same as off. Two features change what members' browsers do — the extension deny list and on-device link analysis — so Claude asks you before turning either on
What one member gets For one member or one group: which sites are Protected and why (required by your organization or a group, or on by default), the extensions allowed, the enforcement mode and features. Every other site Haven knows is Verified. Ask "why isn't Chase Protected for Alex?" and Claude reads the answer from the same resolution their browser uses. Claude's answers may still use Haven's older labels for now: a site marked shielded is Protected, and protected, verified-only or identity-only on their own mean Verified. The field names are unchanged
Extensions Allow a browser extension so it keeps running while a Protected site is open, remove one, and approve or turn down the requests your team sends you. Your first allowed extension starts your own allow list, which pauses every other extension on Protected sites, password managers included, so Claude asks you first

These map directly to the Policy page in the console — see Choose what Haven protects for how Required sites work.

Enforcement mode changes every member's browser

In Monitor-Only, Haven watches and records but does not interrupt anyone. In Active Enforce, it acts — blocking, warning, and pausing extensions on Protected sites (banking, tax, government, state-portal and healthcare sites by default, and any others you make Protected or add). Moving to Active Enforce is the single biggest change you can make by asking, and your team feels it immediately. Ask Claude what the current mode is before you change it.

If your team is inside a monitor-first trial period, the switch to Active Enforce is refused until that period ends. Claude will tell you when it lifts. Switching back to Monitor-Only is always allowed.

Setting policy replaces it

Changing the enforced policy writes the whole thing at once — the lists you end up with become the entire policy, not an addition to it. The same is true of a group's policy, and of your per-site usage reporting settings, where a site you leave out goes back to Haven's setting. Ask Claude to show you the current policy first, and to confirm the full list back to you before it writes. It will tell you which entries a change removed.

Groups "give the finance team stricter rules"
Create and organize Make a group, rename it, add and remove members. Deleting a group also deletes the policy attached to it — Claude will tell you what it removed
Per-group policy A group can have its own enforcement mode, Protected categories and sites, allowed extensions, optional features, and per-site usage reporting settings
Groups mostly tighten A group's rules can make it stricter than your team. Setting a group to Monitor-Only will not relax a team that is enforcing, and a group's Protected categories and sites are added to the team's rather than replacing them. Allowed extensions go the other way: a group's list adds to your team's allow list for that group's members, and does nothing until your team has an allow list of its own. Per-site usage reporting is the other exception: a group's own reporting setting for a site replaces your team's for that group's members, and someone in groups that disagree gets the stricter one

See Groups and Google Workspace for how group policy interacts with your organization-wide settings.

Workspace directory "sync my Google groups"
Check the connection Whether a directory is connected, which domain and admin it uses, when it last synced, and which of your Google groups are mapped to Haven groups
Map and sync Map a Google group to a Haven group. A mapping replaces that group's members with the people in its Google groups, including anyone you added by hand, so Claude first shows you who would be added and removed, by name, and waits for your go-ahead. Then sync one group or all of them. People in a Google group who are not yet Haven members are skipped, and Claude will list them so you can invite them
Disconnecting is one-way Claude can disconnect the directory, but it cannot reconnect one — that needs you at a browser to approve Google's consent screen again. Your groups and their members stay as they are; they simply stop syncing

This is the same connection covered in Groups and Google Workspace — Claude can check and sync it, but the initial Google consent screen still needs a browser.

Reporting "what's our security posture this week?"
The overview How much of your team has Haven installed, who is carrying a risky extension, and activity across the org — then ask who is behind any number
The Browser Risk Report The report you would take to a review: coverage, risky extensions and who has them, sensitive sites visited, link verdicts, campaigns hitting more than one person, out-of-date browsers, and what to do about it
One person A member's installed extensions and the individual phishing warnings and paused downloads behind their totals
SaaS and AI apps Which tracked apps your team uses — Slack, ChatGPT and the like — how many people use each, their active time, and who. Only time since you turned usage reporting on counts. Someone with no recorded use may simply not have Haven running in that browser, so it is not proof they do not use the app
This is the part worth connecting for

Reporting is where asking beats clicking. "Compare this month's risky extensions to last month, and tell me which of them are on more than two machines" is one question here and a lot of clicking in the console.

Claude sees the same coarse telemetry your console does — a site name, a category, a verdict — never a full browsing history or the contents of a page. And when a part of a report cannot be loaded, Claude will say so rather than reporting a zero, so an outage never looks like a clean week.

If you run several teams

Skip this if you administer exactly one team, which is most people.

Managed service providers and anyone owning more than one organization can reach each of them from the same connection. Two things make that safe:

  • Claude never guesses which team you mean. Ask it to do something without naming one and it lists your teams and waits, rather than picking the first.
  • Every answer names the team it acted on. If the wrong name comes back, you know before the next request.

Start with "list my Haven teams", then name one in each request: "in Globex, who has an admin role?". A name Haven does not have you down as administering is refused, and nothing is sent.

Nothing is remembered between requests. There is no current team to get out of step with what you meant, which is deliberate.

Access and disconnecting

Who Claude is when it acts, and how to stop it.

Claude acts as you. It carries your own Haven sign-in, so it has exactly your permissions on exactly the teams you administer, and Haven checks that on every single request — not once at setup. If your role is reduced or your access ends, the connection loses the same access at the same moment.

To disconnect:

  • Remove the Haven connector in Claude's connector settings, or run claude mcp remove haven in Claude Code. That ends it for that Claude.
  • Haven has no switch that disconnects every Claude at once, so remove the connector in each Claude you added it to.

Troubleshooting

The five things that come up most often.

Claude will not add the connector, or setup fails right after I paste the address

Almost always the address. It must be exactly https://account-mcp.starthaven.com, with no trailing slash, no path, and no other hostname. The server publishes that hostname as its own identity, so Claude refuses a connection registered at a different one.

Custom connectors also need a paid Claude plan. If Add custom connector is missing from Claude's settings, that is why.

Claude says I do not administer any team

The connection works and you are signed in — Haven simply does not have you down as an owner or admin of a team. Two common reasons: you are a member rather than an admin, or you signed in with a different account from the one that runs your team.

Ask Claude which account it is signed in as. If it is the wrong one, remove the connector and connect again with the right account. If it is the right one, ask an owner or admin of your team to give you admin access.

I signed in to Haven but Claude still says it is not connected

The approval screen was not completed. Signing in is only the first half — the connection is made when you click Connect Claude on the screen that lists what Claude will be able to do.

Start the connection again from Claude and follow it through to that button. If the browser tab was closed early, nothing was granted.

Claude acted on the wrong team

This is possible only across teams you genuinely administer — Haven refuses anything else. Every answer names the team it acted on, so check that line first.

Name the team in each request rather than relying on a default: "in Globex, invite jo@acme.com". Ask Claude to list your teams if you are not sure of the exact names.

Will Claude add seats or spend money without asking?

Adding seats, and inviting someone when every seat is taken, both grow your seat count, which increases what you pay if your seats are billed. Both are things you asked for, and Claude tells you what it did, but neither needs a second confirmation step from Haven.

If you want to be sure, ask for your seat count before inviting: "how many Haven seats are free?"

Still stuck?

Tell us what you asked Claude, what came back, and the email address you signed in with, and we will help you sort it.

Contact Haven support