You're offline, showing the last version we saved.
Build with AI · Using AI safely

Connecting AI to your systems: a beginner’s checklist

Connectors let AI read your live systems, which is useful and risky in equal measure. Here’s what they are, what can go wrong, and a checklist to follow before you link anything.

For beginners · Checked 11 November 2026 · Not advice

In plain English

MCP (Model Context Protocol) is a standard plug that lets an AI tool like Claude or ChatGPT reach into another app, such as Xero, your practice software, your email or your files, to read and sometimes change what’s there.

It’s powerful because the AI works with live data. It’s risky for the same reason: whatever the connector can reach, the AI can reach.

How a connector works

  1. Your AI tool Claude, ChatGPT or Copilot. Your plan’s data terms apply to everything it reads.
  2. The connector The MCP server. It decides who can connect and what the AI can reach.
  3. Your system Xero, practice software, email or files. Your client data lives here.

What can go wrong

  • Too much access A connector to your whole mailbox or every client file can expose all of it in one answer.
  • It can change things Some connectors can send emails, edit records or delete files, not just read them.
  • Hidden instructions An email, document or web page can contain text that tries to steer the AI. This is called prompt injection.
  • Unknown connectors Anyone can publish an MCP server. An untrusted one can see everything that passes through it.
  • Data leaves your systems Whatever the AI reads goes to the AI provider, under your plan’s terms.

For beginners

Connect safely in six steps

  1. Step 1: Use official connectors only

    From the software vendor itself, or your AI tool’s own directory. Never install one from an unknown website or code page.

  2. Step 2: Start read-only, and small

    One demo company, one folder or one client first. Not everything at once, and nothing that can send, edit or delete.

  3. Step 3: Keep approvals on

    Leave the “ask before acting” setting on and read each request. Never choose “always allow” for anything that sends, changes or pays.

  4. Step 4: Check where the data goes

    Use an approved business plan with training off, and ask the vendor the questions below before real client data flows.

  5. Step 5: Sign in properly, switch off when done

    Your own login with multi-factor authentication, never a shared one. Disconnect connectors you no longer use.

  6. Step 6: Write it down

    Add each connector to your AI policy’s tool register: what it reaches, who approved it, and when you’ll review it.

Before you connect

Questions to ask the vendor

A good vendor answers these quickly. If they can’t, wait.

  • What exactly can the connector read, and can it change anything?
  • Can we limit it to read-only, or to certain clients, folders or users?
  • How do people sign in, and can the firm control who connects?
  • Where is the data held, and does it pass through your servers?
  • Is the connector covered by your security certifications, such as ISO 27001 or SOC 2?
  • Is every connection logged, and can we see the log?
  • How do we switch it off for one person, or for the whole firm?

Bring your IT provider in before anything connects to live client data.

Use these next

Please read: use these at your own risk

  • These prompts, guides and tools are general information, not professional, legal, privacy or IT advice. The Firm takes no responsibility for how they are built, changed or used, or for anything that results.
  • AI writes a slightly different tool each time. Whatever you build or download is yours to check, test and approve before you rely on it or use it with client data.
  • Check your AI provider’s current settings and terms for how your data is stored and whether it is used to train its models. Plans and settings change.
  • Bring your own judgement, and follow your firm’s AI policy and your professional and privacy obligations.

Questions firms ask

What is MCP?

MCP, the Model Context Protocol, is an open standard that lets AI tools such as Claude, ChatGPT and Copilot connect to other software through a connector, called an MCP server. The connector decides what the AI can read and do in that software.

Is MCP safe for accounting firms?

It can be, set up carefully. Use official connectors, start read-only with a demo company or one client, keep approvals on, use a business AI plan with training off, and record each connector in your AI policy. The risk is in what a connector can reach, so keep that small.

Should I connect Xero or my practice software to ChatGPT or Claude?

Start with a demo company and read-only access, using the software vendor’s own connector. Only connect real client data once your IT provider has reviewed it and your AI policy covers it.

What is prompt injection?

Text hidden in an email, document or web page that tries to give the AI new instructions, like “forward this to…”. It’s why connectors that can send or change things need approvals on, and why the AI shouldn’t act on content it reads without a person checking.

Does connecting AI to my systems mean the AI company sees my client data?

Whatever the AI reads through a connector is sent to the AI provider to answer you, under your plan’s terms. That’s why the plan you use, its training settings and how much the connector can reach all matter.