MCP & Connecting AI to Data & Tools

Advanced · Technical & Agentic track · ~35 min hands-on + readings and quiz

← Back to the Technical & Agentic track

Understand how assistants connect to real systems — and the access risks that come with it.

What you’ll be able to do

  • Explain what MCP (Model Context Protocol) does
  • Recognize when connecting AI to a tool helps vs. adds risk
  • Apply least-privilege and approval before connecting to data

Overview

The Model Context Protocol (MCP) is a standard way to connect an assistant to outside data sources and tools — a file store, a database, a calendar. It’s the plumbing behind agents that do more than chat. Powerful, and a new surface for mistakes and access risk.

Connect with least privilege: give the narrowest access that does the job, prefer read-only, and confirm Drexel’s rules before connecting to any real or sensitive system.

Practice activities

Activity 1 · Advanced — Map a connection with least privilege

Time ~15 min · Tools conceptual + the connector’s docs

Goal. Plan a safe AI-to-tool connection.

Setup. Work through this concrete scenario:

The task: You want to connect Claude Desktop to your OneDrive folder containing de-identified crash data files (CSVs and PDFs of published reports) so you can ask questions about the data without manually copying and pasting. The folder is Pedestrian Safety Study / Public Data.

The over-scoped version: You connect Claude to your entire OneDrive — every folder, every file, read and write access. This is faster to set up.

The least-privilege version: You connect Claude to only the Pedestrian Safety Study / Public Data subfolder, read-only access, no access to any other folder including the parent Pedestrian Safety Study folder (which contains identified data, IRB documents, and personnel files).

Steps.

  1. Map out what each version can access:

    Over-scoped Least-privilege
    Can read public crash CSVs Yes Yes
    Can read published PDF reports Yes Yes
    Can read IRB protocols with participant details Yes No
    Can read personnel files with salaries Yes No
    Can read your email drafts Yes No
    Can modify or delete files Yes No
    Can write new files into any folder Yes No

  2. Get a second opinion:

    I want to connect an AI assistant (Claude Desktop via MCP) to a OneDrive subfolder containing de-identified crash data CSVs and published reports. The parent folder contains identified data and IRB documents. I’m considering read-only access to only the public-data subfolder. What’s the least-privilege version of this, and what could go wrong if I connected the whole OneDrive instead?

  3. Decide: Is even read-only access to the subfolder acceptable under Drexel’s data rules, given that the files are de-identified and public? What would change if the folder also contained files with ZIP codes and dates that could theoretically re-identify?

Expected result. A least-privilege access plan: read-only, single subfolder, no access to parent directories. You should also have identified that the over-scoped version would expose IRB protocols, personnel files, and email drafts to the AI — none of which are needed for the task.

Check your work. Ask: “If this connection misbehaved or was compromised, what’s the worst it could do?” With least-privilege, the worst case is reading de-identified public data. With over-scoped access, the worst case is reading (and potentially leaking) identified research data, personnel records, and IRB documents.

Common pitfalls. Convenience tempts over-permissioning. “I’ll just connect the whole drive so I don’t have to reconfigure later” is the most common mistake. Prefer read-only; confirm Drexel rules before connecting any system.

Stretch (optional). Decide whether the connection is even worth the risk versus manually copying the specific CSV into the chat. For a one-time question, copy-paste may be safer than a persistent connection.

Activity 2 · Advanced — Risk-check the connection

Time ~12 min · Tools conceptual

Goal. Put a human approval step before consequential actions.

Setup. Your plan from Activity 1.

Steps.

  1. List what could go wrong if the connection misbehaves or the AI is misled by content it reads.

  2. Add a human-approval step before any write, send, or delete action.

  3. Find the worst case:

    Given this connection, what’s the single highest-risk action, and how do I gate it?

Expected result. A risk list plus an approval gate on the riskiest action.

Check your work. Is there any path where the AI acts irreversibly without a human? Close it.

Common pitfalls. Connected agents can be misled by malicious content (prompt injection) — keep humans on consequential steps.

Stretch (optional). Note which actions you’d never connect to AI at all.

Activity 3 · Advanced — Configure a real least-privilege MCP connection

Time ~25 min · Tools Claude Desktop (or Claude Code) + Node.js — consumer/PI-purchased tools: Low Risk Data only

Goal. Turn Activity 1’s paper plan into a real, working, testable least-privilege connection — using only fabricated practice data.

Setup. Make one new folder on your computer (e.g., mcp-practice on your Desktop) and put 2–3 fake “crash summary” text files in it with obviously made-up numbers (e.g., crash-summary-2024.txt: “District 9 recorded 42 crashes in 2024, 7 involving bicycles.”). Nothing real, nothing identified — this folder is the entire universe the assistant will be allowed to see. NOT a real OneDrive folder; NOT anything with actual Drexel data. Then connect the official filesystem MCP server (@modelcontextprotocol/server-filesystem) scoped to only that folder. In Claude Desktop: Settings → Developer → Edit Config, add this to claude_desktop_config.json (swap in your actual folder path), save, and restart the app:

{
  "mcpServers": {
    "practice-folder": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/Users/you/Desktop/mcp-practice"]
    }
  }
}

That last line is Activity 1’s least-privilege table row, now as real configuration: one specific folder path — not your whole drive, not a parent folder.

Steps.

  1. Test that reading works. Ask a question answerable only from the practice files:

Using the practice-folder connection, which district had the most crashes across the summary files, and what is the total in each file?

  1. Test the boundary. Ask for something outside the folder and confirm it fails:

List the files in my Documents folder.

You should get an “access denied” or “not in allowed directories” response — the connection can only see the one folder named in the config, nothing else on the computer.

  1. Now deliberately try to make it write:

Create a new file called notes.txt in the practice folder that says “test”.

This reference server does include write tools, so Claude Desktop will ask your approval before any write — click Deny. That approval prompt is Activity 2’s human-approval gate, made real. Since the server itself doesn’t enforce read-only, your read-only guarantee comes from two things you can inspect: the config grants only this one folder, and you decline every write. When you’re done practicing, remove the server block from the config and restart — the narrowest access of all is none.

Expected result. A working connection that answers questions from the practice files, cannot see anything outside the folder, and never writes without your explicit approval — Activity 1’s comparison table passing a live test.

Check your work. Re-ask Activity 1’s question against the real thing: “if this connection misbehaved, what’s the worst it could do?” The honest answer should now be “read three fake text files.”

Common pitfalls. Pointing the config at your Desktop or home folder instead of the single practice subfolder — that’s the over-scoped version from Activity 1, for real. Clicking “Allow” on write prompts out of habit. Leaving the server configured after the exercise ends. And the big one: this is a controlled practice exercise only — connecting MCP to any real Drexel data folder (OneDrive included) needs Drexel’s approval first, exactly as this page’s Data rules state.

Stretch (optional). Try the same design in Claude Code: claude mcp add practice-folder -- npx -y @modelcontextprotocol/server-filesystem ~/Desktop/mcp-practice, then use /permissions to deny the server’s write tools outright — least privilege enforced by configuration rather than by clicking Deny each time.

Check your readiness

Answer these, then check — your score suggests whether to dive in or skim the readings first.

Useful resources