Org admin's personal MCP connector is auto-shared org-wide (coupled add/remove, no per-user gating, silently auto-invoked)

### Summary

When an organization **admin** (Owner / Primary Owner) adds a **custom remote MCP connector** through their **personal** connector settings (Customize → Connectors), it is automatically also registered as an **organization** connector (Organization Settings → Connectors) and made available to **all** members. The personal and org entries appear to be **coupled**: removing the org connector also removes the personal one, and re-adding it personally re-shares it org-wide. There is **no per-user / per-group gating**, and members' normal chat sessions **auto-invoke** the connector's agent without the user explicitly selecting it(desired config).

### Impact (confidentiality)

An admin testing a **not-for-production** MCP server unintentionally exposed it to the entire organization. In our case the connector points to an internal line-of-business system running on a **non-production / dev instance that holds a copy of real personal data** confidential notes, and PII. Once it silently became an org connector, other staff members' chats began **auto-using it**, surfacing that data to people who shouldn't see it, with no indication it was a dev/test system.

(Separately, the upstream product has an authorization issue we're already addressing with its vendor, which compounds the exposure — but the **connector-scoping behavior described here is the vulnerability being reported**, and it is dangerous on its own: a personal, in-testing connector should never be silently pushed to a whole organization.)

### Steps to reproduce

1. Sign in as an organization admin (Owner / Primary Owner).
2. Add a **custom remote MCP connector** via **personal** settings → Customize → Connectors.
3. Observe it **also** appears under **Organization Settings → Connectors**, available to all members.
4. In a normal member chat (a different, non-admin account), the connector's agent is **auto-invoked** without the member explicitly selecting it.
5. Remove it from Organization Settings → Connectors → it is **also removed from your personal** connectors. Re-adding it personally re-shares it org-wide.

### Expected behavior

- A connector added through **personal** settings should stay **personal-only**.
- Sharing a connector to the organization should be a **separate, explicit** action — never an automatic side effect of an admin adding it for themselves.
- Organization connectors should support **per-user / per-group gating**.
- Members should **not silently auto-use** a newly shared connector.

### Environment

- Surface: claude.ai (web)
- Reporter role: Organization Owner / Primary Owner
- Date observed: 2026-08-14

### Severity / ask

Please treat this as a **security issue** and prioritize:

1. **Decouple** personal vs. organization connector creation for admins — a personal add must not auto-share org-wide.
2. Add **per-user / per-group gating** for organization connectors.
3. Prevent **silent auto-use** of newly shared connectors.

---

*Reviewed by (myself)Jonathan. Drafted and filed with Claude Code (Claude Opus 4.8) at the reporter's request.*