Part three of a series. Part one is Your Next Legal Research Platform Isn’t a Website. It’s a Protocol. Part two is Nobody Gets to Plead Impracticality Twice.
Updated October 7, 2026, to add Anthropic’s September 25 opening of its connector directory.
In June I submitted FLexlaw’s MCP server to Anthropic’s connector directory. Within days an email confirmed receipt, signed by a real Anthropic engineer who works on the protocol, or by someone using his name. Seven weeks later a second email from the same domain asked me to finish the review by sending “the full list of tools your connector exposes (their names, descriptions, and parameters)” through a submission form.
I did not send it, and I still do not know whether I should have. The emails came from a workspace on a commercial support-mail service rather than from an Anthropic address, and anyone can name such a workspace what they like. The second message mentioned the form several times and contained no link to one. The real directory reads a server’s tools from the live server, so I could not see why anyone at Anthropic would need me to type up the list. A list of every tool and every parameter is also the survey an attacker makes before trying the doors.
I had been through the real process, I knew what it asked for, and I could not settle the question. Most lawyers who connect a server to their AI assistant know far less about who is on the other end, and nobody is checking for them.
What is on the shelves
Some of what has been connected to the protocol comes from the people who keep the records. In January the Government Publishing Office opened a public preview of an MCP server for GovInfo, which holds the Federal Register, the Statutes at Large, congressional documents, and opinions from selected federal courts. In May the Free Law Project put CourtListener, its archive of opinions and federal dockets, into the connector directory. When you query either one, you are asking the custodian.
Much of the rest is less clear. Search a server directory for “census” and you get a page of servers with similar names. Learning which one, if any, the Census Bureau stands behind takes real work. A server named for a weather service, a drug-safety database, or a web archive may be a wrapper an individual developer wrote over the agency’s public data. A wrapper can be accurate and useful. But when you use one, you are trusting its author, and the agency’s name on the label tells you nothing about who that author is.
I should say that I run one of these servers. FLexlaw’s is a wrapper over a corpus I built, and the questions below apply to it as much as to anyone’s.
What the registry checks
The protocol has an official registry, still in preview. It verifies one thing, and verifies it well. Only the owner of a domain or a GitHub account can publish a server under that name. The registry’s own documentation says it leaves security scanning to the package registries and to the marketplaces built on top of it, and calls its metadata “deliberately unopinionated.” It tells you who published a server. It does not tell you whether the server is honest.
The first malicious MCP server reported in the wild shows the gap. In September 2025 a developer published a package to npm called postmark-mcp, the same name as the email company Postmark’s own server, which lived on GitHub. The early versions worked as advertised. Version 1.0.16 added one line that copied every email sent through the server to an address the developer controlled. The package was downloaded 1,643 times before it was removed. The emails still went where they were addressed. Nothing a user could see had changed.
What the directory checks
The directories built on top of the registry do more, and Anthropic’s has just opened its doors. On September 25 it began taking submissions from anyone on a paid Claude plan, with no partner program to apply to first. Every connector is scanned automatically for policy compliance and, by default, listed with a Community label. Anthropic may move a listing to Verified review, in which a reviewer tests each tool.
To its credit, Anthropic says plainly what the labels do not mean. It “screens Community connectors before listing them but hasn’t reviewed them in depth,” and tells users to “only connect to developers you trust.” Verification “isn’t a security audit or a guarantee of how the connector will perform,” because “the developer operates the connector and controls its tools, which can change after review.” Once connected, a Community connector has the same access as any other. The line that turned postmark-mcp against its users arrived in version 1.0.16. A review of any earlier version would have found nothing to flag.
The rule has no protocol exception
Florida’s confidentiality rule already covers this. Rule 4-1.6(e) requires a lawyer to “make reasonable efforts to prevent the inadvertent or unauthorized disclosure of, or unauthorized access to, information relating to the client’s representation.” In 2024 the comment gained a warning that “generative artificial intelligence may create risks to the lawyer’s duty of confidentiality.” Ethics Opinion 24-1 tells lawyers to research an AI program’s policies on data retention, data sharing, and self-learning before trusting it with client information.
A query sent to an MCP server is information. A query that names the client, the dispute, or the theory of the case is a disclosure to whoever runs the server, and that is as true of the custodian’s server as of anyone else’s. Opinion 24-1 was written before lawyers were wiring outside servers into their assistants, but its questions carry over without change. The Bar gave the same instruction about cloud storage in 2013, when Opinion 12-3 told lawyers to research the service provider before putting client files on it. The same 2024 order added “using generative artificial intelligence” and “using an Internet-based service to store client information” to the comment’s list of outside services a lawyer may use, and kept the condition that comes with the list. The lawyer must make reasonable efforts to ensure the service is provided “in a manner that is compatible with the lawyer’s professional obligations,” weighing “the education, experience and reputation of the nonlawyer; the nature of the services involved; the terms of any arrangements concerning the protection of client information.”
Asking for credentials
The fair objection is that a practicing lawyer cannot audit a server’s code. Neither can she audit an expert’s laboratory. She asks for credentials, learns the methodology, and decides whether to put the result in front of a court. The comment to Rule 4-5.3 asks for the same things, in the Bar’s words. In mine, they come to four questions.
Who runs it? A server should trace to the agency, court, or vendor whose data it serves, or to an author you can identify and evaluate.
Where do the queries go, and what is kept? If the server logs queries, ask for how long and for what purpose. If the operator will not say, assume the worst.
Can you trace the answers? A good server returns its source with each result, and a link you can check. One that returns conclusions without sources is asking for a trust it has not earned.
How did it reach you? A server you found through a source you already trust is different from one recommended in an unsolicited email, however well it is dressed.
None of this requires technical skill. It requires the habit of asking, which lawyers already have and tend to set aside when a tool is new and works well.
The librarian
A law library has someone whose job is to know which books are authoritative, which are current, and which are advocacy dressed as analysis. The catalog of MCP servers has no one in that job, and may never have one. The registry checks names. Anthropic’s directory screens everything it lists, tests some of it, and says that neither is an audit. Everything past that falls to the lawyer who connects the server, under a rule written before the protocol existed.
The authorities: R. Regulating Fla. Bar 4-1.6(e) & cmt.; R. Regulating Fla. Bar 4-5.3 cmt.; In re Amendments to Rules Regulating the Florida Bar, Chapter 4, 393 So. 3d 137 (Fla. 2024) (FLexlaw case id 1355740); Fla. Bar Ethics Op. 24-1 (Jan. 19, 2024); Fla. Bar Ethics Op. 12-3 (Jan. 25, 2013). Sources: U.S. Gov’t Publishing Office, AI Agents Meet Federal Data: Public Preview for the GovInfo MCP Server (Jan. 22, 2026); Free Law Project, CourtListener Is Now Available Inside Claude (May 12, 2026); Model Context Protocol, The MCP Registry; Anthropic, Build Plugins for Claude with the Directory Submission Portal (Sept. 25, 2026); Anthropic, Connector Verification; First Malicious MCP Server Found Stealing Emails, The Hacker News (Sept. 2025).
John J. Lloyd is a Florida/Texas litigator and legal technologist, and the creator of FLexlaw, a Florida-focused legal research platform. He writes about Florida litigation and legal technology at lloydesq.com.