Claude Web & Cowork

Claude has several surfaces, and they behave differently. This page covers the two connector-based ones:

• claude.ai chat in the browser — ordinary Claude conversations
• Claude Cowork — Claude's agentic workspace

For the complete Cowork click path, permissions, verification, recovery, upgrade, and removal, use the dedicated Claude Cowork installation guide. For the coding CLI, see Claude Code, which is the Claude surface with deterministic hook-based memory.

Which surface am I using?

There is no MemoryRouter Chrome extension, and none is needed — a remote connector is officially supported and avoids browser and page permissions entirely.

Connect the connector

Both surfaces use the same remote MCP connector:

https://mcp.memoryrouter.ai/mcp

1. Open Customize → Connectors. On an individual plan choose + → Add custom connector. On Team/Enterprise, an Owner first adds it under Organization settings → Connectors → Add → Custom → Web, then members return to Customize and choose Connect.
2. Add the custom connector with the URL above.
3. Leave advanced OAuth client ID and secret empty — discovery and dynamic registration handle it.
4. Sign in and choose the vault for this connection.

Plan availability

Custom connectors and Skills are available across Claude plans. Plugins are paid-plan packaging, and Team/Enterprise generally require an owner or administrator to provision connectors for members.

Anthropic changes plan capabilities over time; verify against Anthropic's current documentation before relying on a specific row.

What is included

claude.ai chat (browser) — version 1.0.0:

• Remote OAuth connector definition
• Read-write and read-only skill packages
• Scoped Project instructions for personal, project, and organization use in each mode
• An optional no-code plugin package for paid plans

Claude Cowork — version 2.0.0:

• Hosted OAuth connector configurations (read-write and read-only)
• A behavioral skill with explicit scope handling
• Two plugins — read-write and least-privilege read-only
• A marketplace bundle and enterprise managedMcpServers administrator templates
• Deterministic, hash-verified archives

Read-only is behavioral unless enforced

A read-only skill package tells Claude not to write. That is policy, not a security boundary. Real enforcement comes from either:

• connecting with only the memories:read scope, or
• blocking the store_memory tool through Claude organization policy.

The read-only plugin pins memories:read in its MCP configuration, which is the enforceable version.

Model-directed limits

Neither browser chat nor Cowork has a lifecycle hook that can force recall or capture. Claude chooses when to use the tools, so recall and capture are not guaranteed on every turn.

Skills and Project instructions improve how consistently Claude uses memory, but they are orchestration, never authorization. For guaranteed automatic memory, use Claude Code or Codex against the same vault.

Vaults and projects

One connection is bound to one vault, chosen during OAuth. To change vaults, disconnect and reconnect.

Cowork's skill supports explicit conversation-local scopes (personal/default, project/<handle>, org/<handle>) and fails closed: if a write is requested with no active scope, it asks rather than guessing. Handles are never inferred from a folder, filename, or repository.

These handles are compatibility labels. The server accepts no scope argument, so for strict isolation use a dedicated vault per project or organization.

Enterprise and admin setup

For Team and Enterprise, an owner or administrator typically adds the connector for the organization. Cowork ships managedMcpServers templates, including a read-only variant that blocks store_memory and delete at the policy layer.

Those templates are administrator inputs for managed deployment — they are not files consumed by standard claude.ai.

Manual acceptance still required

These steps cannot be automated and must be completed in a real account:

• Interactive OAuth sign-in and vault choice
• Organization-level connector distribution and permission enforcement
• Plugin or marketplace acceptance, if you distribute the packages that way

Deletion

Claude surfaces do not get per-memory deletion — no such tool exists, and a store_memory receipt is not a deletion ID. Remove individual memories in the dashboard.

Whole-vault deletion via forget_all_memories requires the memories:delete scope and the exact phrase DELETE ALL MEMORIES. Claude must ask for explicit confirmation first, and "forget that" is never treated as consent to erase a vault.

Troubleshooting

Connector missing or greyed out. Plan limit or admin policy. Free plans allow one custom connector; Team/Enterprise may require owner provisioning.

Claude ignores memory. Model-directed behavior. Ask explicitly, or add the skill and Project instructions.

"Insufficient scope" when saving. The connection is read-only. Reconnect and approve memories:write; a 403 is not retriable.

Vault statistics unavailable. Call memory_status, or read memory://vault/stats if the host exposes resources. Claude should never estimate counts.