Detects the first seen creation of a Model Context Protocol (MCP) server integration name for a given Anthropic organization within the rule history window, signaling a new external data pathway into Claude. Implemented as a New Terms rule keyed on organization.id and anthropic.audit.mcp_server_name, it alerts when a new MCP connector is created (event.action: mcp_server_created, event.outcome: success) in logs-anthropic.audit-*. The rule is scoped to avoid duplicate alerts for the same connector name within the same organization while allowing alerts for the same connector name in different tenants. It leverages a 14-day history window to identify genuinely new connectors. Investigation fields include organization.id, anthropic.audit.mcp_server_id/name, actor type, user details, source IP, and user agent. The rule assigns a risk score of 47 and a medium severity and maps to MITRE ATT&CK Persistence (T1176: Software Extensions, TA0003). False positives may occur during Claude pilots when approved MCP connectors are rolled out; validation against inventory and onboarding tickets is recommended. Recommended triage steps: record mcp_server_name/id and actor, verify against the approved integration inventory, review related mcp_server_updated/deleted events for exports or privilege changes, and close as FP if inventory and pilot tickets align. If unauthorized, remove the MCP server and review data accessed during the exposure window. References include the Anthropic API/compliance documentation for activities list.