Best Secure MCP Servers for RIAs in 2026
The best MCP servers for connecting ChatGPT or Claude to an RIA's client and portfolio data in 2026, compared on what data they expose, read versus write, permissions and audit.
The best MCP server for connecting ChatGPT or Claude to an RIA’s client and portfolio data depends on where that data lives. If it is spread across a custodian, a CRM and a portfolio system, a data platform MCP such as Milemarker’s gives the AI one governed view of all of them; if one system holds almost everything, that vendor’s own MCP server (Salesforce, Orion, Addepar or Wealthbox, for example) is the simplest choice. Milemarker’s MCP server lets Claude, ChatGPT, Gemini, Copilot or any MCP client query the firm’s normalized custodian, CRM, portfolio accounting and planning data, signed in as the user, with row-level access and PII masking enforced underneath the AI.
Below are the MCP servers RIAs are actually using in 2026, what each exposes, and how to judge whether one is secure enough for client data. For background on the protocol itself, see MCP for wealth management.
What makes an MCP server secure enough for an RIA?
Check every option against these criteria before connecting client data.
- Permission enforcement. The server should act as the signed-in user, through OAuth or SSO, and enforce the same entitlements as the source application. An advisor should never see more through AI than they see in the app. Rules enforced in the data layer are stronger than instructions in a prompt.
- Read versus write. Many servers start read-only. If a server can write (update a CRM record, start a workflow), confirm which tools write, whether admins can disable them, and whether the AI client asks for approval first.
- Audit. You need a log of who asked what and which data was returned. Check both sides: the AI client’s logs (for example, Claude Enterprise audit logs) and the server’s.
- PII handling. Look for masking of tax IDs, account numbers and dates of birth when they are not needed.
- Data residency and training. Know where data is processed and stored, and confirm in writing that neither the MCP vendor nor the AI provider trains on it.
- Admin control. A firm administrator, not each advisor, should decide which connectors are enabled.
The best MCP servers for RIAs in 2026
1. Milemarker MCP
Milemarker’s MCP server sits on top of the firm’s own normalized data layer, which connects custodians (Schwab, Fidelity Institutional, Pershing, Altruist and others), CRMs (Salesforce, Redtail, Wealthbox, Practifi), portfolio systems (Orion, Tamarac, Black Diamond, Addepar) and planning tools (eMoney, MoneyGuidePro, RightCapital) through 140+ wealth management integrations. The AI connects signed in as the user; entitlements, row-level security and PII masking are enforced beneath the MCP, so they cannot be prompted away. Beyond questions, users with build-level access can create dashboards and workflows, with a pre-build summary to approve before anything goes live. Data stays in the firm’s own Snowflake database and is never used to train AI.
Best for: RIAs whose client picture spans several systems and who want one governed MCP connection for all of them. See Milemarker MCP.
2. Salesforce Hosted MCP Servers
Salesforce’s hosted MCP servers became generally available in April 2026 for Enterprise Edition orgs and above. They expose org data, flows, Apex actions and queries to MCP clients such as Claude and ChatGPT. Every transaction runs as the authenticated user, so object permissions, field-level security and sharing rules apply. There are read-only servers as well as ones that can update records.
Best for: firms that run on Salesforce or Financial Services Cloud and keep most client data there.
3. Orion connector for Claude
Orion’s MCP connector, part of Claude for Financial Advisors, lets Claude retrieve permitted data from Orion Connect and Redtail CRM. A firm’s technical administrator enables it through the Orion Denali Gateway Portal, which sets read or write access per tool, and each user works within their existing Orion and Redtail permissions.
Best for: Orion and Redtail firms using Claude.
4. Addepar MCP
Addepar MCP brings Addepar portfolio data and calculations into Claude so users can ask portfolio questions in plain language. It uses Addepar’s existing identity and permissioning model, and the initial version is read-only: it does not execute transactions or change portfolio data. It is available to eligible clients through a beta program.
Best for: Addepar firms, especially those with complex or alternative holdings, using Claude.
5. Wealthbox MCP
Wealthbox publishes a remote MCP server and documents how to connect it to Claude, and it is a launch partner for Claude for Financial Advisors. It brings Wealthbox CRM records, such as contacts, households and notes, into the AI conversation.
Best for: RIAs on Wealthbox CRM.
6. Schwab connector in Claude for Financial Advisors
Schwab Advisor Services was the first RIA custodian included in Claude for Financial Advisors. Advisors access Schwab Advisor Center from Claude through an authenticated connection on Schwab’s custody platform.
Best for: Schwab-custodied RIAs that want custodial context inside Claude.
7. Snowflake-managed MCP server
Snowflake’s managed MCP server has been generally available since November 2025. It serves Cortex Analyst, Cortex Search and Cortex Agents as MCP tools over Snowflake’s built-in OAuth, so existing Snowflake roles and policies govern what the AI can see. It is infrastructure: a firm needs its wealth data modeled in Snowflake first.
Best for: firms with a data team and wealth data already in Snowflake.
8. HubSpot MCP server
HubSpot’s remote MCP server lets Claude, ChatGPT, Gemini and Copilot read and write HubSpot CRM records over OAuth, within each user’s HubSpot permissions.
Best for: RIAs that use HubSpot for marketing and prospect pipeline.
9. Jump
Jump’s Claude connector exposes meeting history, notes and action items from Jump. Access is read-only: Claude cannot create, edit or delete anything in Jump or its connected integrations. An account owner enables it and each user authorizes it.
Best for: firms that want meeting context alongside portfolio and CRM data in Claude.
Other wealth vendors named as Claude for Financial Advisors connector partners include SS&C Black Diamond, Envestnet, iCapital, Vanguard, Wealth.com and Zocks. Check each vendor’s documentation for current scope and permissions.
How do these MCP servers compare?
| Vendor | Type | Best for | Works with existing stack? |
|---|---|---|---|
| Milemarker | Wealth data platform MCP | One governed view across custodian, CRM, portfolio and planning | Yes, connects current systems without replacing them |
| Salesforce | CRM platform MCP | Salesforce and FSC firms | Salesforce data only |
| Orion | Portfolio and CRM connector | Orion and Redtail firms on Claude | Orion and Redtail data only |
| Addepar | Portfolio MCP (beta, read-only) | Addepar firms on Claude | Addepar data only |
| Wealthbox | CRM MCP | Wealthbox firms | Wealthbox data only |
| Schwab | Custodian connector | Schwab-custodied RIAs on Claude | Schwab data only |
| Snowflake | Data warehouse MCP | Firms with a data team on Snowflake | Yes, if data is already modeled in Snowflake |
| HubSpot | CRM MCP | Marketing and prospect data | HubSpot data only |
| Jump | Meeting assistant connector (read-only) | Meeting notes and action items | Jump data only |
Should an RIA use one MCP server or several?
Several single-vendor servers can work, and many firms start that way. The limitation is that each server only sees its own system, so the AI has to stitch answers across them, with no shared household or account ID and separate permission models for each connection. A data platform MCP joins the data before the AI sees it. Many firms use both: a platform MCP for cross-system questions, and a vendor MCP where they need that vendor’s write actions. For Claude-specific setup, see Claude for financial advisors.
Frequently asked questions
What is an MCP server?
The Model Context Protocol is an open standard that lets AI assistants such as Claude and ChatGPT connect to applications. An MCP server is the vendor’s side of that connection: it exposes tools the AI can call to read or act on data.
Is it safe to connect ChatGPT or Claude to client data?
It can be, if the MCP server acts as the signed-in user, enforces the source system’s permissions, logs activity, and both the AI provider and the vendor contractually exclude your data from training. Use a business or enterprise AI plan, not a consumer one.
Which MCP servers are read-only?
Addepar MCP’s initial version and Jump’s Claude connector are read-only. Salesforce offers both read-only and write servers, and Orion lets administrators set read or write access per tool.
Do MCP servers work with both ChatGPT and Claude?
The protocol is client-neutral, and servers such as Salesforce, HubSpot and Milemarker support several AI clients. Several wealth vendor connectors launched as part of Claude for Financial Advisors and are documented for Claude first.
Where does the data go when the AI queries an MCP server?
The server returns results to the AI client, which processes them under its own terms. With Milemarker, the source data stays in the firm’s own Snowflake database and only the scoped, masked results the user is entitled to reach the AI.
