You can connect ElevenLabs to Claude using the Model Context Protocol (MCP), and once it’s connected, Claude can generate voiceovers and text-to-speech audio as part of a conversation instead of you copying a script into a separate app. This guide covers what ElevenLabs’ MCP server does, how to connect it directly or through a gateway, and why a tool that can produce a voice deserves a different kind of caution than one that just reads or writes text.

What the ElevenLabs MCP server actually does

ElevenLabs publishes a remote MCP server at api.elevenlabs.io/v1/mcp that turns text-to-speech and voice generation into tools Claude can call directly. Instead of you pasting a script into ElevenLabs’ own site, Claude can generate the audio as part of the same conversation where you wrote or edited the text. Prompts like these fit the shape of what a voice-generation tool is for:

  • “Turn this script into a voiceover in a calm, neutral voice.”
  • “Read this paragraph back to me so I can hear how it sounds.”
  • “Generate narration for this video draft in a couple of different voices.”

See the ElevenLabs server page in gate’s directory for the current tool list and connectivity status. Like most servers in the catalog that act on an account, ElevenLabs’ MCP server sits behind OAuth rather than being open to anyone.

Why you might hit an allow-list

ElevenLabs currently only admits clients it has allow-listed, the same pattern covered in why some MCP servers reject a client outright. In practice that means a brand-new or less common MCP client can get an “unauthorized client” error the first time it tries to connect, even though your ElevenLabs account and API access are both fine. It’s the same restriction that currently applies to Dropbox, Figma, and Vercel in the same catalog — the vendor deciding who can register as a client, not something wrong with your setup.

Option 1: Connect ElevenLabs to Claude directly

Claude supports remote MCP servers natively. The short version of the setup:

  • Open Claude’s connector or MCP settings.
  • Add a remote server pointing at ElevenLabs’ MCP endpoint at api.elevenlabs.io/v1/mcp.
  • Sign in with your ElevenLabs account when prompted and approve the requested scopes.
  • If the client you’re using isn’t on ElevenLabs’ allow-list yet, you’ll see an authorization error instead of a consent screen — see the workarounds in the unauthorized client post.

That’s enough if ElevenLabs is the only extra server you want in Claude. It gets more to manage once you add a second and third server, each with its own entry in your client’s config and its own separate grant to track.

Option 2: Connect it once, through a gateway

If you’re already connecting more than one MCP server, or the same server across more than one AI client, wiring each one in directly gets old fast — see what running the same server in multiple clients actually costs you. The idea with a gateway is to connect ElevenLabs (and everything else you use) to one URL, then point every AI client at that single URL.

With gate specifically, connecting ElevenLabs looks like this: add gate’s gateway URL to Claude once, then pick ElevenLabs from the ElevenLabs server page in the directory. From then on, its voice-generation tools are available in every client connected to your gate URL, with the same per-tool allow, ask, or block rule applied everywhere instead of set up separately in each client. See the full list on the MCP servers page.

What to check before you point it at real work

A voice-generation tool carries a different kind of risk than a tool that reads your files or your CRM. Nothing it does is destructive in the usual sense — it doesn’t delete a record or send a payment — but the output is audio that can sound like a specific person, which changes what “misuse” means:

  • Voice cloning is an identity question, not just a data question. If your ElevenLabs account has any cloned or custom voices attached to it, treat access to that account the way you’d treat access to someone’s likeness — a tool call that generates audio in that voice is producing something that could pass as a real person speaking. Review what an AI client is actually permitted to do with tools like this the same way you’d review any consequential tool, per what an OAuth scope actually covers.
  • Generated audio can still carry a prompt in the text it’s reading. If the script came from somewhere you don’t fully control — a scraped page, a form submission, another tool’s output — treat that text as untrusted content before you feed it to a text-to-speech tool, the same caution covered in the confused deputy problem in MCP.
  • Read the tool descriptions once. Any MCP server’s tool descriptions are text the model reads before deciding what to call, and that’s true whether the tool writes to a database or synthesizes audio. gate’s free MCP security scanner checks a server’s tool list for prompt injection patterns before you rely on it, no signup required.
Where gate fits: gate puts ElevenLabs and every other server in the catalog behind one URL, with per-tool allow, ask, or block rules and a plain-language log of every call — so a voice-generation tool gets the same review and the same audit trail as anything else connected to your AI client. See the full approach at /mcp-gateway.

The bottom line

Connecting ElevenLabs to Claude with MCP works the same way most OAuth-based servers in the catalog do — direct or through a gateway, allow-list permitting. What’s different is what the tool produces: audio that can sound like a real voice, which is worth a second thought about who can trigger it and what text they’re feeding it, before you treat it like any other read-or-write tool.