MCP servers for coding agents

An MCP server is a program that gives an AI agent new abilities through the Model Context Protocol, an open standard for connecting AI applications to tools and data. Add a GitHub server and your agent can open pull requests. Add a browser server and it can click through your site. In Claude Code, claude mcp add installs one. We checked the protocol docs and each agent's guide on 31 October 2026.

Quick facts

What MCP is, in plain words

Before MCP, every AI app needed its own plug for every service. One for GitHub, one for Slack, one for your database, rebuilt for each assistant. MCP's own docs call it a USB-C port for AI applications: one standard connector, so a server written once works with any client that speaks the protocol.

The docs name three participants:

• Host: the AI application, such as Claude Code or Visual Studio Code.
• Client: a component inside the host that holds a connection to one server.
• Server: the program that provides context.

A server can offer three things:

Most servers you will install are mostly tools.

Local and remote

"Local" and "remote" describe where the server runs, not where it is from.

• Local servers start on your machine, usually with npx, uvx or Docker, and talk over stdio. They serve one client and can touch your files.
• Remote servers run on the vendor's platform and use Streamable HTTP. They usually sign you in with OAuth, and many clients can share one.

The docs use Sentry as the remote example and the filesystem server as the local one. A remote server saves you from running anything; a local one keeps data on your machine.

Do you need one?

Not always. A coding agent with a shell can run gh, psql, curl and your own scripts. That is often lighter, because MCP tools load their definitions into the model's context. Anthropic's Claude Code docs address this with tool search, on by default, which defers MCP tool definitions until the agent needs them, so extra servers have minimal impact on your context window.

MCP earns its place when:

• the service has no good CLI;
• you want OAuth to a hosted product instead of a long-lived token in your shell;
• you want structured results and fine control over which tools are exposed;
• the client has no shell, such as a chat app or an IDE panel;
• you want a team to share one reviewed configuration.

The Playwright maintainers say something similar about their own server: for coding agents they suggest a CLI plus skills for token efficiency, and keep MCP for long loops that need persistent state. See our Playwright MCP page.

Install one: the same server, five agents

The shape is the same everywhere: a name, then either a command (local) or a URL (remote). The syntax differs by agent.

Claude Code

# remote (HTTP)
claude mcp add --transport http github https://api.githubcopilot.com/mcp/ \
  --header "Authorization: Bearer YOUR_GITHUB_PAT"

# local (stdio); the -- separates Claude's flags from the server command
claude mcp add --transport stdio playwright -- npx @playwright/mcp@latest

Add --scope user for all projects or --scope project to write .mcp.json for your team. Manage with claude mcp list, claude mcp get <name>, claude mcp remove <name>, or /mcp inside a session. Project servers need your approval before first use.

Cursor

Edit .cursor/mcp.json (project) or ~/.cursor/mcp.json (global):

{
  "mcpServers": {
    "playwright": { "command": "npx", "args": ["@playwright/mcp@latest"] },
    "github": {
      "url": "https://api.githubcopilot.com/mcp/",
      "headers": { "Authorization": "Bearer YOUR_GITHUB_PAT" }
    }
  }
}

Cursor also supports a one-click "Add to Cursor" flow from its marketplace, OAuth for remote servers, and ${env:NAME} interpolation.

Codex

codex mcp add context7 -- npx -y @upstash/context7-mcp
codex mcp list

Or in ~/.codex/config.toml (or .codex/config.toml per project):

[mcp_servers.github]
url = "https://api.githubcopilot.com/mcp/"
bearer_token_env_var = "GITHUB_PAT_TOKEN"

Codex can restrict tools per server with enabled_tools and disabled_tools, set startup_timeout_sec, and sign in to OAuth servers with codex mcp login <name>.

Gemini CLI

In ~/.gemini/settings.json (or .gemini/settings.json):

{
  "mcpServers": {
    "github": {
      "httpUrl": "https://api.githubcopilot.com/mcp/",
      "headers": { "Authorization": "Bearer $GITHUB_MCP_PAT" }
    }
  }
}

There is also a gemini mcp add command. Each server accepts includeTools and excludeTools lists, a timeout, and a trust flag. Leave trust false: when true, it bypasses tool-call confirmations for that server.

VS Code

VS Code uses a servers key, not mcpServers, in .vscode/mcp.json:

{
  "servers": {
    "playwright": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "@playwright/mcp@latest"]
    }
  }
}

Or from a shell: code --add-mcp '{"name":"playwright","type":"stdio","command":"npx","args":["-y","@playwright/mcp@latest"]}'. You can also run MCP: Add Server from the Command Palette. VS Code supports inputs with "password": true, so API keys are prompted for rather than stored in the file.

Format cheat sheet

A Claude Code JSON entry with a url but no type is a configuration error, because Claude Code reads an entry with no type as stdio. Many "paste this into your config" blocks omit it.

Where to find servers

The reference repo is blunt about itself: its servers are "reference implementations" meant as educational examples, not production-ready solutions. It tells you to browse the registry for a list instead.

Servers worth knowing, by job

We list a server here only when we checked its repo or docs. Each name links to its own page.

Code and repos

Docs and research

Browser and design

Team and tickets

Data and infrastructure

A note on movement: several early reference servers are now archived in modelcontextprotocol/servers-archived, including GitHub, GitLab, Google Drive, PostgreSQL, Puppeteer, Redis, Sentry, Slack and SQLite. Old tutorials still point at them. Use the vendor's current server instead. Our own pages say which one.

Security: what actually goes wrong

An MCP server is code you run, or a service you sign in to, with access to real systems. Four risks matter.

1. Over-broad access. A token with write access plus an agent that makes mistakes is how files and repos get changed. Prefer read-only scopes, one repository, one database role.

2. Prompt injection. Anything the server fetches, such as an issue, a web page or a chat message, may contain instructions aimed at the model. Claude Code's docs say to verify you trust each server and warn that servers that fetch external content can expose you to this risk. Do not combine a write-capable tool with an untrusted-content tool and an unattended run.

3. Supply chain. A local server started with npx -y something@latest runs whatever that package is today. Pin versions for shared configs, and prefer servers from the vendor or a source you recognise.

4. Leaked secrets. Tokens pasted into .mcp.json or mcp.json get committed. Use environment variables, VS Code inputs, Codex bearer_token_env_var or OAuth.

Controls that exist today:

Limits and common problems

• Context cost. Tool definitions use tokens. Claude Code defers them with tool search by default; other agents may load everything. Trim toolsets.
• Output size. Claude Code warns when a tool result passes 10,000 tokens and caps at 25,000 by default, configurable with MAX_MCP_OUTPUT_TOKENS. Larger results are saved to a file.
• Slow starts. Local npx servers can take time to launch. Claude Code honours MCP_TIMEOUT; Codex has startup_timeout_sec.
• Wrong config file. The top-level key differs between agents (mcpServers vs servers vs TOML). This is the most common reason a server does not appear.
• Windows. The reference README says to wrap npx with cmd /c on Windows.
• OAuth quirks. Some services need a fixed callback port or pre-registered credentials; Claude Code has --callback-port and --client-id for that.
• Maintenance risk. Check the last commit and whether the repo is archived before you depend on a server.

How to choose

1. Start from a job you repeat weekly. Do not install a server because it is popular.
2. Prefer the vendor's own server over a third-party clone.
3. Prefer remote with OAuth for hosted services, local for anything touching your files.
4. Check licence, last release and archive status on GitHub.
5. Read the tool list. If it has tools you would not give an intern, switch them off.
6. Start read-only. Add writes when you trust the workflow.
7. Install one at a time and look at your context usage after each.

For lists organised for Claude Code specifically, see Claude Code MCP servers. To see which agents can act as MCP clients, see MCP clients.

Our take

We wrote this page from the protocol docs, the reference repo and each agent's own guide. We did not install every server named here.

MCP has become the default way to attach a service to an agent, and the standard is healthier than the server market around it. The protocol is documented, versioned and implemented by every major client. The servers are uneven: some are vendor-maintained and current, some are abandoned reference code that tutorials still recommend.

Our advice is plain. Install fewer than you think. Three or four servers matched to a real weekly job beats thirty from a list. Check that each is maintained, scope each token tightly, and keep write access on a short leash. When a CLI does the same job, use the CLI.

The most useful habit we can suggest: when you add a server, read its tool list the way you would read an app's permission screen.

Frequently asked questions

What is an MCP server? A program that gives an AI application tools, data or prompt templates through the Model Context Protocol.

How do I install an MCP server in Claude Code? claude mcp add --transport http <name> <url> for remote, claude mcp add <name> -- <command> for local.

Are MCP servers safe? They run with the access you give them. Trust the source, scope the token and prefer read-only.

Where do I find MCP servers? The official MCP Registry, and community lists such as Awesome MCP Servers.

Do I need MCP if my agent has a shell? Not always. A CLI is often lighter. MCP helps with OAuth, structure and shell-less clients.

*Product names are used descriptively. We are not affiliated with the Model Context Protocol project, Anthropic or any server vendor named here.*