development

Best MCP Servers

The best MCP servers ranked on independent evidence: what each one does, how it connects, what it costs, what the benchmarks show and the security risks, plus the wider list of official servers worth knowing.

Updated October 2026

Quick answer: The best MCP server for most people is GitHub MCP Server, because it is free, maintained by GitHub itself, has been generally available as a hosted server since 4 September 2025, and is used in all three major independent MCP benchmarks — MCPMark, MCP-Universe and MCP-Atlas. For browser automation, Playwright MCP is the better choice, because Microsoft’s server is free, runs locally and is the browser environment in both MCPMark and MCP-Universe. For current library documentation inside a coding agent, Context7 is the pick, because it rated “Trial” on the Thoughtworks Technology Radar and has 62,600 GitHub stars. The one caveat: every MCP server you connect widens what a prompt injection can reach, so connect the fewest servers that do the job and use read-only modes wherever a server offers one.

Which one should you pick?

• You write code and use GitHub: GitHub MCP Server. Hosted, free, OAuth sign-in, and a --read-only mode.
• Your agent needs to click through websites or test a web app: Playwright MCP.
• Your coding agent keeps inventing APIs that do not exist: Context7. Free for 1,000 calls a month.
• You are debugging front-end performance, network or console errors: Chrome DevTools MCP.
• You are not a developer and want Claude or ChatGPT to read your team’s docs: Notion MCP. Hosted, OAuth, no install.
• You want an assistant to work with files on your own computer: Filesystem, scoped to one folder.
• Your agent needs clean text from web pages: Firecrawl MCP.
• Your agent needs plain web search at the lowest cost: Brave Search MCP.
• You plan product work in Linear: Linear MCP. Hosted, OAuth, with a read-only endpoint.
• Your company’s own data is the point: build or adopt an internal server. In The Pragmatic Engineer’s survey of 46 engineers (9 December 2025), the median user’s main need was reaching their company’s own data through an internal MCP server, not a public one.

What this page covers, and what it does not

An MCP server is a small program that gives an AI assistant a set of tools — read a repository, open a web page, query a database — through the open Model Context Protocol. This page ranks the servers you plug into an assistant or agent. It does not rank the frameworks you build an agent with: those are on our best AI agent frameworks page. It does not rank model access either: the APIs that serve the model itself are on our best LLM APIs page. In short, a framework is how you build the agent, an LLM API is the model behind it, and an MCP server is a tool the agent can use. For how agents use tools in general, see what is agentic AI. Most MCP servers on this page are used from coding agents and AI apps; those are ranked on our best AI for coding and best AI agents pages.

The current state of MCP

The Model Context Protocol was introduced by Anthropic in November 2024 and is now governed by the Linux Foundation. Anthropic donated MCP to the Linux Foundation’s new Agentic AI Foundation on 9 December 2025, co-founded with Block and OpenAI and backed by Google, Microsoft, AWS, Cloudflare and Bloomberg. The Agentic AI Foundation reported 247 members after its August 2026 intake.

MCP SDKs were downloaded more than 110 million times a month by April 2026, according to the Agentic AI Foundation’s MCP Dev Summit report. The figure was 97 million a month in December 2025, per Anthropic.

The current specification is 2026-07-28, finalised on 28 July 2026. It makes the protocol’s core stateless by removing the initialisation handshake and session IDs, which makes hosted servers easier to scale behind ordinary load balancers. The same revision deprecates the legacy HTTP+SSE transport and the Roots, Sampling and Logging features. GitHub announced support for the new specification in its MCP server on 23 July 2026.

The number of servers is large and mostly noise. Glama’s directory listed more than 94,000 MCP servers on 1 October 2026 (Glama); Smithery listed more than 24,000 (Smithery). The official MCP Registry, launched in preview on 8 September 2025, still describes itself as a preview in which “data resets may occur”. A third-party crawl by MCP Queen counted 18,849 servers in the official registry in July 2026 and found 17.2% of the advertised remote endpoints dead; we could not confirm that count from an official source.

Heavy use is concentrated in a few servers. The Pragmatic Engineer’s December 2025 survey found that only around ten public servers from major developer-tool companies see heavy use, naming GitHub, Linear, Figma, Sentry, Confluence, Playwright, Notion and Context7 among them. In the Stack Overflow 2025 Developer Survey, 34.4% of developers who use AI agents said they use them with MCP servers.

Two shifts change how to pick a server. First, hosted (remote) servers have replaced local installs for most SaaS tools: GitHub, Notion, Linear, Atlassian, Sentry, Stripe, Figma, Slack, HubSpot and others now run official servers you connect to by URL and sign into with OAuth. Second, context cost is now a selection criterion: every tool a server exposes is described to the model on every turn. Anthropic showed in November 2025 that letting the model write code against MCP tools instead of loading them all cut one workflow from 150,000 tokens to 2,000, a 98.7% reduction, and Cloudflare’s Code Mode made the same argument in September 2025. Servers with toolsets, lean modes or few tools are cheaper to keep connected.

How we ranked MCP servers

A server is ranked here only when there is more than one kind of independent evidence about it: an independent benchmark, an audit, a hands-on expert review, a survey of users, or community adoption at volume. A vendor’s own claims are reported beside that evidence, labelled as the vendor’s, and never instead of it. Servers that are real and credible but lack independent assessment are listed separately as not ranked.

One limitation applies to every number in this section. No published benchmark scores the quality of a server on its own. MCPMark, MCP-Universe and MCP-Atlas measure how well AI models complete tasks through a server. A server’s appearance in those benchmarks is evidence that independent researchers chose it as the standard, working implementation for its job; the pass rates mostly describe the models. The only study that compared rival servers head to head on the same tasks is Alibaba’s Evaluation Report on MCP Servers (April 2025), and the services it tested have changed since.

The independent evidence at a glance

Best MCP servers ranked

Stars measure developer interest, not quality, and repositories that bundle many servers inflate the figure. The Filesystem figure covers the whole modelcontextprotocol/servers repository, not the Filesystem server alone.

The best MCP servers in depth

1. GitHub MCP Server — best MCP server overall

GitHub MCP Server is GitHub’s official server for working with repositories, issues, pull requests, GitHub Actions and security alerts from an AI assistant. The hosted version runs at https://api.githubcopilot.com/mcp/ and became generally available on 4 September 2025, with OAuth 2.1 sign-in replacing personal access tokens as the recommended method. A local version runs from a Docker image or a native binary. The repository is MIT-licensed.

Independent evidence: GitHub MCP Server is used in all three major MCP benchmarks: MCPMark (23 tasks), MCP-Universe (its repository-management domain) and MCP-Atlas. It is named in The Pragmatic Engineer’s survey as the public server engineers use for working across repositories. Its repository has 33,300 GitHub stars.

What the benchmarks show: Repository work is hard for models. GPT-5 succeeded on 30.30% of MCP-Universe’s repository-management tasks, its second-weakest domain (MCP-Universe). GPT-5 (medium) passed 47.83% of MCPMark’s GitHub tasks first time (MCPMark).

Key features: toolsets you can switch on and off to limit context cost; a --read-only mode; a “lockdown mode” that filters content from users without push access to a public repository; support for the 2026-07-28 MCP specification; GitHub Enterprise Cloud with data residency through copilot-api.<subdomain>.ghe.com/mcp.

Price: no charge for the server; a GitHub account is required.

Pros: official and actively maintained; hosted with OAuth, so no tokens to manage; read-only mode; the most independently tested server in the category.

Cons: exposes around 90 tools when every toolset is on, which is heavy on context; a public repository is an untrusted input channel.

The caveat that matters: In May 2025, Invariant Labs showed that a malicious issue in a public repository could instruct an agent using the GitHub MCP server to leak data from the user’s private repositories. Invariant described it as an architectural problem with agents that combine private access and untrusted input, not a bug in GitHub’s code. GitHub’s README says lockdown mode reduces this risk but “is not an authorization boundary”. Use a token or OAuth grant scoped to the repositories the agent needs.

Why it ranks first: GitHub MCP Server has the broadest independent evidence of any server, serves the largest group of MCP users (developers), costs nothing and is maintained by the platform it connects to.

2. Playwright MCP — best for browser automation

Playwright MCP is Microsoft’s official server for controlling a web browser from an AI agent. It reads pages through accessibility snapshots rather than screenshots, which makes element targeting deterministic and cheaper than vision-based control. It runs locally with npx @playwright/mcp, supports Chromium, Firefox and WebKit, and is Apache-2.0 licensed.

Independent evidence: Playwright MCP is the browser environment in both MCPMark (25 tasks) and MCP-Universe. It is named in The Pragmatic Engineer’s survey for browser automation and UI testing. Simon Willison published hands-on notes on using it with Claude Code in July 2025. Front-end educator Steve Kinney’s April 2026 comparison recommends it over Chrome DevTools MCP for cross-browser testing and fixing flaky tests. The repository has 37,700 GitHub stars.

What the benchmarks show: GPT-5 succeeded on 35.90% of MCP-Universe’s browser-automation tasks (MCP-Universe). GPT-5 (medium) passed 43.00% of MCPMark’s Playwright tasks first time (MCPMark).

Key features: accessibility-tree navigation; opt-in tool groups for vision, PDF and DevTools; a browser extension that attaches to your logged-in Chrome or Edge session; an HTTP mode with --port.

Price: free.

Pros: official; free; cross-browser; deterministic targeting; the standard browser server in independent research.

Cons: about 70 tools with every group enabled; the README states the server “is not a security boundary”, and its allowed and blocked origin settings are not one either.

Worth knowing: Microsoft’s own README now points coding agents to Playwright CLI with Skills as the more token-efficient route, and keeps the MCP server for agents that need a persistent browser session.

3. Context7 — best for up-to-date library docs

Context7 is Upstash’s server for pulling current, version-specific documentation and code examples for software libraries into a coding agent’s context. It addresses a specific failure: a model writing code against an API that changed after its training data was collected. The hosted endpoint is https://mcp.context7.com/mcp, authenticated with an API key; the MCP repository is MIT-licensed.

Independent evidence: Thoughtworks placed Context7 in the “Trial” ring of its Technology Radar in November 2025, reporting that it reduced code hallucinations; Context7 is not on the current edition of the Radar. It is named in The Pragmatic Engineer’s survey, where a respondent credited it with “fewer hallucinated APIs”. Its repository has 62,600 GitHub stars, the most of any single-purpose MCP server on this page. No benchmark has measured it.

Price (Context7):

Private repository parsing costs $5 per million tokens on paid plans.

Pros: solves the most common coding-agent failure directly; two tools, so cheap on context; free tier covers light use.

Cons: the free tier was cut in January 2026, according to third-party reporting, so heavy users now pay; documentation coverage depends on what Context7 has indexed.

4. Chrome DevTools MCP — best for front-end debugging and performance

Chrome DevTools MCP is the Chrome team’s official server for letting an agent inspect a live Chrome browser: performance traces, network requests, console messages and screenshots. It runs locally with npx chrome-devtools-mcp, is built on Puppeteer and is Apache-2.0 licensed. Its tool reference lists 59 tools across 11 categories.

Independent evidence: Steve Kinney’s April 2026 comparison frames the split as “driving versus debugging”: Playwright MCP for automation, Chrome DevTools MCP for Core Web Vitals, Lighthouse audits, network and console inspection, and memory profiling. Its repository has 52,800 GitHub stars. No benchmark has used it.

Price: free.

Pros: the only official server with Chrome’s performance and debugging tooling; a slim three-tool variant for token-sensitive use.

Cons: Chrome only; usage statistics are collected by default (turn off with --no-usage-statistics); performance-trace URLs may be sent to Google’s CrUX API (turn off with --no-performance-crux); exposes everything in the browser to the client.

Playwright MCP or Chrome DevTools MCP? Use Playwright MCP to make the browser do things across browsers. Use Chrome DevTools MCP to find out why a page is slow or broken. Kinney’s recommendation is to install both in lean configurations and enable each only when needed.

5. Notion MCP — best for team knowledge

Notion MCP is Notion’s official hosted server for reading and writing Notion pages and databases from an AI assistant. It runs at https://mcp.notion.com/mcp, signs in with OAuth only, and needs no install, which makes it the most practical server here for people who do not write code. Workspace admins can revoke connections through Notion’s admin tools.

Independent evidence: Notion is an environment in MCPMark (28 tasks) and is used in MCP-Universe and MCP-Atlas. It is named in The Pragmatic Engineer’s survey for accessing internal documentation.

What the benchmarks show: GPT-5 (medium) passed 41.96% of MCPMark’s Notion tasks first time, its lowest score of the five environments (MCPMark). MCPMark’s authors attribute the gap between local and remote environments partly to how much training data models have seen for each.

Benchmark version note: MCPMark tested Notion’s open-source local server. Notion’s README now says that local server is “no longer actively maintained or supported” and may be sunset; the hosted server is the supported route.

Price: no charge for the server, and Notion’s documentation states no plan restriction; a Notion account is required.

Pros: official; hosted; OAuth; admin revocation; works in any client that supports remote MCP servers with OAuth.

Cons: the lowest model success rate of MCPMark’s five environments; tool count not published.

6. Filesystem — best for local files

Filesystem is the MCP project’s reference server for reading, writing, searching and moving files inside directories you specify. It runs locally and is free. It is one of the seven reference servers the MCP steering group still maintains — Everything, Fetch, Filesystem, Git, Memory, Sequential Thinking and Time (MCP servers repository).

Independent evidence: Filesystem is an environment in MCPMark (30 tasks, the most of any environment) and is used in MCP-Atlas. It has also been independently audited: Cymulate found two vulnerabilities, CVE-2025-53109 (CVSS 8.4) and CVE-2025-53110 (CVSS 7.3), which let an agent escape the allowed directories. Both were fixed in version 2025.7.1 on 1 July 2025.

What the benchmarks show: GPT-5 (medium) passed 57.50% of MCPMark’s Filesystem tasks first time, higher than any remote environment (MCPMark).

Price: free.

Pros: simple; local, so files never pass through a third-party server; directory allow-list.

Cons: the MCP project calls its reference servers “reference implementations”, not production-ready products; an agent with write access can delete or overwrite files. Coding agents such as Claude Code and Cursor already read and write files in your project without it, so check whether you need it at all.

7. Firecrawl MCP — best for web scraping

Firecrawl MCP is Firecrawl’s official server for turning web pages into clean, model-ready text, with tools for scraping, crawling, searching and structured extraction. The hosted endpoint is https://mcp.firecrawl.dev/v2/mcp; a keyless tier offers scrape, search and parse with rate limits, and an API key or OAuth unlocks the full profile of 26 tools. The repository is MIT-licensed.

Independent evidence: In Alibaba’s Evaluation Report on MCP Servers (April 2025), Firecrawl’s search scored 58.33% accuracy at 15.4 seconds average latency, ahead of Tavily (47.99%), Brave Search (46.6%) and Exa (15.02%) and behind only Bing Web Search (64.33%). Those results date from April 2025 and every service has changed since. Its repository has 7,500 GitHub stars.

Price (Firecrawl): Free, 1,000 credits a month; Hobby, $19 a month for 5,000; Standard, $99 a month for 100,000; Growth, $399 a month for 500,000. Those are monthly-billing prices; annual billing is lower, from $16 a month. One page scrape costs one credit.

Pros: returns clean markdown rather than raw HTML; keyless tier for trying it; the best independent search-accuracy result among dedicated scraping and search servers.

Cons: paid at volume; independent evidence is dated; scraped pages are untrusted content that can carry prompt injections.

8. Brave Search MCP — best low-cost web search

Brave Search MCP is Brave’s official server for web, news, image, video and local search through the Brave Search API, with eight tools. It runs locally over stdio by default or over HTTP, authenticates with an API key and is MIT-licensed. It replaced the MCP project’s original Brave Search reference server, which is now archived.

Independent evidence: Brave Search scored 46.6% accuracy at 14.0 seconds in Alibaba’s Evaluation Report on MCP Servers (April 2025), using the older reference server. Brave Search is one of the 36 servers in Scale AI’s MCP-Atlas. It showed the highest use count of any server on Smithery’s directory on 1 October 2026 (87,600), although Smithery does not state the period that count covers.

Price (Brave Search API): $5 per 1,000 search requests, with $5 of free credit each month — about 1,000 free searches.

Pros: an independent search index rather than a resold one; predictable per-request pricing; a free monthly allowance.

Cons: returns search results, not full page text, so pair it with a fetch or scraping server for reading pages; lower accuracy than Firecrawl in the only head-to-head study.

9. Linear MCP — best for product planning and issue tracking

Linear MCP is Linear’s official hosted server for creating, finding and updating issues, projects, initiatives, cycles and comments in Linear from an AI assistant. It launched on 1 May 2025, built with help from Cloudflare and Anthropic, and runs at https://mcp.linear.app/mcp. A separate read-only endpoint runs at https://mcp.linear.app/mcp/readonly. It signs in with OAuth 2.1, a bearer token or a Linear API key, and supports Okta-managed enterprise sign-in.

What it is for: Linear MCP lets an assistant turn a planning conversation into tracked work — drafting issues from a spec, grouping them into a project, assigning them to a cycle — and lets a coding agent read the issue it is working on from a pasted link. Linear documents setup for Claude (desktop and web), Claude Code, Codex, Cursor, VS Code, Windsurf, Zed, Jules and v0.

Independent evidence: Linear MCP is named second in the list of public servers engineers use in The Pragmatic Engineer’s survey of 46 engineers (9 December 2025), for completing tickets by pasting issue links into an agent. No benchmark has used it, and we found no independent hands-on review. That is less independent evidence than any other server ranked here, which is why it ranks ninth.

Price: no charge for the server, and Linear’s documentation states no plan restriction; a Linear account is required.

Pros: official and hosted; OAuth sign-in; a dedicated read-only endpoint; covers planning objects (projects, initiatives, cycles), not just issues.

Cons: Linear’s documentation notes that remote connections sometimes need reconnecting and that multiple workspaces need separate configurations; the legacy /sse endpoint is deprecated.

Feature comparison: the full matrix

Tool counts are approximate and change with releases. Sources: each server’s README or documentation, linked in the sections above.

Which AI apps can use MCP servers

An MCP server only helps if your assistant can connect to it. Support varies by app and by plan.

Local servers such as Playwright MCP, Chrome DevTools MCP and Filesystem need an app that runs on your own machine: Claude Desktop, Claude Code, Cursor, VS Code or Gemini CLI. Web-only assistants can use hosted servers only.

Pricing: what you will actually pay

Most MCP servers are free; the cost is the service behind them and the model tokens the tools consume.

The hidden cost is context. Every connected server’s tool descriptions are sent to the model on every turn, so ten connected servers can consume tens of thousands of tokens before the model does any work. Anthropic’s November 2025 engineering post measured one workflow at 150,000 tokens with tools loaded directly and 2,000 when the model called them through code. Disable the toolsets you do not use.

Best for each situation

For developers on GitHub

GitHub MCP Server is the best choice, because it is the official, hosted, free route to repositories, issues, pull requests and Actions, and it is the most independently tested server. Turn on --read-only unless the agent needs to write.

For browser automation and end-to-end testing

Playwright MCP is the best choice, because it is the browser environment in both MCPMark and MCP-Universe and works across Chromium, Firefox and WebKit.

For coding agents that hallucinate APIs

Context7 is the best choice, because it injects current, version-specific documentation, and Thoughtworks rated it “Trial” for reducing code hallucinations.

For front-end performance and debugging

Chrome DevTools MCP is the best choice, because it is the only official server with Chrome’s performance traces, Lighthouse audits and network inspection.

For non-developers using Claude or ChatGPT

Notion MCP is the best choice, because it is hosted, signs in with OAuth and needs no install. If your team’s documents live elsewhere, use that vendor’s official hosted server instead — see the wider list.

For working with files on your own computer

Filesystem is the best choice, because it is free, local and limits the agent to directories you name. Run version 2025.7.1 or later.

For reading web pages

Firecrawl MCP is the best choice, because it returns clean text from pages and led the dedicated search and scraping servers on accuracy in Alibaba’s head-to-head study.

For web search on a budget

Brave Search MCP is the best choice, because it costs $5 per 1,000 searches with about 1,000 free searches a month from an independent index.

For product planning and issue tracking

Linear MCP is the best choice for teams that plan in Linear, because it is Linear’s official hosted server, covers projects, initiatives and cycles as well as issues, and has a read-only endpoint for agents that should only look.

MCP server security: the risks to know before you connect

MCP servers act with your permissions, and the content they return can contain instructions the model may follow. The security record since 2025 is long enough that it should shape which servers you connect and how.

The core risk is the “lethal trifecta”. Simon Willison defined it in June 2025 as an agent that has access to private data, is exposed to untrusted content, and can send data out. Any agent with all three can be tricked into leaking data. Connecting a GitHub server (private repositories), a scraping server (untrusted web pages) and an email server (a way out) to one agent creates exactly that combination.

Documented incidents:

What the audits found. Astrix Security studied 5,205 MCP servers in October 2025 and found that 88% need credentials, 53% rely on static secrets such as API keys, and 8.5% use OAuth (Astrix). A 2026 audit of 414 internet-facing MCP servers found 91.8% had no OAuth (arXiv). A separate 2026 study of 64,611 servers found automated MCP security scanners averaged 45.5% precision and 24.2% recall, so a scanner’s “safe” label is weak evidence (Hugging Face Papers).

How to connect servers safely:

1. Prefer official servers from the vendor whose data they touch. Every ranked server on this page is maintained by its vendor or by the MCP project.
2. Prefer hosted servers with OAuth over local servers holding long-lived API keys.
3. Use read-only modes — GitHub’s --read-only, Linear’s /mcp/readonly endpoint, Supabase’s read_only=true — unless the agent needs to write.
4. Avoid the lethal trifecta in a single agent. Keep servers that read untrusted content apart from servers that hold private data and can send it out.
5. Pin versions of local servers and update deliberately; the postmark-mcp attack arrived as a routine package update.
6. Keep human approval on for write actions. Leave your client’s confirm-before-running setting on for any tool that writes, sends or pays; the OpenAI Responses API, for example, exposes per-tool approval settings (OpenAI).

Other MCP servers worth knowing (not ranked)

These servers are real, official or widely used, and documented well enough to describe accurately, but none yet has enough independent assessment to be ranked. Each description below comes from the maintainer’s own documentation and is labelled as such. Figma, Sentry and Confluence are all named in The Pragmatic Engineer’s survey, which is the only independent assessment we found for them.

Developer tools

Cloud and infrastructure

Search, automation and creative

Reference servers to avoid. The MCP project has archived its original GitHub, GitLab, Slack, PostgreSQL, SQLite, Puppeteer, Brave Search, Google Drive, Google Maps, Redis and Sentry servers (MCP servers repository). Older tutorials still recommend them. Use the vendors’ official replacements listed on this page instead.

How to choose an MCP server

1. Start from the job, not the directory. With more than 94,000 servers listed on Glama alone, browsing is the wrong approach. Name the system the agent needs to reach, then look for that vendor’s official server.
2. Check who maintains it. An official server from the vendor whose data it touches beats a community wrapper, because the vendor controls the API and carries the liability. Community servers with large followings, such as Serena, are the exception rather than the rule.
3. Prefer hosted with OAuth. A hosted server signs in through your browser and holds no long-lived key on your machine. Local servers are right for browsers, local files and anything that should not leave your computer.
4. Count the tools. More tools means more context consumed on every turn and more ways for a model to pick the wrong one; tool-selection errors caused around half of all failures in LiveMCPBench (August 2025). Choose servers with toolsets or lean modes.
5. Look for a read-only mode and start there.
6. Check your client. A local server will not work in a web-only assistant, and ChatGPT’s custom MCP support depends on your plan.

How to add an MCP server

• Claude Code: run claude mcp add --transport http <name> <url> for a hosted server, for example claude mcp add --transport http notion https://mcp.notion.com/mcp (Anthropic).
• Claude (web and desktop): add a custom connector with the server’s URL and sign in through OAuth; the Free plan allows one custom connector (Anthropic).
• Cursor: add the server to Cursor’s MCP settings with its command (local) or URL (hosted); Cursor supports OAuth sign-in (Cursor).

What developers actually think

Most real MCP use is internal

The Pragmatic Engineer’s survey of 46 engineers found that the median user wants to reach their own company’s data through an internal server. Public servers are the minority of MCP use; the handful that matter are the developer tools on this page.

Context cost has become the main complaint

Tool definitions consume context on every turn, and two of the ranked servers now ship alternatives to themselves. Microsoft’s Playwright MCP README points coding agents to Playwright CLI with Skills as more token-efficient, and Context7 offers a CLI-and-Skills mode beside its MCP server. Anthropic’s code execution with MCP and Cloudflare’s Code Mode both argue that models handle tools better by writing code against them than by calling them directly.

Skills complement MCP rather than replace it

Agent Skills launched in October 2025 and became an open standard in December 2025. The common framing in 2026 treats Skills as packaged instructions and MCP as the connection to external systems, two layers of the same stack (Maxim).

Security is the reason teams hold back

The OX Security disclosure of April 2026, which Anthropic answered by calling the behaviour expected and leaving fixes to downstream developers, and the 2025 run of server CVEs have made security review the gating step for enterprise adoption. The MCP project’s Enterprise-Managed Authorization work, published on 18 June 2026, is the protocol’s response.

Frequently asked questions

What is an MCP server?

An MCP server is a program that gives an AI assistant or agent a set of tools — reading a GitHub repository, controlling a browser, querying a database — through the open Model Context Protocol. The assistant (the MCP client) connects to the server, sees the tools it offers, and calls them while working on a task. MCP was introduced by Anthropic in November 2024 and has been governed by the Linux Foundation’s Agentic AI Foundation since 9 December 2025.

What are the best MCP servers?

The best MCP servers are GitHub MCP Server (best overall and for developers), Playwright MCP (browser automation), Context7 (current library documentation), Chrome DevTools MCP (front-end debugging), Notion MCP (team knowledge), Filesystem (local files), Firecrawl MCP (web scraping), Brave Search MCP (low-cost web search) and Linear MCP (product planning and issue tracking). GitHub MCP Server ranks first because it is free, officially maintained, hosted with OAuth, and used in all three major independent MCP benchmarks.

What is the best MCP server for Claude?

The best MCP server for Claude depends on which Claude you use. In Claude on the web or mobile, only hosted servers work, such as Notion MCP and Linear MCP, which both document Claude setup. In Claude Code and Claude Desktop, local servers also work, which adds Playwright MCP, Chrome DevTools MCP and Filesystem. Claude’s Free plan is limited to one custom connector.

Are MCP servers free?

Most MCP servers are free, including GitHub MCP Server, Playwright MCP, Chrome DevTools MCP, Notion MCP and the Filesystem reference server. Servers for paid services charge through that service: Context7 is free for 1,000 calls a month and $10 per seat a month on Pro, Firecrawl from $19 a month, and Brave Search $5 per 1,000 searches after $5 of monthly free credit. Every server also costs model tokens, because its tool descriptions are sent to the model on every turn.

Are MCP servers safe?

MCP servers are as safe as the permissions you give them and the content they read. Documented attacks include tool poisoning (Invariant Labs, April 2025), a prompt injection through public GitHub issues that leaked private repositories (May 2025), and the first malicious MCP package, postmark-mcp, which copied users’ emails to an attacker (September 2025). Use official servers, prefer hosted servers with OAuth, turn on read-only modes, and avoid giving one agent private data, untrusted content and a way to send data out at the same time.

Where can I find a list of MCP servers?

The official MCP Registry at registry.modelcontextprotocol.io is the protocol’s own list, though it is still labelled a preview. Glama listed more than 94,000 servers on 1 October 2026 and Smithery more than 24,000. Most listed servers are unmaintained or unofficial, so the faster route is to check whether the vendor you need publishes its own server; the tables on this page list the major official ones.

What is the difference between a local and a remote MCP server?

A local MCP server runs on your own computer, usually started with a command such as npx, and suits browsers, local files and anything that should stay on your machine. A remote (hosted) MCP server runs on the vendor’s infrastructure, is reached by URL, and usually signs in with OAuth. Web-based assistants such as Claude on the web and ChatGPT can only use remote servers.

Does ChatGPT support MCP servers?

ChatGPT supports remote MCP servers only, not local ones. Full custom MCP connections are mainly a Business, Enterprise and Edu workspace feature, and OpenAI’s help centre and developer documentation describe plan eligibility differently, so check your own plan’s settings. Developers can also use remote MCP servers through the OpenAI Responses API.

How do I add an MCP server to Claude Code?

Run claude mcp add --transport http <name> <url> for a hosted server, for example claude mcp add --transport http notion https://mcp.notion.com/mcp. For a local server, use --transport stdio followed by the command that starts it. Claude Code warns when a tool returns more than 10,000 tokens and caps tool output at 25,000 tokens by default.

How many MCP servers should I connect?

Connect only the servers a task needs, because every connected server’s tools are described to the model on every turn. Anthropic measured one workflow at 150,000 tokens with tools loaded directly against 2,000 when the model called them through code. Fewer servers also means fewer prompt-injection paths and fewer wrong tool choices, which caused around half of all failures in LiveMCPBench.

Is MCP being replaced by Skills?

MCP is not being replaced by Skills. Agent Skills package instructions and scripts that tell a model how to do a task, while MCP connects the model to external systems; the two are used together. Some vendors, including Microsoft for Playwright and Upstash for Context7, now offer a CLI-and-Skills route beside their MCP server because it uses fewer tokens in coding agents.

Which MCP reference servers are no longer maintained?

The MCP project still maintains seven reference servers: Everything, Fetch, Filesystem, Git, Memory, Sequential Thinking and Time. It has archived its GitHub, GitLab, Slack, PostgreSQL, SQLite, Puppeteer, Brave Search, Google Drive, Google Maps, Redis and Sentry servers. GitHub, Brave and Sentry now publish official replacements.