Category: Model Context Protocol

The best MCP servers for AI coding are GitHub MCP Server for repository work, Context7 for current library docs, Supabase MCP or MCP Toolbox for database context, and Playwright MCP or Chrome DevTools MCP for browser validation. Firecrawl MCP is useful when an agent needs clean public-web evidence. Do not install all of them by default: choose the smallest maintained set that completes a defined workflow with bounded permissions.

This shortlist is for developers who need better agent context or controlled actions. It evaluates workflow components, not entries in another generic MCP server directory. Repository access, documentation, schema inspection, and test evidence each receive a separate trust boundary.

Why MCP Matters for Coding Agents

A model can reason about code already in its prompt. A coding agent can also edit files and run tools. The Model Context Protocol adds a standard client-server interface through which that agent can discover tools and retrieve resources from external systems. In practice, a useful server turns “guess what the repository, database, or browser contains” into “query the authorized source and return evidence.”

That distinction matters in four workflows:

• Repository: connect an issue, branch, pull request, and CI result.
• Documentation: retrieve the API version used by the project.
• Database: expose schema or query results needed to debug code.
• Browser: reproduce a UI failure and inspect the changed page.

MCP does not make the evidence correct or the action safe. A server defines capabilities; the host decides which capabilities to expose; credentials determine the reachable data; and a person remains accountable for consequential writes. The official MCP Registry helps with structured discovery and publisher identity, but registration is not a security audit or a guarantee of production readiness.

If the underlying problem is understanding relationships across a large codebase rather than reaching another SaaS API, Graphify adds structural code context that can complement narrower repository and documentation servers. The broader AI coding agents comparison explains how the host agent affects planning, tool use, and review.

How We Selected MCP Servers

We checked the official publisher repository or product documentation on July 15, 2026. Each selected project was unarchived and showed current maintenance activity. We did not rank by GitHub stars or count every tool as a benefit.

Five filters determined inclusion:

1. Provenance: the publisher, repository, and install path are traceable to an official source.
2. Coding value: the server improves a recurring step between issue, code, test, and review.
3. Permission control: teams can narrow projects, toolsets, credentials, or read/write effects.
4. Operational fit: the transport and authentication work with the intended host and environment.
5. Exit cost: credentials can be revoked, configuration removed, and the workflow restored without trapping project data.

Maintenance is a gate, not a lifetime promise. Recheck the repository, releases, security notices, and client compatibility. The official reference-server repository warns that its examples are not production-ready. This list therefore excludes the old archived PostgreSQL reference package.

Quick Comparison Table

MCP server	Best coding job	Access to constrain	Evidence checked	Main limit
GitHub MCP Server	Repos, issues, PRs, CI, security findings	Organization/repositories, OAuth or token scopes, toolsets, write tools	Official GitHub repository, active	A broad token can turn code lookup into repository mutation
Context7	Version-aware library docs and examples	Requested library, API key, returned source	Official Upstash repository, active	Retrieved examples still require version and project-fit review
Supabase MCP	Supabase schema, docs, local or hosted project work	Project reference, read_only, feature groups	Official Supabase repository, active	Production data and DDL make broad access high impact
MCP Toolbox for Databases	PostgreSQL and multi-database schema/query workflows	Database role, source, named tools/toolsets	Official Google APIs repository, active	Generated SQL is not automatically safe or efficient
Playwright MCP	Accessibility-tree-driven browser automation	Browser profile, origins, downloads, session state	Official Microsoft repository, active	Rich page state can consume context; the project notes CLI skills may be leaner for high-throughput agents
Chrome DevTools MCP	Console, network, performance, screenshots, live Chrome debugging	Browser instance/profile, exposed tabs, tool mode	Official Chrome DevTools repository, active	The connected browser can expose authenticated content and allow modification
Firecrawl MCP	Search, scrape, crawl, and clean public-web context	API account, domains, crawl depth, enabled tools	Official Firecrawl repository, active	External content is untrusted input and some operations consume paid credits

“Active” describes the verification date, not a promise about future support. Exact packages, endpoints, OAuth behavior, quotas, and prices should be checked in the linked source at rollout.

Best MCP Servers for AI Coding

Repository and Filesystem Context

GitHub MCP Server is the strongest first choice for GitHub-centered delivery. GitHub documents repository browsing, code search, commits, issues, pull requests, project boards, Dependabot alerts, and other security findings. It offers a GitHub-hosted remote server and a local option, plus installation guidance for coding hosts including Codex and Claude Code.

Start with one organization or a small repository set. Enable read-oriented repository and pull-request tools before issue creation, merges, workflow reruns, or file writes. For a bug-fix pilot, ask the agent to connect one issue to the relevant files, existing tests, and current CI result. Do not grant administration scope merely because a tool schema supports it.

For an unhosted worktree, limit filesystem roots to the project and exclude secrets and caches. Prefer the host's sandbox when it already has equivalent file tools; duplicated capabilities add ambiguity.

Database and Docs Context

Context7 is the focused choice for library documentation. Its official project describes version-specific documentation and examples delivered directly to the agent. This is useful when a dependency has changed since model training or when two major versions use similar names. Supply the exact library identifier and version when possible, then require the agent to cite the retrieved page in its implementation note. Documentation retrieval reduces guessing; it does not prove that a snippet matches your architecture.

Supabase MCP fits teams building directly on Supabase. The official project supports project-scoped configuration, a read_only option, and selected feature groups such as database and docs. A safe progression is local development, then a staging project with read-only database context, and only then narrowly approved writes. Never connect a production project to an exploratory agent session with a broad account-level credential.

MCP Toolbox for Databases is the better PostgreSQL-oriented alternative to the archived generic reference server. The maintained Google APIs project supports PostgreSQL and other databases through prebuilt tools and configurable toolsets. Give it a dedicated database role, expose schema inspection and bounded queries first, and keep migrations or unrestricted SQL in a separate approval profile. Database context should help code match the real schema; it should not let a prompt become an unreviewed migration operator.

Graphify can sit beside these servers: docs describe the external API, database tools reveal schema, and structural code context shows where that contract is used.

Browser and Testing Context

Playwright MCP is best when an agent needs structured page interaction and persistent browser state. Microsoft says the server uses accessibility snapshots rather than depending on screenshots or a vision model. That supports exploratory flows, self-healing tests, and iterative reasoning over page structure. Its own README also notes that CLI-plus-skill workflows may use fewer tokens for high-throughput coding, so test the MCP form against the host's existing Playwright CLI before standardizing it.

Chrome DevTools MCP is stronger for diagnosis. It exposes console messages, network requests, screenshots, and performance analysis from a live supported Chrome instance. Use it when the question is why the page failed, not merely whether a button can be clicked. Connect a disposable profile with test accounts. The official project explicitly warns that the server can inspect, debug, and modify data available in the browser instance.

Firecrawl MCP is the web-context choice, not a substitute for browser tests. It can search, scrape, interact with, and crawl public pages into cleaner agent-ready content. That helps an agent verify current API pages, migration notes, or competitor behavior before editing code. Restrict target domains and crawl depth, retain source URLs, and treat all retrieved page content as untrusted. A webpage can contain instructions aimed at the agent; provenance does not neutralize prompt injection.

Choose one primary browser path per task. Playwright for repeatable interaction, Chrome DevTools for runtime diagnosis, and Firecrawl for public-web retrieval have different evidence models. Loading all three into every session wastes context and creates overlapping tool choices.

Security and Permission Limits

The official MCP security guidance covers confused-deputy attacks, token handling, session risks, and consent. For a coding team, translate that into a small operational contract before the first connection.

Original Graphify illustration: read access and write actions should follow different approval paths, credentials, and logs.

Use a three-stage rollout:

1. Observe: list the exposed tools, run read-only tasks in a disposable project, and record every external system reached.
2. Constrain: reduce repository selection, project scope, database role, browser profile, feature groups, and toolsets to the minimum that passed the pilot.
3. Approve writes separately: require a human checkpoint for merges, issue changes, SQL, migrations, production browser actions, and any operation that triggers downstream automation.

Record the server version and source, owner, host version, enabled tools, credential identity and scopes, targets, timestamps, approvals, summarized calls, changed artifacts, and rollback result. Redact secrets.

Repository comments, docs, database text, and webpages can contain prompt injection. Retrieved content must remain data; it must not expand permissions, reveal secrets, or authorize another tool. Separate credentials by environment.

Define removal conditions before adoption. Disable and investigate a server when its publisher or package identity changes unexpectedly, the repository becomes archived or materially unmaintained, a security advisory affects the deployed version, requested scopes expand without a reviewed use case, logs disappear, output cannot be traced to a source, or the server duplicates a safer native capability. Also remove it when 30 days of observed work show no recurring task benefit. Revoke credentials first, remove client configuration second, clear cached session data, and verify that the endpoint can no longer access the target.

FAQ

Who should maintain MCP server configurations?

Assign one engineering owner for workflow fit and one security or platform approver for credentials and policy. Repository-specific configuration can live with the owning team, but shared defaults, allowed publishers, minimum versions, and revocation procedures belong in a centrally reviewed catalog. The planned Codex CLI Guide shows where project rules and shared agent configuration fit around these server entries.

What audit records should teams keep?

Keep the exact server identity and version, source URL, configuration diff, enabled tools, transport, credential scopes, target systems, trial task, approvals, tool-call timestamps, resulting code or data changes, and rollback test. Preserve enough information to reproduce why the agent acted without storing raw secrets or unnecessary sensitive content.

When should a team remove an MCP server?

Remove it when maintenance or publisher trust fails, permissions exceed the approved task, a security issue cannot be mitigated promptly, required logs are unavailable, outputs lack provenance, or another controlled tool provides the same capability. Remove unused servers on a scheduled review instead of leaving dormant credentials attached to every coding session.

Conclusion

The best MCP servers in 2026 form a small workflow-specific stack: GitHub MCP Server for repository evidence, Context7 for current docs, Supabase MCP or MCP Toolbox for database context, and one browser option matched to testing, diagnosis, or public-web retrieval. The selection is only good when its permissions and maintenance record are good.

Begin with one read-only server and one representative task. Measure whether it improves the accepted patch, not whether the demo looks impressive. Record the live tools, constrain access, add a human gate for side effects, and define the removal trigger before enabling writes. That discipline gives a coding agent useful context without turning every connected system into an implicit permission.

AI coding agents rarely fail because they cannot generate another function. They fail because they enter a repository with weak situational awareness: ownership is unclear, architectural decisions are scattered across commits, related files are not obvious, and the agent repeatedly searches and rereads code before it can make a safe change.

RepoWise approaches that problem by building a persistent, queryable index of a repository. Instead of treating a codebase as a folder that an agent must rediscover on every task, it combines structural, historical, documentary, decision, and health signals, then exposes the result through the Model Context Protocol (MCP).

This article is an independently researched English analysis inspired by a Chinese overview published by the WeChat account 如此才是. It preserves the source article's two editorial images, but verifies the product claims against RepoWise's current repository, documentation, release metadata, and public benchmark materials.

The current snapshot

As of July 15, 2026, the public GitHub repository had approximately 3,600 stars, and the latest GitHub and PyPI release was v0.31.0. The package requires Python 3.11 or newer, is classified as Alpha in its package metadata, and uses an AGPL-3.0-or-later license declaration. Those details matter because RepoWise is both an open-source local tool and the engine behind a hosted commercial service; teams embedding or modifying it for networked use should review the project's licensing terms rather than assuming that "open source" removes every obligation.

The useful way to understand RepoWise is not as another chat interface. It is an indexing and retrieval layer between a repository and an AI agent. The index is created once, refreshed as the repository changes, and queried by humans, editors, or MCP-compatible agents such as Claude Code, Cursor, Cline, and Codex.

Why a repository index can be more useful than a larger context window

A larger model context window can hold more text, but it does not decide which files matter, recover why a design exists, or distinguish an important hotspot from a peripheral utility. Loading more raw files may even increase cost and distraction.

RepoWise moves part of that work out of the live agent session. Its index records relationships and metadata that ordinary file search does not expose directly: symbol-level dependencies, ownership, churn, co-change, decision records, documentation freshness, and code-health signals. The agent can therefore ask for a task-shaped summary before opening source files.

That does not eliminate source inspection. An agent still needs exact code for implementation and verification. The index is best understood as a navigation and risk-assessment system: it helps the agent choose what to inspect and what else may be affected.

The five intelligence layers

RepoWise's architecture documentation describes five passes that feed one another.

1. Graph intelligence

Language-aware parsers extract files, symbols, imports, calls, and inheritance relationships. RepoWise then applies graph techniques such as PageRank, community detection, strongly connected component analysis, and execution-flow tracing. This allows questions such as "which module is central?", "what depends on this symbol?", and "where is the cyclic core?" to be answered from a model of the codebase rather than from directory names alone.

The graph is still an approximation. Dynamic imports, reflection, dependency injection, generated code, and framework conventions can obscure runtime behavior. RepoWise adds framework-aware resolvers and confidence scores, but a graph edge should be treated as evidence, not as proof that every runtime path has been captured.

2. Git intelligence

Git history supplies a different kind of structure: churn, file ownership, recent owners, bus factor, significant changes, and pairs of files that tend to change together even when no import edge connects them. That hidden coupling is especially useful before a refactor because a syntactically isolated file may still have a strong maintenance relationship with another component.

History also has limits. A squash-heavy repository, a recent migration, generated commits, or inconsistent author identities can make ownership and co-change statistics noisy. Teams should interpret them alongside current maintainership rather than automatically assigning reviewers from old commit counts.

3. Documentation intelligence

RepoWise can generate a Markdown wiki for modules and notable files, then combine full-text and vector search with graph signals. Documentation pages carry freshness and confidence metadata, and incremental updates regenerate affected pages instead of rebuilding the entire corpus.

This is the layer most likely to require an LLM provider. The deterministic graph, Git, health, and dead-code passes can run without one, while generated prose and semantic retrieval depend on the configured provider or a local model. Generated documentation should remain a map back to cited source, not a substitute for reviewing the implementation.

4. Decision intelligence

Architectural decisions are frequently the missing context in AI-assisted maintenance. RepoWise can connect decisions to the files they govern, whether those decisions were entered manually, recorded as ADRs, extracted from inline markers, or inferred from significant history. The get_why tool then retrieves those records before an agent proposes an architectural change.

This layer becomes valuable only when evidence quality is visible. An explicit ADR and a model-inferred rationale are not equivalent. RepoWise exposes verification and staleness concepts, but teams still need a governance habit: promote important inferred decisions into reviewed records and retire obsolete ones.

5. Code-health intelligence

The code-health engine scores files from 1 to 10 using deterministic markers across defect risk, maintainability, and performance. According to the official code-health documentation, the signals combine structural complexity, cohesion, duplication, coverage, Git behavior, ownership, and graph position. The score can also produce rule-based refactoring suggestions and ingest LCOV, Cobertura, Clover, or normalized coverage data.

This is more ambitious than a style linter, but it is not a bug oracle. A low score means "inspect this file sooner" rather than "this file is defective." A high score does not prove correctness, security, or adequate tests.

The nine core MCP tools—and a naming caveat

RepoWise documents nine core, task-shaped MCP tools:

Tool	Primary question
get_overview	What is this repository and where should I start?
get_answer	What does the indexed documentation say about this question?
get_context	What complete context is relevant to these files, symbols, or modules?
get_symbol	What are the exact source bytes and line bounds for this symbol?
search_codebase	Which files, symbols, paths, or concepts match this query?
get_risk	What is the blast radius, hotspot status, co-change set, and likely review need?
get_why	Which decisions explain this design?
get_dead_code	Which apparently unreachable or unused elements are safest to investigate?
get_health	Which files and signals deserve attention before a change or refactor?

The current MCP overview calls these the nine "core" tools, but v0.31.0 registers 16 tools in total. A single-repository server exposes 11 by default, including list_repos and generate_refactoring_code; workspace mode exposes 14 by default, and two graph-navigation tools can be enabled explicitly. Therefore, "nine tools" describes the curated flagship surface, not the total current server capability.

That distinction also exposes an important design trade-off. More tools can provide more capabilities, but every tool schema consumes context and gives an agent another choice. RepoWise's own benchmark discussion says a lean four-tool profile performed better on short tasks than exposing the full surface. Teams should configure the smallest tool set that matches their workflow.

What the benchmark numbers do—and do not—show

RepoWise publishes its benchmark harness and results in the repowise-bench repository. The repository is public and reproducible, but it is maintained by the RepoWise team rather than an independent third party. The strongest efficiency claims come from two different experiments and should not be blended into one universal promise.

First, a context-loading experiment over 30 recent non-merge Flask commits compared the token count of raw changed files, git diff, and get_context. The reported pooled counts were 64,039 tokens for full files, 14,888 for the diff, and 2,391 for RepoWise context. The often-quoted 96% reduction is therefore a comparison with loading the complete changed files, not a guarantee for every coding task.

Second, paired 48-task SWE-QA runs on Flask and scikit-learn used the same model, prompts, budget, and judge, with or without a four-tool RepoWise profile. The reported results included 49% to 70% fewer tool calls and 69% to 89% fewer files read. Dollar cost fell in those runs, but the maintainers explicitly note that prompt caching can reduce the practical cost difference on short tasks.

Most importantly, answer quality was described as roughly comparable, not improved. In the published table, Flask judge scores were 8.82 without RepoWise and 8.81 with it; scikit-learn scores were 8.72 and 8.23 respectively. The credible claim is narrower: the agent performed less exploratory work in those benchmark settings. Teams should reproduce the harness on their own languages, repository size, model, and task mix before forecasting savings.

The health benchmark is similarly promising but bounded. RepoWise reports a cross-project ROC AUC of about 0.737 across 21 open-source repositories and nine languages. In a separate comparison with CodeScene, it reported stronger recall, effort-aware ranking, and defect density under a fixed review budget, while the AUC difference was marginal and precision at 20% of lines was statistically tied. The benchmark repository also acknowledges weak within-size-band discrimination. That transparency is useful: part of the signal is that larger, more active files are riskier.

A practical installation path

For a local evaluation, start with the deterministic index rather than enabling every feature at once:

python -m pip install repowise
cd /path/to/your/repository
repowise init --index-only -y
repowise serve

The current package requires Python 3.11 or newer. The project also documents uv tool install repowise for an isolated CLI installation. repowise init can generate MCP configuration automatically; a manual configuration points an MCP client at repowise mcp /absolute/path/to/project.

After the basic index works, add one capability at a time:

1. Install the post-commit hook or watcher and verify that freshness warnings behave as expected.
2. Add an LLM provider only if the generated wiki and semantic question answering are valuable for the team.
3. Ingest coverage before using health scores to prioritize test work.
4. Review detected decisions and ownership with maintainers who know the repository.
5. Compare a small set of real tasks with and without RepoWise, measuring calls, files opened, latency, answer quality, and wrong turns.

This staged approach separates the value of deterministic repository intelligence from the value—and cost—of generated documentation.

Security, privacy, and licensing questions to ask

Self-hosted RepoWise processes source locally and stores derived artifacts under .repowise/, including graph data, embeddings, generated wiki pages, and Git metadata. If a cloud LLM provider is configured, the provider's data path and retention terms still matter. A local model can keep that generation path offline.

The project's current README also distinguishes source-code privacy from anonymous product telemetry: it says the CLI can send opt-out coarse usage data and documents repowise telemetry disable and DO_NOT_TRACK=1. That is more precise than saying the tool has no telemetry under every configuration.

Before wider rollout, review:

• whether .repowise/ artifacts may contain sensitive names, decisions, or generated summaries;
• whether the chosen LLM provider is approved for the repository;
• whether MCP access is scoped to the intended repository or workspace;
• whether generated docs and decisions are excluded from commits when appropriate; and
• how AGPL-3.0 applies to the team's deployment or any product integration.

Where RepoWise fits—and where it does not

RepoWise is most compelling for repositories where navigation cost and organizational memory are genuine bottlenecks: mature services, unfamiliar inherited systems, multi-repository platforms, or teams using several AI coding clients against the same codebase.

It is less compelling for tiny, short-lived projects where indexing and governance cost more than rereading the code. It also does not replace tests, runtime observability, security scanning, human review, or an authoritative architecture process. Static and historical intelligence can narrow the search space; it cannot prove production behavior.

The product's central idea is nevertheless sound: AI coding becomes safer when context is treated as maintained infrastructure rather than improvised prompt material. RepoWise packages that idea into an open-source index, a dashboard, and an MCP interface. The right evaluation question is not "does it make the model smarter?" but "does it help this team reach well-supported engineering decisions with less repeated exploration?"

Sources

• Original Chinese WeChat article by 如此才是
• RepoWise GitHub repository
• RepoWise v0.31.0 release
• RepoWise documentation: what it is and how it works
• RepoWise MCP tools overview
• RepoWise code-health documentation
• Public RepoWise benchmark repository
• RepoWise on PyPI

A source-control MCP server gives an AI client structured access to repositories, issues, pull requests, pipelines, projects, and security signals. GitHub's official MCP server is the strongest choice for GitHub data and actions. GitLab provides an official remote MCP server in beta. Bitbucket Cloud exposes an Atlassian MCP path. Azure DevOps has its own integration options. A local Git MCP is better when the job only needs commits, diffs, branches, and files on disk.

Do not choose by brand alone. Choose the narrowest boundary that completes the job. Reading a local diff does not require a token with organization-wide issue and pull-request permissions.

Which Git MCP server should you choose?

Need	Best starting point	Connection model	Main caution
GitHub repositories, issues, pull requests, Actions, or code security	Official GitHub MCP Server	Remote or local container/binary	Large tool surface and token scope
GitLab projects, issues, merge requests, and APIs	Official GitLab MCP server	Remote HTTP preferred; mcp-remote fallback	Current server status is beta and plan prerequisites apply
Bitbucket Cloud repositories and work items	Atlassian/Bitbucket MCP integration	Remote, OAuth-based	Confirm exact product coverage and workspace permissions
Azure Repos, Boards, Pipelines, and work items	Azure DevOps MCP integration	Product-specific	Keep the existing detail page canonical
Local commits, branches, diffs, and files	Local Git MCP server	Local stdio process	Filesystem and shell boundaries still matter
Public repository documentation	Read-only repository or documentation MCP	Remote or local	Do not grant write credentials for public research

This hub owns the comparison and workflow architecture. Use the existing GitHub MCP server page and Azure DevOps MCP server page for exact product configuration and release details.

Is there an official GitHub MCP server?

Yes. GitHub maintains github/github-mcp-server as its official MCP server. It can expose GitHub repositories, issues, pull requests, users, Actions, code security, Dependabot, discussions, labels, and other API-backed capabilities through configurable toolsets.

The official server supports:

• a remote GitHub MCP path for compatible clients;
• a local Docker image at ghcr.io/github/github-mcp-server;
• a locally built Go binary using stdio;
• toolset and individual-tool allow-lists;
• read-only mode;
• lockdown mode for public-repository content.

The official GitHub MCP repository is the source of truth for current installation, tools, and releases.

What tools does the GitHub MCP server expose?

GitHub organizes tools into toolsets. The exact list evolves, but the server documents groups for repository context, repositories, issues, pull requests, users, Actions, code security, Dependabot, discussions, Gists, Git operations, labels, notifications, organizations, projects, releases, secret scanning, security advisories, stargazers, and support documentation.

The default toolsets are deliberately smaller than “all.” GitHub currently documents context, repos, issues, pull_requests, and users as defaults. Enable only the groups the workflow needs.

Workflow	Suggested toolsets	Avoid initially
Repository Q&A	context,repos	Actions and write tools
Issue triage	context,repos,issues	Pull-request and release writes
Pull-request review	context,repos,pull_requests	Merge or branch mutation until validated
CI diagnosis	context,repos,pull_requests,actions	Workflow dispatch and rerun without approval
Security review	context,repos,code_security,secret_scanning,dependabot	Remediation writes until findings are verified

Smaller toolsets improve least privilege and help the model choose the right tool.

How do you set up the GitHub MCP server?

The local Docker pattern passes a GitHub token to the official image:

export GITHUB_PAT="your-token"

docker run -i --rm \
  -e GITHUB_PERSONAL_ACCESS_TOKEN="$GITHUB_PAT" \
  -e GITHUB_TOOLSETS="context,repos,issues,pull_requests" \
  -e GITHUB_READ_ONLY=1 \
  ghcr.io/github/github-mcp-server

An MCP client configuration can launch the same container over stdio:

{
  "mcpServers": {
    "github": {
      "command": "docker",
      "args": [
        "run", "-i", "--rm",
        "-e", "GITHUB_PERSONAL_ACCESS_TOKEN",
        "-e", "GITHUB_TOOLSETS=context,repos,issues,pull_requests",
        "-e", "GITHUB_READ_ONLY=1",
        "ghcr.io/github/github-mcp-server"
      ],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_PAT}"
      }
    }
  }
}

Client support for environment expansion differs. Never commit a literal personal access token to mcp.json, editor settings, or a repository.

What is the GitHub MCP server URL?

The correct remote URL and authentication flow depend on the client and current GitHub service documentation. Do not copy an endpoint from an unofficial blog. Follow the official host-integration or client-specific guide linked from GitHub's repository. Remote clients should prefer OAuth 2.1 where supported.

How do you configure read-only GitHub MCP?

Run the server with --read-only or set GITHUB_READ_ONLY=1. GitHub documents that read-only mode removes write tools, even if a requested toolset or individual-tool list would otherwise include them.

Read-only mode is the correct default for:

• repository discovery;
• issue summarization;
• pull-request review;
• release-note research;
• code-security finding analysis;
• tool evaluation.

Add write tools only after each proposed action has a clear approval and rollback path.

How does the official GitLab MCP server work?

GitLab's official MCP server connects MCP clients to GitLab projects, issues, merge requests, and APIs. GitLab's current documentation marks the server beta. It supports GitLab.com, Self-Managed, and Dedicated offerings with plan and feature prerequisites.

GitLab recommends HTTP transport:

{
  "mcpServers": {
    "GitLab": {
      "type": "http",
      "url": "https://gitlab.com/api/v4/mcp"
    }
  }
}

For a self-managed instance, replace gitlab.com with the instance hostname. GitLab also documents a stdio bridge through mcp-remote for clients that cannot connect directly:

{
  "mcpServers": {
    "GitLab": {
      "command": "npx",
      "args": ["mcp-remote", "https://gitlab.com/api/v4/mcp"]
    }
  }
}

The server uses OAuth 2.0 Dynamic Client Registration. On first connection, the client registers an OAuth application, requests authorization, and receives an access token. Review the current GitLab MCP server documentation because availability, protocol versions, and prerequisites continue to change.

GitHub MCP vs GitLab MCP

Dimension	GitHub MCP Server	GitLab MCP Server
Maintainer	GitHub	GitLab
Current maturity signal	Official open-source server with remote/local paths	Official server documented as beta
Local deployment	Docker image or Go binary	Server is part of GitLab; mcp-remote can bridge clients
Remote authentication	OAuth recommended; PAT for local setups	OAuth dynamic client registration
Surface controls	Toolsets, individual tools, read-only, lockdown	GitLab permissions, OAuth scopes, client and instance controls
Native work item	Issues and pull requests	Issues and merge requests
CI/CD	GitHub Actions toolset	GitLab pipeline and API operations as exposed

Use the platform that owns the source data. A GitHub wrapper that scrapes GitLab or a generic API tool usually adds risk without adding value.

How does Bitbucket MCP work?

Atlassian documents a way to interact with Bitbucket Cloud through MCP. Treat Bitbucket MCP and Bitbucket MCP server searches as product-integration queries, not proof that any similarly named repository is official.

Before connecting, confirm:

• whether the integration is hosted by Atlassian or a third party;
• whether it covers repositories, pull requests, pipelines, and workspaces;
• which OAuth scopes it requests;
• whether write actions are available;
• how data residency and organization policy apply.

Use Atlassian's Bitbucket Cloud MCP documentation as the current source of truth.

Where does Azure DevOps MCP fit?

Azure DevOps spans Repos, Boards, Pipelines, Artifacts, and related project data. An Azure DevOps MCP server can therefore expose more than Git operations. That breadth makes tool and permission scoping essential.

Use the Azure DevOps MCP detail page for server-specific setup. In this hub, apply the same decision rule:

• use repository tools for code and pull requests;
• use board tools for work items;
• use pipeline tools for build status;
• keep dispatch, approval, and deployment actions disabled until explicitly needed.

When should you use a local Git MCP server?

Use a local Git MCP server when the job can be completed from a checked-out repository. Typical tools read status, diffs, logs, branches, tags, commits, and file content. This avoids a cloud token and can work with unpushed changes.

A local Git server is better for:

• explaining the current diff;
• finding the commit that introduced a line;
• summarizing branch history;
• comparing two local branches;
• preparing a commit message;
• inspecting a repository without network access.

A hosted source-control server is better for:

• issues and pull requests;
• CI status and workflow runs;
• repository permissions and collaborators;
• release assets;
• organization-wide code search;
• code-security alerts.

Some queries use the term Git-MCP for a documentation service that turns public Git repositories into accessible context. Confirm whether a project operates on local Git, a hosting-provider API, or rendered documentation before granting credentials.

What is an MCP repository?

The phrase MCP repository can mean three things:

1. a source repository that contains an MCP server implementation;
2. a repository exposed as data through an MCP server;
3. a curated list or registry of MCP servers hosted on GitHub.

For discovery queries such as MCP servers repository, list of MCP servers GitHub, MCP registry GitHub, or MCP list GitHub, use a curated directory rather than this source-control integration guide. For a specific server's source, follow the repository link from its canonical product page.

The distinction matters because installing code from a GitHub repository is not the same as connecting the official GitHub MCP Server.

How do you design safe source-control workflows?

Start with read-only discovery, then add one bounded write action at a time.

Workflow 1: Issue triage

1. Read open issues with a named label.
2. Group duplicates and identify missing reproduction details.
3. Draft a comment without posting it.
4. Ask a human to approve the exact comment.
5. Post through an issue-only tool.

Workflow 2: Pull-request review

1. Read the pull request, changed files, tests, and linked issue.
2. Identify concrete risks with file and line evidence.
3. Draft review comments.
4. Require approval before publishing.
5. Never merge as an implicit continuation of review.

Workflow 3: CI failure diagnosis

1. Read the failed job and logs.
2. Correlate the failure with changed files.
3. propose a minimal fix and validation command.
4. Create a branch only after approval.
5. Open a pull request; do not deploy automatically.

Workflow 4: Release preparation

1. Read merged changes since the last tag.
2. Draft release notes with pull-request links.
3. Verify version and artifact checks.
4. Require approval for tag or release creation.
5. Record the actor, inputs, and resulting URL.

Each workflow separates analysis from mutation. That boundary makes the automation understandable and reversible.

How do you apply least privilege to GitHub MCP tools?

Permissions must be enforced by credentials and server configuration, not by prompts. A prompt that says “do not merge” cannot neutralize a token and tool that can merge.

Use these controls:

1. Enable only required toolsets. Avoid all during evaluation.
2. Prefer read-only mode. Add write tools after the read workflow passes.
3. Use repository-scoped credentials. Avoid broad classic PATs where finer options exist.
4. Separate environments. Use different tokens for personal, team, and automation contexts.
5. Protect secrets. Use environment variables or a secret manager and keep config files private.
6. Require branch protection. The MCP server should not bypass normal reviews and checks.
7. Use lockdown mode when appropriate. GitHub's lockdown mode filters some public content by contributor trust while leaving private repositories unaffected.
8. Log mutations. Capture the tool, user, repository, target object, approval, and result.

GitHub's official documentation recommends minimum scopes, separate tokens, rotation, and never committing credentials. Follow the hosting platform's current authentication guidance.

What GitHub MCP mistakes create the most risk?

Mistake	Why it fails	Better design
Enabling every toolset	Increases ambiguity and blast radius	Start with context,repos and add one job-specific set
Using an organization-wide write token	One prompt can affect many repositories	Use a repository-scoped, short-lived credential
Giving a generic API tool	Hides side effects and bypasses semantic routing	Expose explicit tools such as issue_read or create_pull_request
Letting issue text drive policy	Issues can contain prompt injection	Treat all repository content as untrusted data
Reviewing and merging in one autonomous step	Removes independent approval	Separate analysis, review publication, and merge permissions
Logging tokens or private code	Creates a second data leak	Mask credentials and minimize tool output retention

How do you troubleshoot a source-control MCP server?

Symptom	Likely cause	Check
Server starts but requests return 401	Missing, expired, or wrong token	Credential injection, OAuth completion, token scopes
Repository is invisible	Token lacks repository or organization access	Fine-grained repository selection, SSO authorization
Write tools are missing	Read-only mode or toolset filter is active	Server flags, environment variables, approved actions
Too many similar tools confuse the model	Toolsets are too broad	Enable fewer groups or individual tools
GitLab URL fails	Wrong hostname, endpoint, or prerequisites	Instance URL, /api/v4/mcp, GitLab version and feature settings
Docker server exits immediately	stdin, environment, or image problem	Run with -i, verify variable names, inspect logs
A tool works locally but not in an IDE	Client config syntax differs	Follow the official client-specific guide
Tool names collide across instances	Multiple servers expose similar names	Use supported prefixes or clear server names

Test a single read operation before debugging model behavior. Authentication and capability discovery must work before prompt tuning can help.

How do you evaluate a GitHub MCP server release or alternative?

When a query asks for GitHub MCP server release, official GitHub MCP server, or GitHub MCP server npm, verify these facts:

• The repository owner is github for the official server.
• The documented local distribution is the GitHub Container Registry image or a Go binary built from source.
• A similarly named npm package is not automatically the official server.
• Release notes and breaking changes come from the official repository.
• The server's license, security policy, and tool configuration match your use case.

The same provenance rule applies to niche terms such as PAL MCP GitHub, n8n MCP GitHub, Mixpanel MCP server GitHub, or Google Analytics MCP server GitHub. A GitHub link tells you where code is hosted; it does not make GitHub the vendor or auditor of that integration.

Frequently asked questions

Is GitHub MCP the same as GitHub Copilot?

No. GitHub MCP Server exposes GitHub data and actions through MCP. Copilot is an AI product that can act as an MCP client in supported environments. Copilot can connect to the server, but they are separate products.

Can the GitHub MCP server read and write files?

It can expose repository-content and Git-related tools according to enabled toolsets and permissions. Do not confuse those API-backed repository tools with a generic local filesystem server's read_file, write_file, and create_directory tools. Check the official tool list instead of relying on a search snippet.

Can GitHub MCP use Actions and Projects?

Yes, the official server documents toolsets for Actions and Projects. Enable them only when the workflow needs them. Workflow dispatch, project updates, and similar mutations should require approval.

Is GitLab MCP server official?

Yes. GitLab documents an official MCP server at the GitLab instance's /api/v4/mcp endpoint. Its current status is beta, so check the documentation for plan, version, and feature prerequisites.

Is Bitbucket MCP official?

Atlassian publishes Bitbucket Cloud MCP documentation. Follow that documentation and verify OAuth scopes. Do not install an unrelated package solely because its name contains “Bitbucket MCP.”

Should I use a GitHub remote MCP or a local container?

Use remote OAuth when the client and organization support it and centralized access fits the policy. Use a local container or binary when you need explicit toolsets, local process control, or a client that launches stdio servers. Both need least privilege.

What is mcp-use GitHub?

It usually refers to using an MCP client library or framework with GitHub, not a distinct official GitHub server. Connect the framework to the official server and follow both projects' configuration guidance.

Final recommendation

Use the official server for the platform that owns the data. Start GitHub MCP in read-only mode with context and repos, then add issues, pull requests, Actions, or security toolsets only for a named workflow. Use local Git for local history and uncommitted changes. Keep product pages canonical, credentials narrow, write actions approved, and every mutation auditable.

Sources

• GitHub's official MCP Server
• GitHub MCP host integration guidance
• GitLab MCP server documentation
• GitLab MCP clients documentation
• Atlassian: Interacting with Bitbucket via MCP

A browser MCP server lets an AI client inspect and operate a browser through Model Context Protocol tools. Playwright MCP is the strongest general choice for structured navigation and web testing. Chrome DevTools MCP is better for network, console, trace, and performance diagnosis. Firecrawl fits extraction and crawling. Browser-use-style servers fit autonomous browsing, while Selenium integrations fit teams that already depend on WebDriver.

The right server depends on the job. “Open a page” is not a useful selection criterion because almost every browser tool can do it. Ask whether the agent must test behavior, diagnose a browser, extract content, reuse a signed-in profile, or run a repeatable suite.

Which browser MCP server should you choose?

Primary job	Best starting point	Why	Main tradeoff
Navigate, click, fill, and assert UI behavior	Playwright MCP	Structured accessibility snapshots and deterministic browser tools	Rich snapshots can consume context
Debug console, network, performance, or Chrome internals	Chrome DevTools MCP	Direct DevTools capabilities and trace insights	Chrome-focused and exposes sensitive browser state
Crawl sites and return clean content	Firecrawl MCP	Extraction-first workflow	Not a full interactive testing framework
Run autonomous browsing loops	Browser Use MCP	Agent-oriented browsing abstractions	Behavior and safety depend on the specific implementation
Reuse established WebDriver infrastructure	Selenium MCP	Fits existing grids and test assets	MCP implementations vary; verify maintenance and tools
Script Chrome or Firefox from code	Puppeteer or Playwright libraries	Direct, testable code without a large MCP schema	Requires the agent to write and run scripts

Microsoft's Playwright MCP documentation now makes an important distinction: coding agents may prefer a Playwright CLI plus Skills for token-efficient, high-throughput work, while MCP remains useful for persistent state, rich introspection, exploratory testing, and long-running agent loops. The protocol is not automatically the best interface for every test.

What is Playwright MCP?

Playwright MCP is Microsoft's official MCP server for browser automation through Playwright. It lets an MCP client interact with web pages through structured accessibility snapshots instead of relying only on screenshots. The server exposes browser actions such as navigation, clicking, typing, form filling, tab management, console inspection, and page snapshots.

Use the existing Playwright MCP server page for package-specific details and updates. This guide owns the cross-product comparison and workflow design.

Why do accessibility snapshots matter?

An accessibility snapshot represents interactive page structure with roles, names, and references. That gives an agent a stable target such as “button named Submit” instead of asking a vision model to estimate pixel coordinates.

The model receives a smaller semantic problem:

1. inspect the current page structure;
2. select an element reference;
3. call a deterministic tool;
4. inspect the resulting state.

This approach improves repeatability, but it does not remove the need for visual validation. Layout bugs, overlapping elements, responsive breakpoints, and canvas content still require screenshots or other visual evidence.

How do you install Playwright MCP?

The standard local configuration launches the official npm package:

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": ["@playwright/mcp@latest"]
    }
  }
}

For Codex CLI:

codex mcp add playwright -- npx "@playwright/mcp@latest"

For a standalone HTTP endpoint:

npx @playwright/mcp@latest --port 8931

Then configure the client to connect to http://localhost:8931/mcp. The official repository lists Node.js 18 or newer as a requirement and documents client-specific setup.

How should you verify a Playwright MCP install?

Use a test page you control and ask the client to:

1. open the page;
2. read its title;
3. fill one non-sensitive field;
4. click a harmless button;
5. report the resulting visible state;
6. capture console errors and a screenshot.

A passing test proves more than server startup. It proves navigation, element resolution, action execution, state observation, and artifact return.

When should you use a Playwright MCP extension?

The Playwright browser extension connects the server to an existing Chrome or Edge session. This is useful when the workflow needs an already authenticated tab. It also raises risk because the agent inherits access to that browser state.

Use the extension only when all of these are true:

• the signed-in session is necessary;
• the profile contains no unrelated sensitive tabs;
• the allowed task and domains are narrow;
• the user can observe and stop the run;
• write actions have explicit approval.

For repeatable tests and CI, prefer an isolated context with known storage state.

How does Chrome DevTools MCP differ from Playwright MCP?

Chrome DevTools MCP focuses on inspecting and debugging a live Chrome browser. Its official repository highlights performance traces, network analysis, screenshots, console messages with source maps, and reliable automation built with Puppeteer.

Need	Playwright MCP	Chrome DevTools MCP
Cross-browser test intent	Strong: Playwright targets Chromium, Firefox, and WebKit	Chrome and Chrome for Testing are officially supported
Structured page actions	Core capability	Supported through Puppeteer-based automation
Network and console diagnosis	Available	Deeper DevTools-first emphasis
Performance traces and insights	Possible through testing tools	Core strength, including trace insights
Existing browser connection	Extension or endpoint modes	Browser URL, WebSocket endpoint, or auto-connect
Best user	Test author or exploratory agent	Web developer diagnosing Chrome behavior

Use the Chrome DevTools MCP server page for its exact configuration. Do not create a duplicate product profile inside this hub.

Chrome DevTools MCP can expose browser contents to the client. Its documentation warns users not to share sensitive browser data with MCP clients. It also documents usage statistics and a flag to disable them. Review those operational details before enterprise rollout.

Is Puppeteer MCP a separate official server?

Puppeteer is a JavaScript library for controlling Chrome and Firefox. The official Puppeteer repository currently points users toward chrome-devtools-mcp, a Puppeteer-based MCP server, for MCP browser automation and debugging.

That means a search for Puppeteer MCP, MCP Puppeteer, or Puppeteer MCP server may lead to three different things:

• Chrome DevTools MCP, maintained in the Chrome DevTools organization;
• a third-party MCP wrapper around Puppeteer;
• a custom server a team built over the Puppeteer library.

Verify repository ownership, package provenance, maintenance activity, and tools before installation. Do not assume a similarly named npm package is official.

When should you use Firecrawl MCP?

Firecrawl MCP is best when the goal is web extraction rather than interactive UI testing. It can turn web pages into cleaner content for search, research, or ingestion workflows. It is a poor substitute for validating a multi-step form, keyboard behavior, browser storage, or visual layout.

Use the Firecrawl MCP server page for its product-specific authentication and tools.

Choose Firecrawl when the output should be documents, structured data, or crawl results. Choose Playwright when the output should be evidence that a user flow works. Combine them only if the workflow truly needs both; overlapping web tools make agent routing harder.

What are Browser Use, Browser Tools, and Browser Control MCP servers?

These names describe a category, not one stable product. Searches such as browser use MCP, browser-tools-mcp, browser control MCP, browser tool MCP, MCP browser, and browser MCP extension can refer to unrelated projects.

Evaluate any candidate with this checklist:

Test	Evidence to request
Provenance	Official organization, signed release, package-to-repository link
Scope	Exact tool list and side effects
Browser boundary	New isolated profile, existing profile, or remote browser
Network boundary	Allowed and blocked origins; redirect behavior
Filesystem boundary	Download and upload directories; file:// access
Secret handling	Environment variables, secret files, masking, and logs
Observability	Screenshots, traces, console, network logs, and replay artifacts
Maintenance	Recent releases, security policy, issue handling

The generic name browser MCP server does not tell you whether the tool is safe, deterministic, or maintained.

When does Selenium MCP make sense?

Selenium MCP servers can bridge an AI client to WebDriver or a Selenium Grid. They make sense when a team already has browser infrastructure, page objects, and test environments built around Selenium.

However, “Selenium MCP” is not one universal implementation. Before adopting a server, confirm:

• whether it drives local WebDriver, a remote Grid, or a vendor cloud;
• which browsers and versions it supports;
• how sessions are isolated;
• whether it exposes raw script execution;
• how credentials and capabilities are passed;
• whether the project has a security and release process.

For a new AI-agent workflow, compare the maintenance quality and semantic tool design against Playwright MCP instead of selecting Selenium only because the term is familiar.

How do you design a reliable web-testing MCP workflow?

A reliable workflow separates intent, action, evidence, and decision.

1. Define the test oracle

State what counts as success before the agent acts. “Test checkout” is vague. A useful oracle is: “After submitting a valid test card, the URL is /confirmation, an order number appears, and no error console event occurs.”

2. Start from controlled state

Use a fresh or isolated browser context. Seed only the required storage state. Reset test data or create unique records.

3. Constrain the action space

Allow only the staging host and required identity provider. Block production payment, email, and admin systems. Restrict file access and downloads.

4. Collect independent evidence

Capture structured snapshots for semantic state, screenshots for layout, console messages for runtime errors, and network evidence for failed requests. One signal cannot prove every class of result.

5. Return a reproducible report

The report should include the tested URL, browser, viewport, initial state, action sequence, expected result, actual result, artifacts, and first failing step.

This structure turns an agent session into an engineering result another person can reproduce.

How do you secure a browser MCP server?

A browser MCP server is not a security boundary. Microsoft's Playwright MCP documentation states this directly. A page can contain prompt injection, a browser profile can contain secrets, and a powerful automation tool can click destructive controls.

Use layered controls:

1. Run an isolated profile. Do not expose a personal daily-use browser by default.
2. Allow-list origins. Include authentication redirects explicitly, then test redirect behavior.
3. Separate secrets. Use a secret file or vault injection; never type production credentials through the model transcript.
4. Restrict files. Keep uploads and downloads inside a disposable workspace.
5. Require approval for side effects. Purchases, messages, account changes, and data deletion need a human gate.
6. Disable unnecessary capabilities. Raw code execution, unrestricted origins, and unrestricted file access should be exceptional.
7. Capture an audit trail. Save actions, URLs, timestamps, and artifacts without logging secret values.
8. Treat page content as hostile. Website instructions cannot override the user's goal or tool policy.

Playwright MCP provides controls such as isolated sessions, allowed or blocked origins, filesystem restrictions, secret files, output modes, and browser profiles. Read the exact option semantics before relying on them. An origin filter is not automatically a complete network sandbox.

Why does a browser MCP server fail?

Symptom	Likely cause	What to check
Server starts but browser does not open	Missing browser runtime or display	Package requirements, headless mode, Docker image, DISPLAY
Click target is stale	Page changed after the snapshot	Take a new snapshot before acting
Existing Chrome connection fails	Debug endpoint, extension, or profile conflict	Browser URL, WebSocket endpoint, extension state, profile ownership
Two clients conflict	Both use one persistent profile	Use isolated mode or separate user-data directories
Login vanishes between runs	Isolated context discarded state	Load a test storage-state file or use a dedicated persistent profile
Redirected request bypasses assumptions	Origin controls were incomplete	Test redirect chains and enforce a real network policy
Context fills quickly	Tool schemas and snapshots are verbose	Narrow tools, use CLI/Skills, or save large outputs to files
CI hangs	Headed browser lacks display or sandbox config	Use documented headless/container configuration

Debug the transport first, then browser startup, page state, element resolution, action execution, and evidence collection.

What is a practical browser MCP evaluation scorecard?

Score candidates from 0 to 2 for each item: absent, partial, or strong.

Criterion	0	1	2
Official provenance	Unknown	Maintained third party	Vendor or established project
Deterministic targeting	Pixel-only	Mixed	Structured semantic references
Isolation	Shared profile	Optional	Isolated by default
Evidence	Text only	Screenshot or logs	Snapshot, screenshot, console, network/trace
Policy controls	None	Basic flags	Origins, files, tools, secrets, approvals
Operational fit	Manual only	Local repeatability	Local, remote, and CI patterns

Reject any server that scores zero for provenance, isolation, or policy controls, regardless of feature count.

Frequently asked questions

Is Playwright MCP the same as Playwright?

No. Playwright is the browser automation framework. Playwright MCP exposes browser capabilities as MCP tools. A coding agent can also use Playwright through code, CLI commands, or Skills without loading the MCP tool surface.

What is the official Playwright MCP package?

Microsoft's repository documents @playwright/mcp. Install from the official package and repository, and verify current requirements before pinning a release.

Can Playwright MCP connect to my existing browser?

Yes. The official server documents an extension mode for existing Chrome or Edge sessions. Use it carefully because it exposes the signed-in browser state to the MCP client.

Is Chrome DevTools MCP built with Puppeteer?

Yes. Its official documentation describes Puppeteer-based automation combined with Chrome DevTools features.

Should I use MCP for every browser test?

No. Use MCP when persistent interaction and rich inspection justify the context cost. Use code or a Playwright CLI plus Skills for deterministic, high-throughput test execution where a fixed script is clearer.

Can a browser MCP server safely browse arbitrary sites?

Not by default. Arbitrary pages can contain prompt injection and malicious downloads. Use isolation, network controls, restricted files, secret separation, and approvals.

Final recommendation

Start with Playwright MCP for interactive testing, Chrome DevTools MCP for Chrome diagnosis, and Firecrawl for extraction. Keep each product's detail page canonical. Evaluate generic browser servers by provenance and boundaries, not by their name. The strongest workflow combines semantic page state, visual evidence, runtime diagnostics, and a narrow security policy.

Sources

• Microsoft Playwright MCP
• Microsoft Playwright
• Chrome DevTools MCP
• Puppeteer
• Firecrawl documentation

ChatGPT and OpenAI Codex support the Model Context Protocol, but they use it in different ways. Codex acts as an MCP client for local stdio servers and remote HTTP servers. ChatGPT connects to remote MCP-powered apps through its Apps and developer-mode workflow. Choose the host first; the correct setup, transport, and security model follow from that choice.

This guide separates three products that search results often blur together:

• Codex as an MCP client connects tools to the Codex CLI and IDE extension.
• Codex as an experimental MCP server exposes a Codex engine to another MCP client through codex mcp-server.
• ChatGPT MCP apps connect ChatGPT web to remote, workspace-governed tools.

That distinction prevents the most common setup error: copying a local Codex stdio configuration into ChatGPT, which expects a remote app endpoint.

Does ChatGPT support MCP?

Yes. ChatGPT supports custom MCP-powered apps through developer mode, subject to plan, role, and product limitations. OpenAI's current help documentation says full MCP support, including write actions, is rolling out in beta for Business, Enterprise, and Edu workspaces. Pro users can connect read/fetch MCPs in developer mode, while full write support remains limited. The feature is on ChatGPT web, not mobile.

Question	Current answer	Practical consequence
Can ChatGPT connect to an MCP server?	Yes, as a custom app	Create the app in ChatGPT settings and provide a remote endpoint
Can ChatGPT connect directly to localhost?	No	Use a remote server or OpenAI's Secure MCP Tunnel for private/local infrastructure
Can an MCP app write data?	Plan- and permission-dependent; full support is beta	Treat every write tool as privileged and require confirmation
Can ChatGPT use several apps together?	Yes	Keep tool names specific so the model can choose correctly
Do server tool changes appear automatically?	No	An admin must review and publish changes to the frozen tool snapshot
Can agent mode use custom apps?	OpenAI currently says no	Test the intended ChatGPT surface before deployment

OpenAI changes availability and UI over time. Verify the current ChatGPT developer-mode requirements before you design a rollout.

How do Codex and ChatGPT MCP support differ?

Codex MCP and ChatGPT MCP solve related problems at different boundaries.

Dimension	Codex CLI or IDE extension	ChatGPT web app
Main role	MCP client for coding workflows	Host for workspace apps
Local stdio server	Supported	Not connected directly
Remote HTTP server	Supported	Required for a custom app
Configuration	codex mcp commands or config.toml	Apps UI plus endpoint and authentication
Governance	Local config, project policy, approvals	Admin publishing, RBAC, action controls, confirmations
Best fit	Repository tools, browser testing, local developer utilities	Business systems, shared knowledge, approved workflows

Use Codex CLI MCP when the tool belongs beside a repository and needs local process access. Use ChatGPT custom MCP when a workspace needs a shared, remote, governed integration.

How do you add an MCP server to Codex CLI?

The shortest path is the codex mcp add command. This example registers Microsoft's Playwright MCP package as a local process:

codex mcp add playwright -- npx "@playwright/mcp@latest"

Then inspect the configured server:

codex mcp list
codex mcp get playwright

Remove it with:

codex mcp remove playwright

Codex stores MCP server launchers in config.toml. A direct configuration is useful when you need environment variables, timeouts, or repeatable team documentation:

[mcp_servers.playwright]
command = "npx"
args = ["@playwright/mcp@latest"]

The official Codex repository describes Codex CLI as an MCP client and documents codex mcp for adding, listing, reading, and removing launchers. Check the current Codex configuration documentation when you need fields beyond the basic launcher.

How do you configure a remote MCP server in Codex?

A remote server uses a URL rather than a local command. The exact accepted fields can change with Codex releases, so confirm them against the current configuration schema. The conceptual configuration is:

[mcp_servers.company_tools]
url = "https://mcp.example.com/mcp"

If the server requires OAuth, complete the login flow through the client instead of pasting bearer tokens into a repository. Codex supports MCP OAuth credential storage and a local callback listener. Prefer the OS keyring when available.

How do you verify a Codex MCP server actually works?

Do not stop when the config parses. Use a five-part test:

1. Discovery: codex mcp list shows the expected server.
2. Startup: the local process starts without package, runtime, or path errors.
3. Capability: Codex can enumerate the intended tools.
4. Execution: a read-only prompt triggers one expected tool call.
5. Boundary: a disallowed operation fails or asks for approval.

A useful smoke-test prompt names the server and requests a low-risk fact: “Use the GitHub server to read the repository description; do not create or update anything.” This tests tool selection and permissions without creating data.

How do you add an MCP server to ChatGPT?

To add MCP to ChatGPT, create a custom app in developer mode and point it at a remote MCP endpoint. The UI is workspace- and role-dependent, but the current flow is:

1. Ask an admin or owner to enable developer mode for the workspace.
2. Enable developer mode for the authorized account.
3. Open Settings → Apps → Create, or the equivalent workspace Apps page.
4. Enter the remote MCP endpoint and metadata.
5. Select the authentication method.
6. Run Scan Tools and complete OAuth if required.
7. Create the draft app and test it in a new chat.
8. Review every tool and publish it only after the workspace owner approves its actions.

ChatGPT connects to remote MCP servers. For a server on a developer machine, private VPC, or on-premises network, use a supported private-connection method rather than opening an unauthenticated public port.

What should a ChatGPT MCP integration expose?

Expose small, explicit tools that match user jobs. A tool named create_linear_issue is safer and easier to route than a generic execute_api_request tool. Describe side effects in the tool schema, validate inputs on the server, and return concise results.

For product-specific integrations, keep the existing product pages canonical:

• Use the Linear MCP server for Linear-specific setup and tool details.
• Use the n8n MCP server for n8n nodes and workflow automation.
• Use the Supabase MCP server for database operations.
• Use the Atlassian MCP server for Jira and Confluence access.
• Use the Playwright MCP server for browser automation.

This hub explains the OpenAI host layer. The product pages own package names, tool lists, and vendor-specific installation details.

What is the OpenAI API MCP path?

The OpenAI API can call remote MCP servers as tools in agentic application flows. This is separate from ChatGPT's Apps UI and Codex's local client configuration. Your application sends a model request, declares a remote MCP tool, and controls which server and operations the model can use.

Treat an OpenAI MCP client as application code with three responsibilities:

• authenticate to the remote MCP server;
• restrict tools and actions to the user's job;
• log the server call, result, and approval decision.

Do not market an arbitrary API wrapper as an “OpenAI MCP server.” A server implements MCP; OpenAI models or products consume that server through a client surface.

Can Codex run as an MCP server?

Yes, but this is different from configuring Codex to consume MCP tools. The official repository documents an experimental codex mcp-server command that exposes Codex through stdio and JSON-RPC. Another MCP client can then control Codex threads and turns.

codex mcp-server | your_mcp_client

For inspection:

npx @modelcontextprotocol/inspector codex mcp-server

The interface is experimental and subject to change. Use it for controlled integration work, not as an undocumented production contract. The Codex MCP server interface lists its current transport and RPC surface.

Which MCP servers work well with Codex?

The best Codex MCP servers add structured context or actions that the coding agent cannot get safely from the repository alone.

Job	Server type	Example prompt	Guardrail
Read repository issues	Source-control MCP	“Summarize open bugs tagged regression.”	Start read-only
Test a web app	Browser MCP	“Reproduce checkout failure in staging.”	Isolated profile and allowed origins
Query a database schema	Database MCP	“Explain tables involved in invoice status.”	Read-only role, row and schema restrictions
Create a project ticket	SaaS MCP	“Draft a Linear issue from this stack trace.”	Require approval before create
Trigger an automation	n8n MCP	“Run the approved release checklist.”	Allow-list workflow IDs

Avoid installing every available server. Large tool catalogs increase ambiguity and context cost. Add the smallest server set that completes the workflow, then enable only the necessary tool groups.

How should you secure OpenAI and Codex MCP integrations?

MCP extends the model's reach, so the server boundary must enforce policy even when the prompt does not. Prompt instructions are not access controls.

Use these controls in combination:

1. Trust the server source. Pin packages or container digests where practical. Review updates before deployment.
2. Use least privilege. Give a read task read credentials. Split read and write toolsets.
3. Keep secrets outside prompts and repositories. Use environment injection, a secret manager, or OAuth.
4. Require approval for side effects. Creating issues, sending messages, changing records, and executing deployments need explicit gates.
5. Constrain network and filesystem access. A browser or shell tool should not inherit access to every host and directory.
6. Log tool identity and outcome. Record the user, server, tool, inputs, approval, result, and error class.
7. Defend against prompt injection. Treat tool output and retrieved pages as untrusted data. Never let external content rewrite system policy.

OpenAI warns that unsafe MCP servers increase prompt-injection and data-exposure risk. For ChatGPT workspaces, admins should review actions, use RBAC, and republish changed tool definitions. For Codex, keep project instructions and approval policy aligned with the server's real credentials.

Why is my ChatGPT or Codex MCP connection failing?

Symptom	Likely cause	Fix
ChatGPT cannot reach localhost	ChatGPT expects a remote endpoint	Deploy remotely or use a supported secure tunnel
Codex lists a server but exposes no tools	Server startup, protocol, or authentication failed	Run the command directly, inspect logs, and verify transport
OAuth works once and then expires	Refresh tokens are not issued	Enable offline/refresh access and recreate the app
The model selects the wrong tool	Names or descriptions overlap	Narrow the catalog and use action-specific tool names
Write tools fail after a server update	ChatGPT uses a reviewed snapshot	Ask an admin to refresh and approve changed actions
npx server fails on another machine	Runtime or package resolution differs	Document Node requirements and pin a known version
A local server sees the wrong project	Working directory or environment is wrong	Set the correct launcher directory and explicit variables

Debug one layer at a time: host configuration, transport, authentication, capability discovery, tool execution, then model routing. Mixing those layers produces vague “MCP does not work” diagnoses.

What is a reliable production rollout checklist?

Before publishing a ChatGPT app or sharing a Codex MCP configuration, confirm:

• The host and transport match: Codex local/remote versus ChatGPT remote.
• The server has a named owner and an update policy.
• Every tool has a clear description and bounded input schema.
• Credentials use the minimum scopes.
• Read-only mode is the default for evaluation.
• Write actions require approval and server-side authorization.
• A smoke test covers discovery, execution, failure, and audit logging.
• Tool output is treated as untrusted input.
• Product-specific pages remain canonical and receive internal links.
• The deployment date and tested versions are recorded.

Frequently asked questions

Is “Codex MCP” a client or a server?

It can mean either. Codex CLI is an MCP client that connects to configured servers. The experimental codex mcp-server command makes Codex itself available to another MCP client. State the direction whenever you document an integration.

Does ChatGPT Desktop support local MCP servers?

Do not assume ChatGPT Desktop behaves like Claude Desktop or Codex CLI. OpenAI's current custom-app documentation describes remote MCP apps on ChatGPT web. Verify the current product documentation before promising local desktop connectivity.

What is the fastest way to install MCP in Codex?

Use codex mcp add <name> -- <command> [args...], then verify it with codex mcp list and one read-only tool call. For Playwright, the official package documents codex mcp add playwright -- npx "@playwright/mcp@latest".

Does OpenAI support the Model Context Protocol directly?

Yes. OpenAI products expose several MCP integration surfaces: ChatGPT custom apps, Codex as an MCP client, the OpenAI API's remote MCP tool path, and the experimental Codex MCP server interface. Their configuration and security boundaries are not interchangeable.

Should I connect Linear, n8n, Supabase, Atlassian, or Playwright through this guide?

Use this guide to choose and configure the OpenAI host. Then follow the linked product detail page for its exact server, permissions, and tools. That prevents duplicate setup advice and keeps vendor-specific information current.

Final recommendation

Start with one read-only server and one observable job. For a developer, that might be Codex reading repository issues. For a workspace, it might be ChatGPT fetching an approved internal record. Prove discovery, permissions, and auditability before adding write tools. MCP creates the most value when the connection is narrow, explicit, and easy to inspect.

Sources

• OpenAI: Developer mode and MCP apps in ChatGPT
• OpenAI Codex configuration
• OpenAI Codex MCP client and server overview
• OpenAI Codex MCP server interface
• Microsoft Playwright MCP

MCP (Model Context Protocol) is an open protocol that lets an AI application connect to external tools and data through a standard client–server interface. An MCP server can expose actions, readable context, and reusable workflows. An MCP host such as an AI editor manages the connections, permissions, and model interaction.

The short version: MCP standardizes the connection. It does not make an untrusted server safe, guarantee that every client supports every feature, or make the model understand your system automatically.

MCP at a glance

MCP separates an AI application from the systems it needs to use. That boundary lets one host connect to many servers without inventing a new integration format for each service.

Entity	What it is	What it controls	Simple example
MCP host	The AI application	User experience, permissions, model access, client lifecycle	An AI coding editor
MCP client	A connection component inside the host	One session with one server	The editor’s connection to a repository server
MCP server	A program that exposes capabilities	Tools, resources, prompts, and server-side policy	A server that reads issues and creates pull requests
Tool	A callable operation	An action with typed inputs and results	create_issue
Resource	Addressable context	Data the application can read	A repository README or database schema
Prompt	A reusable interaction template	A guided workflow with arguments	A code-review checklist

This table reflects the current official MCP architecture. The protocol uses JSON-RPC 2.0 messages and separates its data layer from its transport layer.

Original Graphify illustration: one host creates a separate client connection for each server, while servers bridge to external systems.

What does “MCP” mean in software and AI?

In software, Model Context Protocol is a contract for exchanging context and capabilities between AI applications and external systems. “Context” includes more than text. It can include structured tool schemas, files, database metadata, images, and results returned by an operation.

MCP is not an AI model. The phrase MCP model is common in search, but the protocol does not replace an LLM. The model reasons over information that the host provides; the host and MCP client mediate server access.

MCP is also not a universal plugin runtime. A server can advertise a capability, but a host may not implement that capability. Always check the client’s support matrix before designing around resources, prompts, sampling, elicitation, or experimental features.

What is an MCP server?

An MCP server is a program that provides context or capabilities to an MCP client through the Model Context Protocol. The word “server” describes its protocol role, not its physical location. A server may run as a local child process or as a remote service.

A useful server has a narrow contract:

• It declares its identity and supported capabilities during initialization.
• It publishes typed descriptions of the tools, resources, or prompts it offers.
• It validates requests before touching an external system.
• It returns structured results or protocol errors.
• It enforces authorization at the system boundary, not only in natural-language instructions.

For example, an MCP server for API documentation could expose versioned OpenAPI documents as resources, a search_endpoint tool, and a prompt that guides an API migration. A local file MCP server could expose approved directories while blocking paths outside configured roots.

How do MCP servers work?

An MCP connection progresses through a predictable sequence:

1. The host starts or contacts the server. Local servers commonly use standard input/output. Remote servers commonly use Streamable HTTP.
2. The client initializes the session. Client and server exchange protocol versions, identities, and capabilities.
3. The client discovers capabilities. It can request tool, resource, or prompt lists when the relevant capability exists.
4. The host chooses what to expose. The application may filter tools, request user approval, or attach a resource to the conversation.
5. The model or user initiates work. The host routes a tool call, resource read, or prompt retrieval through the client.
6. The server validates and executes. It talks to the file system, API, database, or other backing service.
7. The result returns to the host. The host presents it to the model and user, records it, or asks for confirmation before the next action.

The client and server must negotiate a compatible protocol version. If they cannot, the connection should end rather than continue with ambiguous behavior. See the current MCP specification overview for normative requirements.

What messages does MCP use?

MCP uses JSON-RPC 2.0 requests, responses, errors, and notifications. A request has an identifier because it expects a response. A notification has no identifier because it does not.

This distinction matters during debugging. A connection can be alive while a capability request fails. Check the lifecycle in order: transport, initialization, capability negotiation, discovery, then execution.

Which transports does MCP support?

The architecture currently documents two primary transports:

Transport	Best fit	Process boundary	Key concern
stdio	Local tools and scripts	The host launches a child process	Environment, executable path, and local permissions
Streamable HTTP	Remote and shared services	The client contacts an HTTP endpoint	Authentication, authorization, TLS, and tenancy

Legacy SSE configurations still exist in clients and server documentation, but new remote integrations should prefer Streamable HTTP where the client and server support it. Transport selection changes deployment and trust boundaries; it does not change the meaning of tools, resources, or prompts.

What are MCP tools, resources, and prompts?

Tools perform operations, resources provide addressable context, and prompts package reusable interaction templates. They are complementary primitives, not three names for the same thing.

Original Graphify illustration: an operation control, a data surface, and a conversation template represent the three server primitives.

Primitive	Control pattern	Use it when	Avoid using it when
Tool	Usually model-controlled through host policy	The system must calculate, search, create, update, or delete	Static data can be read as a resource
Resource	Usually application-controlled	The host needs files, schemas, docs, or other context with a URI	The operation has side effects
Prompt	Usually user-controlled	A repeatable, parameterized workflow improves consistency	Enforcement or authorization is required

The official server concepts guide describes resources as passive data sources, tools as executable functions, and prompts as reusable templates. Host behavior still varies, so test the exact client you plan to support.

What is an MCP tool?

An MCP tool is a named operation with a description and an input schema that a server exposes to a client. The client discovers tools with tools/list and invokes one with tools/call.

A strong tool definition makes five things explicit:

• the operation and its side effects;
• required and optional inputs;
• input constraints;
• the shape of a successful result;
• failure conditions the caller can act on.

Tool descriptions influence model selection, but descriptions are not a security control. The server must validate inputs and permissions again when the tool is called.

What is an MCP resource?

An MCP resource is content identified by a URI that a client can discover or read. Typical resources include file contents, a database schema, API documentation, Git history, or an application record.

Resources work well when context has identity and structure. A URI such as repo://team/service/readme is easier to govern and cache than a large block copied into every prompt.

What is an MCP prompt?

An MCP prompt is a server-provided, parameterized message template for a repeatable interaction. A prompt might ask for a target branch and produce a structured code-review conversation.

Prompts improve usability. They do not enforce policy. If an operation must be blocked, enforce that decision in the host, gateway, server, or backing API.

What can clients provide to servers?

MCP is not one-way. Depending on negotiated capabilities, a server can ask the client to perform functions such as model sampling, collect structured user input through elicitation, or report roots that define relevant filesystem boundaries. The protocol also supports logging, progress, cancellation, and change notifications.

These features require careful consent design. A server asking a client to sample from a model creates a different cost and data boundary than a server returning a resource. Treat every negotiated capability as an explicit contract.

What is the MCP specification?

The MCP specification defines protocol messages, lifecycle rules, capabilities, transports, and security requirements for interoperable clients and servers. The authoritative source is the versioned documentation on modelcontextprotocol.io.

Use the versioned specification rather than a screenshot, logo, or unversioned tutorial when implementing protocol behavior. A Model Context Protocol logo can help readers recognize the project, but it does not prove compatibility or endorsement. Verify the protocol version and feature support instead.

The ecosystem also provides SDKs that implement protocol mechanics. Frameworks such as FastMCP reduce boilerplate, but what is FastMCP? It is an implementation framework, not a different protocol. An SDK can simplify server development while the wire contract remains MCP.

How do you get started with MCP?

Start with one low-risk job, not a large server collection:

1. Define the task: for example, read versioned API documentation.
2. Choose a host that supports the required primitive and transport.
3. Select a server from the Graphify MCP server directory or the official MCP Registry.
4. Verify the publisher, source repository, requested permissions, and installation command.
5. Install it in a test project with the smallest possible scope.
6. Confirm discovery before execution: list the server and inspect its published tools.
7. Run a read-only task with non-sensitive data.
8. Add write access only after reviewing an audit trail and approval flow.

An MCP installer or MCP server installer can reduce setup friction. It cannot decide whether a server deserves access. Keep the verification step even when installation takes one click.

How should you evaluate MCP safety?

MCP standardizes messages; safety comes from architecture and operations. Review these boundaries before connecting a server:

• Provenance: Is the endpoint or package linked from the publisher’s official domain or repository?
• Scope: Can the server access only the directories, accounts, and records required for the job?
• Side effects: Which tools create, update, delete, publish, or send data?
• Credentials: Are secrets stored outside shared configuration and process arguments?
• Transport: Is a remote connection authenticated and encrypted? Is a local executable pinned and reviewed?
• Tool change: Can the server change its advertised tools after connection? How will the host notify the user?
• Output trust: Could a file, web page, issue, or tool result contain instructions intended to manipulate the model?
• Recovery: Can you revoke tokens, stop the process, inspect logs, and undo actions?

The official reference-server repository warns that its examples are educational rather than production-ready. “Official,” “open source,” and “listed” are useful signals, but none replaces a threat model.

Where does Graphify fit?

MCP connects an AI assistant to capabilities. Graphify addresses a different problem: representing relationships across code, documents, and design artifacts as a queryable knowledge graph.

That distinction matters in complex repositories. A generic file tool can retrieve a file. A structured code-understanding layer can help an assistant relate symbols, modules, dependencies, and supporting documents before it edits. Graphify can therefore complement MCP-based workflows instead of replacing the protocol.

If your immediate need is a product-specific integration, use the dedicated profile or guide. Do not force product names such as Continue, Lovable, Emacs, or Google Analytics into a protocol definition page; link them from the relevant client or integration hub so each page owns a clear intent.

Frequently asked questions

Is MCP the same as an API?

No. An API defines how software interacts with a particular system. MCP defines how an AI host discovers and uses context or capabilities exposed by servers. An MCP server often wraps one or more APIs.

Is an MCP server always remote?

No. A server can run locally through stdio or remotely through Streamable HTTP. “Server” describes the role in the protocol.

Is MCP open source and free?

The specification and official SDK projects are openly available. Individual servers and the external services they access can use different licenses, prices, or account requirements. Check each package and service separately.

What is the official Model Context Protocol site?

The official documentation and specification are at modelcontextprotocol.io. The official server registry is at registry.modelcontextprotocol.io.

Do all MCP clients support the same features?

No. Clients differ in transports, primitives, authentication, approval UI, roots, sampling, and experimental-feature support. Capability negotiation prevents some mismatches, but you should still test the target host.

Can MCP reduce model context usage?

It can. A client can discover tools or load resources when needed instead of placing all integration instructions and data into every request. Actual savings depend on the host’s tool-discovery and context strategy.

Does MCP prevent prompt injection?

No. External content and tool results can contain hostile instructions. Hosts and servers need permission gates, input and output handling, isolation, and least-privilege access.

The practical takeaway

MCP gives AI applications a shared protocol for tools and context. The host manages the user experience, a client maintains each server connection, and the server exposes typed capabilities. Use tools for actions, resources for addressable data, and prompts for reusable workflows. Then add the controls the protocol cannot supply for you: provenance checks, least privilege, approvals, logging, and recovery.

For the next step, browse the curated MCP servers directory or read the deployment guide for local and remote MCP servers.

Claude MCP connects Claude Code or Claude Desktop to external tools and data through Model Context Protocol servers. In Claude Code, use claude mcp add for local stdio or remote HTTP servers, choose the correct configuration scope, run claude mcp list, and inspect /mcp before you let a server act on real data. In Claude Desktop, prefer reviewed desktop extensions or authenticated remote connectors where available.

This guide covers the current setup paths, configuration files, commands, server selection, and troubleshooting. Product-specific pages remain the canonical source for exact servers; this page explains how those servers fit into Claude.

Which Claude MCP setup should you use?

Claude supports more than one MCP experience. Pick the client and connection type before copying a command.

Goal	Use	Connection	Best setup path
Work in a terminal coding agent	Claude Code	Local stdio or remote HTTP	claude mcp add
Share a server definition with a repository	Claude Code project scope	Local or remote	Commit .mcp.json without secrets
Use local files or desktop apps in chat	Claude Desktop	Desktop extension/local server	Settings → Extensions
Connect Claude to a cloud service	Claude connectors	Remote MCP	Settings → Connectors and OAuth
Centrally govern enterprise connections	Managed Claude Code/Desktop	Managed configuration	Admin policy and allow/deny rules

Anthropic’s Claude Code MCP documentation recommends HTTP for remote servers and documents stdio for local processes. The legacy SSE transport is deprecated; use HTTP where the server offers it.

Original Graphify illustration: Claude connects to local code and files through a local process, and to cloud systems through an authenticated remote boundary.

How do you add an MCP server to Claude Code?

Use claude mcp add, place every option before the server name, and place -- before the executable for stdio servers. Then verify the saved definition and connection status.

How do you add a remote HTTP MCP server?

Use this form for a remote Streamable HTTP endpoint:

claude mcp add --transport http <name> <url>

Example with a placeholder endpoint:

claude mcp add --transport http docs https://mcp.example.com/mcp

For an OAuth-enabled server, add it first, open Claude Code, and use /mcp to authenticate. Avoid a static bearer token when the server provides a supported OAuth flow.

How do you add a local stdio MCP server?

Use this form for a reviewed executable that Claude Code should launch:

claude mcp add --transport stdio <name> -- <command> [args...]

Example with a generic local package:

claude mcp add --transport stdio local-docs -- npx -y example-docs-mcp

The double dash matters. Claude Code options such as --transport, --env, and --scope must appear before the server name. Server command arguments belong after --.

How do you pass environment variables?

Pass secrets to the server environment instead of embedding them in a shared file:

claude mcp add --transport stdio \
  --env SERVICE_API_KEY="$SERVICE_API_KEY" \
  service -- npx -y example-service-mcp

This keeps the literal value out of .mcp.json, but it may still be stored in local Claude configuration when passed as a value. Prefer environment expansion or the server’s OAuth flow for reusable setups. Never commit an API key.

What are the Claude MCP commands?

The core Claude MCP list command and management commands are:

claude mcp list

claude mcp get <name>

claude mcp remove <name>

claude mcp add-json <name> '<json>'

claude mcp add-from-claude-desktop

claude mcp reset-project-choices

claude mcp serve

Inside Claude Code, use:

/mcp

The /mcp panel shows connection status and available tool counts. It also starts OAuth login for supported remote servers. Treat claude mcp list as configuration evidence and /mcp as live-session evidence; you need both when debugging.

Which Claude Code MCP configuration scope should you choose?

Claude Code supports local, project, and user scopes. The scope controls where a server loads, who receives the definition, and where it is stored.

Scope	Loads in	Shared with team	Stored in	Best use
local (default)	Current project	No	Project entry inside ~/.claude.json	Experiments, personal credentials, one repository
project	Current project	Yes	.mcp.json in the repository root	Reviewed team configuration
user	All projects	No	~/.claude.json	Trusted personal utilities used everywhere

Add the --scope option before the name:

claude mcp add --transport http --scope project docs https://mcp.example.com/mcp

For the same server name, Claude Code uses this precedence: local, project, user, plugin-provided, then Claude connectors. A higher-precedence duplicate can make a correct lower-level definition appear ignored.

Original Graphify illustration: nested configuration scopes converge on one active definition when names or endpoints overlap.

What does .mcp.json do in Claude Code?

.mcp.json stores project-scoped MCP server definitions that a team can review and share through version control. Claude Code asks for approval before using a project-scoped server from this file.

A remote example:

{
  "mcpServers": {
    "docs": {
      "type": "http",
      "url": "${DOCS_MCP_URL:-https://mcp.example.com/mcp}",
      "headers": {
        "Authorization": "Bearer ${DOCS_MCP_TOKEN}"
      }
    }
  }
}

A local example:

{
  "mcpServers": {
    "repo-helper": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "example-repo-mcp"],
      "env": {
        "REPOSITORY_ROOT": "${CLAUDE_PROJECT_DIR:-.}"
      }
    }
  }
}

Claude Code expands ${VAR} and ${VAR:-default} in command, arguments, environment, URL, and headers. If a required variable has no value or default, parsing fails. Commit variable names and safe defaults—not secret values.

What does claude --mcp-config do?

The search phrases claude --mcp-config and claude code --mcp-config refer to starting Claude Code with an explicit MCP configuration file. Use it for an isolated configuration or automation that should not depend on the normal saved scopes.

claude --mcp-config ./path/to/mcp-config.json

Check your installed Claude Code version’s claude --help output before scripting this flag. CLI surface area can change faster than third-party tutorials.

How do you set up MCP in Claude Desktop?

For current Claude Desktop releases, Anthropic presents two primary paths:

How do you install a local desktop extension?

1. Open Settings → Extensions.
2. Browse the extension directory.
3. Install a reviewed extension.
4. Configure required values in the extension interface.
5. Restart or inspect extension logs if tools do not appear.

Anthropic’s local MCP server guide explains Desktop Extensions (.dxt) and organization controls. A DXT package reduces manual JSON and dependency work, but you should still review its publisher and requested access.

How do you add a remote connector?

1. Open Settings → Connectors.
2. Choose a pre-built connector or Add custom connector.
3. Use the URL published on the provider’s official site.
4. Authenticate and review OAuth permissions.
5. Enable only the tools needed for the task.

Remote connectors are appropriate for cloud services. Local desktop extensions are appropriate when the server must reach files or applications on your computer. Anthropic’s comparison of desktop and web connectors recommends matching the connection type to the data boundary.

What about claude_desktop_config.json and stdio?

Some local servers still document a manual Claude Desktop configuration. Follow the server’s current official instructions and use an absolute executable path if the desktop application cannot resolve your shell PATH. Prefer the extension UI when the same integration ships as a reviewed DXT.

Do not copy a random claude_desktop_config.json block without checking the package name, command, arguments, environment, and publisher. A JSON configuration is executable setup, not inert documentation.

What are the best MCP servers for Claude?

The best Claude MCP servers cover distinct jobs with little overlap. Start with two or three read-oriented capabilities.

Need	Recommended starting point	Canonical Graphify profile	Claude-specific note
Current library docs	Context7	Context7 MCP	Add project-specific usage instructions rather than loading every library
Code navigation and memory	Serena or Graphify	Serena	Scope indexing to the intended repository
Source control	GitHub	GitHub MCP Server	Start read-only; protect merge and write actions
Browser testing	Playwright	Playwright MCP	Use a separate test profile and non-production account
Database work	Supabase or Postgres	Supabase MCP, Postgres MCP	Use a read-only database role for exploration
Project planning	Atlassian	Atlassian MCP	Separate search from issue creation/editing
Knowledge and notes	Notion	Notion MCP	Confirm workspace and page access
Workflow automation	n8n	n8n MCP	Review downstream side effects before execution
Cloud documentation	AWS Docs	AWS Docs MCP	Keep documentation access separate from infrastructure control

How do Context7 and Claude Code work together?

Queries such as Claude Code MCP Context7 and Context7 MCP Claude Code belong to the dedicated Context7 profile. The integration pattern is simple: Claude calls a documentation tool with a library identity and version, then uses the returned official documentation while coding.

The benefit is freshness and version targeting. The risk is context volume and misplaced trust. Ask for the narrow documentation slice you need and retain links or identifiers that let you verify it.

How do Serena and Claude Code work together?

Queries such as Claude Code Serena, Serena MCP Claude Code, Serena Claude, and Serena Claude Code belong to the Serena profile. Serena focuses on semantic code navigation and editing workflows. Review its repository scope and edit capabilities before enabling it across projects.

Graphify covers a complementary need: it turns code, documents, and design artifacts into a living knowledge graph. Use this structural context when Claude needs to reason across modules rather than retrieve isolated files.

How do you add Supabase, Postgres, or MySQL?

Use the provider’s current endpoint or package instructions, then apply least privilege:

• Claude Code add MCP Supabase: begin with the Supabase MCP profile and a restricted project role.
• Claude MCP Postgres / Claude Postgres MCP: use the Postgres MCP profile and a read-only connection for inspection.
• Claude MySQL MCP / Claude Snowflake MCP / Snowflake MCP Claude: separate schema and query access from mutation or administrative operations.

Never give a general coding session a production owner credential.

How do you add Playwright or Puppeteer?

For add Playwright MCP to Claude Code, install Playwright MCP Claude Code, and Claude Playwright MCP, follow the Playwright MCP profile. Use a test account, isolate browser state, and confirm before submissions, purchases, or destructive actions.

For Claude Code Puppeteer MCP or Puppeteer MCP Claude Code, verify the package and publisher because similarly named community servers exist. Do not run browser automation against a personal profile that contains unrelated authenticated sessions.

How do you add GitHub, Atlassian, Jira, or Notion?

• For Claude Code GitHub MCP and add GitHub MCP to Claude Code, use the GitHub MCP profile. Start with repository read access.
• For Atlassian MCP Claude Code and add Atlassian MCP to Claude Code, use the Atlassian MCP profile and review site scopes.
• For Jira MCP Server Claude Code, route through the Atlassian/Jira product documentation and separate search from issue mutation.
• For Claude MCP Notion, use the Notion MCP profile and restrict page access.

What about memory, filesystem, and other specialized servers?

Use Claude memory MCP or Claude Code memory MCP only after you understand retention, deletion, and cross-project isolation. Use Claude filesystem MCP with explicit allowed roots. A filesystem server should not receive your entire home directory by default.

Specialized searches—including Claude MCP SSH, Claude Outlook MCP, Claude MCP PDF, Claude Projects MCP, Claude Code Stripe MCP, Vercel MCP Claude Code, Excalidraw MCP Claude Code, Unity MCP Claude, Claude Mac MCP RStudio, Sequential Thinking MCP Claude Code, Windows-MCP Claude, Claude Python MCP, and browser MCP Claude—represent separate trust and capability profiles. Verify each publisher and keep the exact product page canonical rather than relying on a generic list.

How do you verify a Claude MCP installation?

Use this sequence after every change:

1. Run claude mcp get <name> and confirm the saved type, command or URL, and scope.
2. Run claude mcp list and check whether the server connects.
3. Open Claude Code and run /mcp.
4. Inspect the live tool count and authenticate if required.
5. Ask Claude to describe the available tools without calling them.
6. Run one read-only operation with test data.
7. Review the returned source, server logs, and permission prompt.
8. Test one expected failure, such as an out-of-scope path or unauthorized write.

A successful connection proves transport and initialization. It does not prove that the right server is running or that every tool is safe.

Why is Claude MCP not working?

Diagnose the first failed layer instead of reinstalling everything.

Symptom	Likely cause	Check	Fix
Server not listed	Wrong scope or configuration not parsed	claude mcp list, JSON syntax, current directory	Re-add in the intended scope; fix missing environment variables
spawn ... ENOENT	Executable not in the app’s PATH	which <command>	Use an absolute path or install the runtime
Server disconnects at startup	Package crash, missing argument, or bad environment	Server stderr/logs	Run the command directly and resolve its first error
Authentication required	OAuth flow not completed	/mcp	Authenticate, then retry
Tools are missing	Capability mismatch, delayed connection, or server exposes no tools	/mcp tool count	Wait, update, or inspect the server’s advertised capabilities
Project server ignored	Duplicate name at a higher-precedence scope	claude mcp get, local/user config	Remove or rename the duplicate
.mcp.json fails	Undefined ${VAR} without a default	Shell environment and JSON	Set the variable or add a safe default
Huge context or slow selection	Too many servers/tools or large tool output	/mcp, response size	Disable unused servers; narrow tools and outputs
Desktop extension has no tools	Extension config or refresh issue	Settings → Extensions → logs	Review settings and restart Claude Desktop

Claude Code warns when a tool output exceeds 10,000 tokens and uses a default maximum of 25,000 tokens for tools without their own limit, according to the current official documentation. Use MAX_MCP_OUTPUT_TOKENS only after fixing unnecessarily broad queries.

Why does stdio connect in a terminal but fail in Claude Desktop?

Desktop applications often inherit a different environment from your interactive shell. Use an absolute executable path, provide required environment variables explicitly, and inspect the extension or server logs. Do not solve PATH errors by running the whole desktop app with excessive privileges.

Why does a server show zero tools?

The server may expose only resources or prompts, may require authentication before publishing tools, or may have declared the tools capability without returning tools. Inspect /mcp, server logs, and the server’s official capability documentation.

How do you secure Claude MCP?

Apply controls at several layers:

• Choose provenance: install from the provider’s official page or a verified registry record.
• Minimize scope: prefer local or project scope over user scope for task-specific tools.
• Protect secrets: use OAuth or environment expansion; never commit tokens.
• Separate read and write: use different credentials or server profiles where possible.
• Constrain local access: allow specific directories, not an entire home folder.
• Review live tools: a package name does not tell you every action it exposes.
• Require confirmation: protect destructive, publishing, financial, and external-message actions.
• Isolate browser state: use test accounts and dedicated profiles.
• Log and revoke: keep enough evidence to investigate and remove access quickly.
• Treat external content as untrusted: files, issues, pages, and tool results can contain prompt-injection attempts.

For teams, Claude Code supports managed MCP configuration and allow/deny policies. A deny rule takes precedence over an allow rule. Central policy reduces configuration drift but does not replace server-side authorization.

Frequently asked questions

What is Claude MCP?

Claude MCP is Claude’s use of Model Context Protocol to connect to external servers that expose tools, resources, or prompts. Claude Code, Claude Desktop extensions, and remote connectors use different configuration experiences.

Is Claude an MCP client?

Claude Code and Claude Desktop act as MCP hosts and manage client connections to servers. The underlying Claude model is not itself the network client.

Where is Claude Code MCP configuration stored?

Local and user scopes are stored in ~/.claude.json. Project-scoped servers are stored in .mcp.json at the repository root.

What is the Claude MCP server config format?

Each entry sits under mcpServers and defines a local stdio command or a remote URL. Use claude mcp add to generate the correct shape when possible.

How do I list Claude MCP servers?

Run claude mcp list in the terminal. Inside Claude Code, run /mcp to inspect live status, tools, and authentication.

Can Claude Code itself run as an MCP server?

Yes. Run claude mcp serve to expose Claude Code’s tools over stdio to another MCP client. The consuming client remains responsible for user confirmation and safety controls.

Are Claude Desktop MCP servers the same as Claude Code servers?

They can point to the same server, but configuration, packaging, scope, and supported features differ. Claude Code can import selected Desktop servers on macOS and WSL with claude mcp add-from-claude-desktop.

Which Claude MCP servers should I install first?

Install one server for your highest-value recurring job and one for supporting context. A documentation server plus a repository or code-understanding server is a strong read-oriented starting point.

Recommended Claude MCP rollout

Start in a disposable repository. Add one server at local scope. Inspect its live tools. Complete a read-only task. Record permissions and data flow. Move the definition to project scope only after review, and keep secrets in environment variables or OAuth storage. Add a second server only when it closes a measured capability gap.

For current product instructions, use the dedicated MCP server directory and exact product profiles linked above. For protocol concepts, read What Is MCP?.

A database MCP server connects an AI client to a data system through named tools and resources. Choose the server that matches the database and job, then restrict it to the smallest project, feature set, role, and network path possible. Supabase MCP is a strong managed Postgres option; PostgreSQL, MySQL, SQLite, MongoDB, Redis, Neo4j, Qdrant, Firebase, Elasticsearch, and dbt require different query and safety models.

Do not choose by database popularity alone. A read-only schema explorer, a migration tool, a vector-memory service, and an analytics assistant expose very different consequences when an agent calls the wrong operation.

Original Graphify editorial visual. The categories are abstracted from current database MCP use cases and do not reproduce vendor interfaces or artwork.

Which database MCP server should you choose?

Choose by data model, required action, and authority boundary. Start with read-only metadata and queries. Add writes, DDL, account administration, or deployment tools only after the workflow proves that it needs them.

Need	Good starting category	Examples from this guide	Main risk to control
Managed Postgres development	Platform-specific MCP	Supabase MCP	Account-wide access and mutating project tools
SQL inspection and tuning	Relational database MCP	Postgres MCP, MySQL MCP, SQLite MCP	Destructive SQL, locks, expensive scans, sensitive rows
Flexible document data	Document database MCP	MongoDB MCP, Firebase MCP	Broad collection access and writes with weak filters
Connected entities and paths	Graph database MCP	Neo4j MCP	Write-capable Cypher and large traversal cost
Semantic retrieval	Vector database MCP	Qdrant MCP, Chroma MCP, Pinecone MCP	Cross-tenant retrieval, untrusted stored text, embedding cost
Cache, streams, and agent memory	Key-value MCP	Redis MCP	Mutation, eviction, unbounded keys, production session exposure
Search and observability data	Search MCP	Elasticsearch MCP or its current successor	Large queries, cluster scope, and deprecated deployment paths
Analytics project context	Analytics MCP	dbt MCP	Running SQL in the wrong environment and exposing warehouse data

The term MCP database does not identify one canonical server. Several official vendor projects exist, while other repositories are community maintained. Verify the owner, release, license, transport, and permissions before copying a configuration.

What can a database MCP server expose?

A database MCP server normally converts model requests into a small set of database-specific operations. The exact tools vary, but they usually fall into five groups:

1. Metadata: list databases, schemas, tables, collections, indexes, graph labels, or vector collections.
2. Read: run SQL, aggregation pipelines, Cypher, search queries, or semantic retrieval.
3. Write: insert, update, delete, cache, publish, or create graph relationships.
4. Administration: create projects, branches, indexes, users, or storage resources.
5. Documentation and diagnostics: search product docs, inspect logs, explain plans, or report configuration.

Tool names are not security controls. The database credential, server-side allowlist, project scope, query policy, and client approval gate determine what an agent can actually do.

How should you secure a database MCP server?

Build the connection as if an untrusted prompt could reach every enabled tool. Database values, tickets, documents, and log records can contain instructions that try to redirect an agent. A model can also generate a harmful query without malicious input.

Original Graphify editorial visual. The pipeline separates environment, identity, tool, query, approval, and audit controls.

Use this order:

1. Connect a development, branch, replica, or sanitized dataset—not production.
2. Create a dedicated database identity; never reuse an owner or administrator credential.
3. Limit the identity to the necessary schema, database, collection, graph, or index.
4. Start in read-only mode and disable mutating tool groups.
5. Constrain network egress and ingress to the MCP process and database endpoint.
6. Keep manual approval enabled for tool calls, especially generated queries.
7. Set timeouts, row limits, cost limits, and statement restrictions server-side.
8. Log tool name, sanitized parameters, identity, result size, decision, and error.
9. Test prompt-injection strings stored inside database rows and documents.
10. Rotate credentials and delete cached results or local logs according to policy.

Read-only does not make data safe. A read-only role can still expose personal data, secrets, proprietary embeddings, customer documents, or a large export.

What makes Supabase MCP different?

Supabase MCP is a hosted and local development interface for Supabase projects, not merely a generic Postgres query wrapper. Its official documentation lists database, docs, debugging, development, functions, branching, storage, and account-management tool groups.

The current remote URL supports three important restrictions:

https://mcp.supabase.com/mcp?project_ref=YOUR_PROJECT_REF&read_only=true&features=database,docs

• project_ref limits access to one project and disables account-level tools.
• read_only=true runs queries as a read-only Postgres user and disables mutating tools.
• features enables only selected tool groups.

The Supabase MCP documentation recommends a development project, project scoping, read-only mode, feature restriction, branching, and manual review. Those are layered controls, not interchangeable switches.

Graphify already has an exact-product Supabase MCP profile. This hub owns the broader selection and security intent; it does not replace that setup page.

Which PostgreSQL MCP server should you use?

“Postgres MCP” describes several implementations, so identify the repository before installing anything. Graphify’s current exact-product Postgres MCP profile covers crystaldba/postgres-mcp, a server focused on database analysis and performance work with restricted and unrestricted access modes.

Common search variants—including postgres mcp, postgres-mcp, PostgreSQL MCP server, MCP server Postgres, and Postgres MCP Pro—may lead to different packages or old reference implementations. Confirm:

• repository owner and package publisher;
• whether the server can write or run only read queries;
• whether it exposes plans, index advice, health checks, or arbitrary SQL;
• which PostgreSQL versions and extensions it supports;
• whether credentials appear in process arguments, environment variables, or config files;
• how it enforces statement timeouts and result limits.

For a first trial, use a dedicated read-only role on a non-production database. Query plans can still consume resources, so apply database-side timeouts even when writes are blocked.

How do MySQL MCP and SQLite MCP differ from Postgres MCP?

MySQL MCP servers connect to a networked relational database; SQLite MCP servers operate on a database file. Both can expose schema and SQL tools, but their containment problems differ.

What should you check in a MySQL MCP server?

Search results for MySQL MCP, MCP MySQL, and MySQL MCP server include community projects such as benborla29/mcp-server-mysql. Treat the repository name as part of the entity. Check its current maintenance, package provenance, TLS options, allowed statements, and database role before use.

A read-only MySQL user should receive only the necessary schema privileges. Avoid connecting an agent through an application account that can write every production table.

What should you check in a SQLite MCP server?

Search variants such as SQLite MCP, MCP SQLite, and MCP server SQLite may describe a local file tool or a broader database server. Restrict the process to an explicit database path. Prevent arbitrary path selection, symlink escapes, attachment of unrelated databases, unsafe extension loading, and writes outside the workspace.

SQLite is convenient for a disposable local test because a copied file is easy to isolate. That convenience disappears if the MCP process can browse the whole filesystem.

What does the official MongoDB MCP server provide?

The official MongoDB MCP Server connects agents to MongoDB databases and Atlas clusters. MongoDB’s product page and mongodb-js/mongodb-mcp-server repository document database and Atlas access for compatible clients.

MongoDB tasks differ from SQL tasks. An agent may inspect collections and indexes, run aggregation pipelines, sample documents, or manage Atlas resources depending on enabled tools. Restrict the connection string to the intended database, use a dedicated role, and review filters before a query scans or returns large collections.

Searches for MongoDB MCP, MongoDB MCP server, mongodb-mcp-server, MCP MongoDB, and MongoDB Atlas MCP server also surface community servers. Use the canonical vendor project when vendor support matters, and state clearly when a guide describes another implementation.

What can Firebase MCP access?

Firebase MCP can give AI development tools access to Firebase projects, app code, documentation resources, and services such as Cloud Firestore and Firebase Data Connect. The official Firebase MCP documentation is the source of truth for current tools and installation.

The phrases Firebase MCP and Firebase MCP server are broad because Firebase combines database, hosting, authentication, functions, and project configuration. Enable only the product areas needed for the task. A tool that reads Firestore data does not need permission to deploy a function or change hosting configuration.

Firebase Studio warns that an added MCP server can run code and potentially modify an app. Apply the same approval and environment isolation rules used for SQL servers.

When should you choose Neo4j MCP?

Choose Neo4j MCP when the agent must inspect or query nodes, relationships, labels, properties, and paths in a Neo4j graph. The current official neo4j/mcp server supports schema exploration and Cypher queries and provides a NEO4J_READ_ONLY option.

The older neo4j-contrib/mcp-neo4j Labs collection includes components such as mcp-neo4j-cypher. Its README now directs users who want the official product server to neo4j/mcp. That lifecycle distinction matters for searches such as neo4j mcp server, neo4j-mcp, mcp neo4j, mcp server neo4j, and mcp-neo4j-cypher.

Graph queries can traverse far more data than expected. Limit database scope, set query timeouts, cap returned paths, and keep write-capable Cypher disabled until the use case requires it.

Which vector database MCP server should you choose?

A vector database MCP server stores and retrieves items by semantic similarity; it is not a general replacement for a source database. Choose based on the existing vector platform, metadata-filter requirements, embedding pipeline, tenancy model, and delete/update semantics.

Server family	Typical MCP job	Verification question
Qdrant MCP	Store and retrieve snippets or documents with metadata	Are collection, tenant filter, embedding model, and score threshold fixed?
Chroma MCP	Local or application-level semantic memory	Where is persistence stored, and can the process reach other collections?
Pinecone MCP	Managed vector retrieval	Which index and namespace are allowed, and who can upsert or delete?

The official Qdrant MCP repository presents an example that can become a specialized code-search tool. Its tool descriptions are examples and may need customization. Searches for Qdrant MCP and Qdrant MCP server should resolve to that canonical owner when official provenance is required.

For Chroma MCP, Pinecone MCP server, MCP vector database, and MCP server vector database, verify the individual implementation rather than assuming the database vendor maintains it. Vector records may contain untrusted text, so treat retrieved content as data, not instructions.

When do Redis MCP and Elasticsearch MCP fit?

Redis MCP fits state, cache, streams, search, and fast agent-memory patterns; Elasticsearch MCP fits search and analysis over indexed documents. Neither should inherit a production administrator credential just because the server is convenient to configure.

The official Redis MCP repository exposes tools for Redis data structures, streams, JSON, search, and vector operations. Configure ACLs, TLS, key prefixes, expiry rules, and a dedicated logical database or instance. Write access can alter sessions, queues, rate limits, or cache behavior immediately.

Elastic’s elastic/mcp-server-elasticsearch repository now marks that server as deprecated and says it has been superseded by the Elastic Agent Builder MCP endpoint for Elastic 9.2.0+ and Elasticsearch Serverless. Articles targeting Elasticsearch MCP or Elasticsearch MCP server must surface that status instead of recommending a stale deployment as the default.

What is dbt MCP used for?

dbt MCP gives an agent context and tools for dbt Core, dbt Fusion, dbt Platform, product documentation, and supported SQL workflows. It belongs in this hub because analytics context includes models, metrics, lineage, tests, documentation, and warehouse execution—not only a raw database connection.

The official dbt MCP repository documents tools for dbt project and product context. The search variants dbt mcp and dbt-mcp refer to the same core entity, but current capabilities depend on authentication and configured toolsets.

Keep development and production targets explicit. A natural-language request that sounds like analysis can still run expensive SQL or reach sensitive warehouse tables.

How should you evaluate a database MCP server before adoption?

Run a permission-first pilot before measuring answer quality. Use a disposable environment and test both legitimate and adversarial requests.

Record these facts:

Area	Required evidence
Identity	Canonical owner, release, package, license, and signed/container provenance
Transport	stdio or Streamable HTTP endpoint, bind address, TLS, and authentication
Database scope	Account, project, database, schema, collection, graph, index, or namespace
Tool scope	Metadata, read, write, DDL, admin, docs, diagnostics, and shell execution
Query controls	Allowlist, timeout, row/result limit, cost cap, and transaction behavior
Data handling	Prompt path, model/service path, logs, caches, retention, and deletion
Human control	Approval prompts, change preview, rollback, and escalation owner
Operations	Health check, audit log, rate limit, backup, and credential rotation

Test at least one denied write, one overbroad read, one prompt-injection string stored in a row, one expensive query, one secret-like value, and one tool call with an ambiguous target. A safe server should fail clearly and leave a usable audit trail.

Final recommendation

Use a platform-specific official MCP server when it exists and fits the task, but rely on database permissions—not branding—for safety. Supabase, MongoDB, Firebase, Neo4j, Qdrant, Redis, dbt, and Elastic publish current first-party material. PostgreSQL, MySQL, SQLite, Chroma, and Pinecone searches may require more implementation-level provenance checks.

Begin with one development data source, a dedicated read-only identity, a narrow tool set, manual approvals, and hard query limits. Expand authority only after the team can explain why each additional tool is necessary and how to reverse its effects.

Frequently asked questions

What is an MCP database server?

An MCP database server is a program that exposes database context or operations to an MCP-compatible AI client through declared tools and resources. It translates model requests into controlled database-specific actions.

Is Supabase MCP the same as Postgres MCP?

No. Supabase MCP includes Supabase platform and project tools in addition to database operations. A generic Postgres MCP server connects directly to PostgreSQL and exposes the operations implemented by that specific project.

Can a database MCP server be read-only?

Yes, if both the MCP tool set and the database identity enforce read-only access. Use both layers. A prompt or client setting alone is not sufficient.

Is a vector database MCP server safe from prompt injection?

No. Retrieved vector records can contain adversarial or irrelevant instructions. Treat retrieved text as untrusted data, constrain follow-up actions, and require confirmation for sensitive tools.

Which database MCP server is best for local testing?

A SQLite MCP server connected to a copied database file can be simple to isolate. A local Supabase development stack or disposable Postgres container is better when the application depends on Postgres behavior.

Should I connect an MCP server to production?

Avoid production for exploration and setup. If a production read is unavoidable, use a dedicated role, narrow database scope, manual approvals, hard limits, monitoring, and an incident owner.

Primary sources

• Supabase MCP documentation
• MongoDB official MCP server
• Firebase MCP server documentation
• Neo4j official MCP server
• Qdrant MCP server
• Redis official MCP server
• dbt MCP server
• Elasticsearch MCP lifecycle notice
• CrystalDBA Postgres MCP

Research checked July 14, 2026. Database MCP projects change quickly; verify the current official source, release, and permission model before installation.

SaaS workflow MCP servers let AI clients search workspaces, create or update issues, read documentation, and trigger automations through a standard tool interface. The most useful setup is not the one with the most tools. It is the one that gives an agent enough context to plan work while keeping writes visible, reversible, and accountable.

This guide compares n8n, Jira, Linear, Notion, and Obsidian MCP patterns. It also explains when a server should retrieve context, when it should execute a workflow, and where a human approval gate belongs.

Short answer: Use one system as the source of truth, start with read tools, and require preview plus approval for issue creation, status changes, page edits, messages, or workflow execution.

What Is a SaaS Workflow MCP Server?

A SaaS workflow MCP server is an adapter between an MCP client and a hosted or local work application. The server publishes tools such as search, get issue, create task, update page, list workflow, or run automation. The MCP client makes those tools available to the model.

The server owns the real security boundary. It authenticates the user or service identity, limits the actions, calls the upstream API, and returns a structured result. A useful design separates read, propose, approve, and execute instead of presenting every action as a single opaque tool.

Which Workflow MCP Server Fits Your Job?

Choose by the record that must remain authoritative after the AI session ends.

Primary job	Best-fit category	Typical MCP actions	Main risk
Orchestrate multi-app automation	n8n MCP	Discover nodes, inspect workflows, create or run automations	Cascading writes across services
Manage enterprise work	Jira or Atlassian MCP	Search, create, transition, comment, link	Wrong project, issue, or transition
Manage product execution	Linear MCP	Find, create, and update issues, projects, comments	Bulk or duplicate changes
Search and edit team knowledge	Notion MCP	Search pages, read content, create and update pages	Workspace-wide data exposure
Work with local notes	Obsidian MCP	Search vault, read/write notes, inspect links	Accidental overwrite or path escape

An agent may use several servers in one flow, but only one system should own each record type. If Jira owns delivery status, do not let a parallel Notion table silently become a second status database.

How Does n8n MCP Work?

n8n mcp can describe two different directions of integration:

1. An AI client controls n8n. An n8n MCP server exposes node documentation, workflow inspection, validation, creation, or execution.
2. n8n acts as an MCP client. An n8n mcp client or n8n mcp client tool node connects a workflow to external MCP servers and makes their tools available inside the automation.

This distinction explains keyword variants such as n8n mcp integration, n8n mcp server, n8n mcp client node, n8n mcp client tool node, n8n mcp client stdio, and n8n nodes mcp. They are related, but they do not describe the same runtime direction.

Use the existing n8n MCP profile for the canonical n8n-mcp, n8n-mcp-server, mcp n8n, and mcp server n8n product details. This guide focuses on architecture and selection.

When should n8n be the orchestrator?

n8n is a strong orchestrator when the result must cross applications or run on an event or schedule. A practical pattern is:

1. A trigger receives an incident, form, or repository event.
2. Read tools collect evidence from approved systems.
3. The model proposes a structured plan.
4. Deterministic workflow nodes validate the plan.
5. A human approves high-impact actions.
6. Write nodes execute the approved changes.
7. The workflow records an audit summary.

The n8n mcp node should not become a universal escape hatch. Prefer narrow workflow inputs and outputs over passing unrestricted tool access through every branch.

What should n8n MCP client tool documentation explain?

Good n8n mcp client tool documentation should state transport support, authentication, tool discovery, input mapping, timeouts, retries, streaming behavior, and how errors appear in workflow execution. It should also explain whether credentials stay in n8n, travel to the remote server, or enter model context.

How Do Jira and Atlassian MCP Servers Fit Enterprise Work?

A Jira MCP server connects an AI client to issues, projects, comments, users, and workflows. Search variants such as jira mcp, mcp jira, mcp for jira, mcp server jira, and mcp server for jira express the same broad intent: let an agent work with Jira through MCP.

Atlassian Jira MCP can refer to a Jira-focused server or the broader Atlassian remote server that spans Jira and Confluence. The broader surface is helpful when requirements live in Confluence and execution lives in Jira. It also increases the importance of site, project, and space scoping.

Use the existing Atlassian MCP profile for the canonical product implementation. Before following any jira mcp setup, verify whether the server is vendor-hosted or community-run, which authentication flow it uses, and whether write tools can transition or delete issues.

What is a safe Jira workflow?

A safe Jira workflow converts a natural-language request into a previewable change set:

• Resolve the target site, project, and issue.
• Read current status, assignee, labels, and workflow options.
• Propose the exact fields and transition.
• Ask for approval when the change affects delivery or another person.
• Execute once with an idempotency key or duplicate check.
• Return the issue key, changed fields, and audit link.

This pattern prevents the common failure where an agent creates a duplicate issue because a search result was incomplete.

How Does Linear MCP Differ From Jira MCP?

Linear's official MCP server is a hosted, authenticated remote server. Its documentation describes tools for finding, creating, and updating issues, projects, and comments. It uses Streamable HTTP and an OAuth-based flow at its hosted endpoint.

The existing Linear MCP profile remains canonical for linear mcp server, mcp linear, and linear app mcp setup details.

Decision	Linear MCP	Jira/Atlassian MCP
Typical environment	Product and software teams	Broader enterprise work management
Core objects	Issues, projects, cycles, comments	Issues, projects, workflows, fields, comments
Configuration complexity	Often lower	Often higher due to custom schemes and fields
Main validation	Team, project, state, duplicate	Site, project, issue type, field schema, transition

Do not choose based on interface preference alone. Choose the server tied to the system your team already treats as authoritative.

What Can Notion MCP Do?

Notion's official hosted MCP server gives compatible AI tools access to a user's workspace through authentication. The official documentation describes search, documentation creation, task management, reporting, and campaign-planning use cases.

Use the existing Notion MCP profile for the canonical mcp notion implementation. In this hub, the key design question is scope: a convenient workspace-wide search can reveal far more than the current task needs.

Use a dedicated integration or user authorization with the smallest practical page access. Treat page content as untrusted input. A malicious instruction in a pasted document must not override the workflow policy.

When Does Obsidian MCP Make Sense?

An Obsidian MCP server fits local-first knowledge work: search a vault, inspect backlinks, summarize project notes, or create a structured note. Keyword variants include obsidian mcp, obsidian-mcp, mcp obsidian, obsidian mcp server, and obsidian mcp tools.

Obsidian integrations are commonly community projects, so capability and maintenance vary. Protect the filesystem boundary:

• Pin the server to one vault path.
• Resolve and validate paths before every operation.
• Deny hidden files, configuration secrets, and parent-directory traversal.
• Write through atomic replacement or version control.
• Preview frontmatter and links before saving.

For a team-wide system of record, a hosted knowledge platform may offer stronger centralized authorization. For private engineering notes, a local vault can keep context close to the developer.

How Should You Design Human Approval?

Approval should depend on impact, not on whether the model sounds confident. Read-only retrieval may proceed automatically. A state-changing operation should present the exact target, change, and expected consequence.

Action	Default policy	Why
Search issues or pages	Automatic within scope	Low state-change risk
Draft a proposed issue or page	Automatic, unsaved	Reversible preview
Create one issue in an approved project	Confirm target and fields	External state change
Transition, assign, or notify	Require approval	Affects people and process
Run a multi-app workflow	Require plan-level approval	Can produce cascading effects
Bulk edit or delete	Deny or require elevated workflow	High blast radius

The approval record should include the actor, tool, normalized arguments, target account, timestamp, and result. A chat “yes” without a bound action is not a durable control.

How Can You Prevent Duplicate and Cascading Actions?

Workflow agents fail differently from question-answering agents. A retry can create two issues, send two messages, or run the same n8n workflow twice.

Use four controls:

1. Idempotency: attach a stable request key to every write.
2. Read-before-write: search for an existing object using a deterministic fingerprint.
3. Bounded retries: retry transient reads more freely than writes.
4. Compensation: define how to archive, revert, or annotate a partial result.

For multi-system workflows, store a transaction journal outside the model conversation. The journal maps one intent to every created or updated record.

How Do You Evaluate a Productivity MCP Server?

Build a test suite from real work rather than judging a polished demo.

Test	Expected result
Ambiguous project name	Agent asks which project
Existing duplicate	Agent links or updates instead of creating
Unsupported field	Server returns the schema mismatch clearly
Hidden workspace content	Server refuses access
Prompt injection in a page	Content is quoted as data, not followed as policy
Write timeout	System checks outcome before retrying
Revoked access	Server fails closed and explains re-authentication

Score task success, false writes, authorization failures, latency, trace quality, and recovery. One false write can outweigh many correct summaries.

How Does Graphify Complement SaaS Workflow MCP Servers?

Workflow MCP servers expose operational records. Graphify builds a knowledge graph from code, documentation, and design artifacts so an AI coding assistant can understand the software behind those records.

A useful combined workflow starts with a Jira or Linear issue, uses Graphify to find the affected services and dependencies, proposes an implementation plan, and then writes the evidence-backed plan back to the issue. The work tracker remains canonical for status; Graphify remains the structural context layer.

Frequently Asked Questions

How do I make an MCP server for a SaaS tool?

To answer how to make an mcp server or how to make mcp server, define the smallest required tools, add upstream authentication, validate every input against the SaaS API schema, enforce resource scope, and return structured results. Follow the dedicated MCP server-building guide for SDK and transport implementation; this article covers solution selection.

Is n8n an MCP server or an MCP client?

It can participate in either direction. An n8n-focused server lets an AI client inspect or operate n8n. An n8n MCP client tool lets an n8n workflow call tools exposed by other MCP servers.

Should an agent be allowed to create Jira or Linear issues automatically?

Only for a narrow, validated workflow with duplicate detection and bounded fields. General conversational access should preview the issue and request approval before creation.

Is Obsidian MCP safe for a private vault?

It can be, if the server is local, scoped to one vault, blocks path traversal, and uses previewable or versioned writes. Review the specific implementation; MCP alone does not enforce filesystem safety.

Do I need one MCP server for every SaaS product?

Not always. A workflow orchestrator can call several APIs, but separate servers can provide clearer permissions and ownership. Prefer the design that makes each credential and action auditable.

Final Recommendation

Start with one read-only workflow tied to a real job. Add a preview, a bound approval, idempotency, and an audit record before enabling writes. n8n excels at orchestration; Jira and Linear own work; Notion and Obsidian own knowledge. Keep those roles clear, and an MCP-enabled agent becomes a controlled operator instead of an invisible source of state changes.

Sources

• Linear MCP server documentation
• Notion MCP overview
• n8n documentation
• Model Context Protocol specification