Blog

ChatGPT and OpenAI Codex support the Model Context Protocol, but they use it in different ways. Codex acts as an MCP client for local stdio servers and remote HTTP servers. ChatGPT connects to remote MCP-powered apps through its Apps and developer-mode workflow. Choose the host first; the correct setup, transport, and security model follow from that choice.

This guide separates three products that search results often blur together:

• Codex as an MCP client connects tools to the Codex CLI and IDE extension.
• Codex as an experimental MCP server exposes a Codex engine to another MCP client through codex mcp-server.
• ChatGPT MCP apps connect ChatGPT web to remote, workspace-governed tools.

That distinction prevents the most common setup error: copying a local Codex stdio configuration into ChatGPT, which expects a remote app endpoint.

Does ChatGPT support MCP?

Yes. ChatGPT supports custom MCP-powered apps through developer mode, subject to plan, role, and product limitations. OpenAI's current help documentation says full MCP support, including write actions, is rolling out in beta for Business, Enterprise, and Edu workspaces. Pro users can connect read/fetch MCPs in developer mode, while full write support remains limited. The feature is on ChatGPT web, not mobile.

OpenAI changes availability and UI over time. Verify the current ChatGPT developer-mode requirements before you design a rollout.

How do Codex and ChatGPT MCP support differ?

Codex MCP and ChatGPT MCP solve related problems at different boundaries.

Use Codex CLI MCP when the tool belongs beside a repository and needs local process access. Use ChatGPT custom MCP when a workspace needs a shared, remote, governed integration.

How do you add an MCP server to Codex CLI?

The shortest path is the codex mcp add command. This example registers Microsoft's Playwright MCP package as a local process:

codex mcp add playwright -- npx "@playwright/mcp@latest"

Then inspect the configured server:

codex mcp list
codex mcp get playwright

Remove it with:

codex mcp remove playwright

Codex stores MCP server launchers in config.toml. A direct configuration is useful when you need environment variables, timeouts, or repeatable team documentation:

[mcp_servers.playwright]
command = "npx"
args = ["@playwright/mcp@latest"]

The official Codex repository describes Codex CLI as an MCP client and documents codex mcp for adding, listing, reading, and removing launchers. Check the current Codex configuration documentation when you need fields beyond the basic launcher.

How do you configure a remote MCP server in Codex?

A remote server uses a URL rather than a local command. The exact accepted fields can change with Codex releases, so confirm them against the current configuration schema. The conceptual configuration is:

[mcp_servers.company_tools]
url = "https://mcp.example.com/mcp"

If the server requires OAuth, complete the login flow through the client instead of pasting bearer tokens into a repository. Codex supports MCP OAuth credential storage and a local callback listener. Prefer the OS keyring when available.

How do you verify a Codex MCP server actually works?

Do not stop when the config parses. Use a five-part test:

1. Discovery: codex mcp list shows the expected server.
2. Startup: the local process starts without package, runtime, or path errors.
3. Capability: Codex can enumerate the intended tools.
4. Execution: a read-only prompt triggers one expected tool call.
5. Boundary: a disallowed operation fails or asks for approval.

A useful smoke-test prompt names the server and requests a low-risk fact: “Use the GitHub server to read the repository description; do not create or update anything.” This tests tool selection and permissions without creating data.

How do you add an MCP server to ChatGPT?

To add MCP to ChatGPT, create a custom app in developer mode and point it at a remote MCP endpoint. The UI is workspace- and role-dependent, but the current flow is:

1. Ask an admin or owner to enable developer mode for the workspace.
2. Enable developer mode for the authorized account.
3. Open Settings → Apps → Create, or the equivalent workspace Apps page.
4. Enter the remote MCP endpoint and metadata.
5. Select the authentication method.
6. Run Scan Tools and complete OAuth if required.
7. Create the draft app and test it in a new chat.
8. Review every tool and publish it only after the workspace owner approves its actions.

ChatGPT connects to remote MCP servers. For a server on a developer machine, private VPC, or on-premises network, use a supported private-connection method rather than opening an unauthenticated public port.

What should a ChatGPT MCP integration expose?

Expose small, explicit tools that match user jobs. A tool named create_linear_issue is safer and easier to route than a generic execute_api_request tool. Describe side effects in the tool schema, validate inputs on the server, and return concise results.

For product-specific integrations, keep the existing product pages canonical:

• Use the Linear MCP server for Linear-specific setup and tool details.
• Use the n8n MCP server for n8n nodes and workflow automation.
• Use the Supabase MCP server for database operations.
• Use the Atlassian MCP server for Jira and Confluence access.
• Use the Playwright MCP server for browser automation.

This hub explains the OpenAI host layer. The product pages own package names, tool lists, and vendor-specific installation details.

What is the OpenAI API MCP path?

The OpenAI API can call remote MCP servers as tools in agentic application flows. This is separate from ChatGPT's Apps UI and Codex's local client configuration. Your application sends a model request, declares a remote MCP tool, and controls which server and operations the model can use.

Treat an OpenAI MCP client as application code with three responsibilities:

• authenticate to the remote MCP server;
• restrict tools and actions to the user's job;
• log the server call, result, and approval decision.

Do not market an arbitrary API wrapper as an “OpenAI MCP server.” A server implements MCP; OpenAI models or products consume that server through a client surface.

Can Codex run as an MCP server?

Yes, but this is different from configuring Codex to consume MCP tools. The official repository documents an experimental codex mcp-server command that exposes Codex through stdio and JSON-RPC. Another MCP client can then control Codex threads and turns.

codex mcp-server | your_mcp_client

For inspection:

npx @modelcontextprotocol/inspector codex mcp-server

The interface is experimental and subject to change. Use it for controlled integration work, not as an undocumented production contract. The Codex MCP server interface lists its current transport and RPC surface.

Which MCP servers work well with Codex?

The best Codex MCP servers add structured context or actions that the coding agent cannot get safely from the repository alone.

Avoid installing every available server. Large tool catalogs increase ambiguity and context cost. Add the smallest server set that completes the workflow, then enable only the necessary tool groups.

How should you secure OpenAI and Codex MCP integrations?

MCP extends the model's reach, so the server boundary must enforce policy even when the prompt does not. Prompt instructions are not access controls.

Use these controls in combination:

1. Trust the server source. Pin packages or container digests where practical. Review updates before deployment.
2. Use least privilege. Give a read task read credentials. Split read and write toolsets.
3. Keep secrets outside prompts and repositories. Use environment injection, a secret manager, or OAuth.
4. Require approval for side effects. Creating issues, sending messages, changing records, and executing deployments need explicit gates.
5. Constrain network and filesystem access. A browser or shell tool should not inherit access to every host and directory.
6. Log tool identity and outcome. Record the user, server, tool, inputs, approval, result, and error class.
7. Defend against prompt injection. Treat tool output and retrieved pages as untrusted data. Never let external content rewrite system policy.

OpenAI warns that unsafe MCP servers increase prompt-injection and data-exposure risk. For ChatGPT workspaces, admins should review actions, use RBAC, and republish changed tool definitions. For Codex, keep project instructions and approval policy aligned with the server's real credentials.

Why is my ChatGPT or Codex MCP connection failing?

Debug one layer at a time: host configuration, transport, authentication, capability discovery, tool execution, then model routing. Mixing those layers produces vague “MCP does not work” diagnoses.

What is a reliable production rollout checklist?

Before publishing a ChatGPT app or sharing a Codex MCP configuration, confirm:

• The host and transport match: Codex local/remote versus ChatGPT remote.
• The server has a named owner and an update policy.
• Every tool has a clear description and bounded input schema.
• Credentials use the minimum scopes.
• Read-only mode is the default for evaluation.
• Write actions require approval and server-side authorization.
• A smoke test covers discovery, execution, failure, and audit logging.
• Tool output is treated as untrusted input.
• Product-specific pages remain canonical and receive internal links.
• The deployment date and tested versions are recorded.

Frequently asked questions

Is “Codex MCP” a client or a server?

It can mean either. Codex CLI is an MCP client that connects to configured servers. The experimental codex mcp-server command makes Codex itself available to another MCP client. State the direction whenever you document an integration.

Does ChatGPT Desktop support local MCP servers?

Do not assume ChatGPT Desktop behaves like Claude Desktop or Codex CLI. OpenAI's current custom-app documentation describes remote MCP apps on ChatGPT web. Verify the current product documentation before promising local desktop connectivity.

What is the fastest way to install MCP in Codex?

Use codex mcp add <name> -- <command> [args...], then verify it with codex mcp list and one read-only tool call. For Playwright, the official package documents codex mcp add playwright -- npx "@playwright/mcp@latest".

Does OpenAI support the Model Context Protocol directly?

Yes. OpenAI products expose several MCP integration surfaces: ChatGPT custom apps, Codex as an MCP client, the OpenAI API's remote MCP tool path, and the experimental Codex MCP server interface. Their configuration and security boundaries are not interchangeable.

Should I connect Linear, n8n, Supabase, Atlassian, or Playwright through this guide?

Use this guide to choose and configure the OpenAI host. Then follow the linked product detail page for its exact server, permissions, and tools. That prevents duplicate setup advice and keeps vendor-specific information current.

Final recommendation

Start with one read-only server and one observable job. For a developer, that might be Codex reading repository issues. For a workspace, it might be ChatGPT fetching an approved internal record. Prove discovery, permissions, and auditability before adding write tools. MCP creates the most value when the connection is narrow, explicit, and easy to inspect.

Sources

• OpenAI: Developer mode and MCP apps in ChatGPT
• OpenAI Codex configuration
• OpenAI Codex MCP client and server overview
• OpenAI Codex MCP server interface
• Microsoft Playwright MCP

Code intelligence MCP servers give AI coding clients better evidence than a raw chat window can hold. Some retrieve current library documentation. Some package repository text. Some navigate symbols and references. Others preserve knowledge as a graph or scan code for quality and security findings.

No single server wins every task. Choose the context model that matches the question. Use Context7 for version-aware library docs, Serena for symbol-level repository work, a code index for retrieval, static-analysis servers for findings, and a knowledge graph when relationships and memory must survive across sessions.

Short answer: Documentation retrieval answers “How does this API work?” Symbol intelligence answers “Where is this behavior implemented?” Static analysis answers “Which rule is violated?” A knowledge graph answers “How are these code, document, and system entities connected?”

What Is a Code Intelligence MCP Server?

A code intelligence MCP server is an MCP implementation that exposes code or documentation operations as tools. The server may search an index, resolve a symbol, find references, retrieve versioned docs, package files, query a knowledge graph, or return scanner findings.

The key entity relationship is simple: an MCP client invokes a tool; the tool queries an evidence system; the server returns structured context; the model uses that context to plan or edit. Quality depends on what the evidence system represents and how fresh, scoped, and attributable its results are.

Which Code Intelligence MCP Server Should You Use?

Select by the question your agent must answer.

The best stack often combines two layers. Fresh external docs plus symbol-aware local code navigation is more reliable than either alone.

How Does Context7 MCP Improve Documentation Retrieval?

Context7 MCP retrieves current, version-relevant library documentation and examples. Its official repository describes two core MCP tools: one resolves a library name to a Context7 library ID, and another queries documentation for that ID. Supplying an exact library ID or version reduces ambiguity.

The existing Context7 MCP profile remains canonical for context7 mcp, context7-mcp, mcp context7, context7 mcp server, and configuration details. The profile also owns queries such as context7 mcp documentation, context7 mcp official docs, and context7 mcp server documentation.

Use Context7 when the failure mode is stale training knowledge: removed methods, changed configuration keys, or version-specific APIs. Cite the retrieved library and version in the final answer. Do not treat community-contributed documentation as infallible; verify security-sensitive behavior against the library owner's docs.

When Is Serena MCP Better Than Text Search?

Serena MCP exposes semantic code retrieval, editing, refactoring, and debugging operations at the symbol level. Its official repository explains that it can use Language Server Protocol backends or a JetBrains plugin to understand symbols and relationships.

Use the existing Serena MCP profile for the canonical serena mcp, serena mcp server, and mcp serena installation details.

Serena is strong when a task requires:

• Finding a symbol without reading the whole file.
• Listing references before a change.
• Understanding type or implementation relationships.
• Editing a symbol body rather than applying brittle line-based replacement.
• Preserving project memory across a longer coding workflow.

Text search remains faster for an exact literal or tiny repository. Symbol intelligence pays off when the codebase is large, names are overloaded, or a refactor crosses files.

What Do Code Index MCP and Sourcegraph MCP Provide?

A code index MCP exposes an indexed representation of a repository. The exact tools vary, but useful servers support file discovery, lexical or semantic search, symbol lookup, reference traversal, and incremental refresh. Search variants code index mcp and code-index-mcp should resolve to one canonical comparison section, not two pages.

Before adopting an implementation, test five properties:

1. Freshness: how quickly do commits enter the index?
2. Scope: can it isolate repository, branch, and tenant?
3. Semantics: does it understand symbols or only chunks?
4. Evidence: does every result include file, range, revision, and retrieval method?
5. Operations: can you rebuild, inspect, and delete the index?

Sourcegraph MCP belongs to the same broad category but may connect to a larger code search and intelligence platform. Validate current MCP availability and supported operations in Sourcegraph's official documentation before planning a rollout; product integration details can change faster than the general selection framework.

Where Do DeepWiki and Repomix Fit?

deepwiki mcp and deepwiki mcp server represent repository-explanation intent. A DeepWiki-style system turns a repository into navigable documentation and answers. It is useful for orientation, but any generated explanation should link back to the exact revision and source files.

repomix mcp represents repository-packaging intent. Repomix-style tools collect selected files into an AI-friendly artifact. Packaging is simple and portable, but a packed snapshot has three limits: it can exceed the context budget, become stale, and flatten relationships that a symbol graph preserves.

Use packaging for bounded review or handoff. Use an index for repeated retrieval. Use symbol intelligence for navigation and refactoring.

How Do Graphiti, Cognee, and Knowledge-Graph MCP Differ?

graphiti mcp and graphiti mcp server target temporal or evolving graph memory. Graphiti's official repository describes a system that builds and queries knowledge graphs for AI agents, with relationships that can change over time.

cognee mcp server targets persistent AI memory constructed from ingested data. Cognee's official repository exposes memory-oriented operations and an MCP server path within its broader data and graph stack.

The generic queries knowledge graph mcp, mcp knowledge graph, knowledge graph memory, and knowledge graph memory mcp describe a pattern, not one product. A useful knowledge-graph MCP implementation should expose:

• Entity and relationship provenance.
• Time or revision boundaries.
• Upsert, deletion, and conflict rules.
• Tenant and dataset isolation.
• A way to explain which source supports each edge.

Graph memory does not replace repository truth. It accelerates reasoning by preserving relationships; the agent should still verify a proposed code change against the current branch.

Where Does Greptile MCP Fit?

greptile mcp represents hosted repository intelligence and code-review context. Treat Greptile as a product-specific option whose current tool surface, repository permissions, and retention policy must be verified in official documentation. The comparison questions remain stable: what gets indexed, which revisions are searchable, how evidence is cited, and whether the service can delete stored code.

For private repositories, include data residency, model-provider access, retention, and organization-level authorization in the review—not only search quality.

How Do SonarQube, Semgrep, and Snyk MCP Servers Differ?

Static-analysis MCP servers expose findings, rules, locations, and sometimes remediation actions. They should complement, not replace, their underlying scanners.

Keyword variants such as sonarqube mcp, sonarqube-mcp-server, sonarqube mcp server, and mcp sonarqube belong to one entity cluster. The same is true for semgrep mcp and semgrep mcp server, and for snyk mcp and snyk mcp server.

Require the server to return the scanner source, rule ID, file and range, revision, severity, and a stable finding identifier. A model-generated explanation without those fields is advice, not a verified finding.

How Should You Combine Documentation, Code, and Memory?

Use a layered retrieval plan. Each layer answers a different kind of question and supplies a different evidence type.

1. Clarify the task. Identify target repository, branch, library version, and expected output.
2. Retrieve external contracts. Use current official or Context7 documentation for APIs and frameworks.
3. Inspect local structure. Use symbol or index tools to find definitions, references, tests, and configuration.
4. Consult memory. Use graph memory for prior decisions, architecture relationships, and cross-artifact context.
5. Verify with scanners and tests. Static analysis and tests check the proposed change.
6. Cite evidence. The answer names the revision, files, symbols, docs, and findings it used.

This sequence reduces a common error: applying a correct current API example to the wrong part of the local architecture.

How Can You Evaluate Code Intelligence MCP Servers?

Create a benchmark from real repository tasks and keep the expected evidence set hidden from the tool under test.

Measure precision, recall, citation completeness, context tokens, latency, freshness delay, and authorization failures. Also run a no-tool baseline. The server earns its place only if it improves task outcomes enough to justify its context and operational cost.

Where Does Graphify Add Unique Value?

Graphify is a knowledge-graph layer for AI coding assistants. It connects code, documents, and design artifacts into queryable structures so an agent can reason about a complex system instead of treating the repository as unrelated chunks.

That makes Graphify complementary to the tools in this guide:

• Context7 supplies fresh external library facts.
• Serena supplies precise symbol operations.
• Static analyzers supply verified findings.
• Graphify supplies cross-artifact structure and relationships.

For a large codebase, the strongest workflow combines these evidence types and keeps provenance attached. The model can then explain not only what to change, but why the change belongs in that subsystem and what it may affect.

Frequently Asked Questions

Is code index MCP the same as a knowledge graph MCP?

No. A code index optimizes retrieval over code artifacts. A knowledge graph stores explicit entities and relationships, often across code, documents, and decisions. Some products combine both, but the data models and query guarantees differ.

Is Context7 MCP enough to understand my repository?

No. Context7 is strongest for external library documentation. Pair it with repository search, symbol intelligence, or a code knowledge graph for local architecture and implementation evidence.

Is Serena MCP a code index?

Serena can retrieve code semantically through language-aware tooling, but its value is broader than a generic text index: it exposes symbol relationships and structured editing/refactoring capabilities.

Can graph memory become stale?

Yes. Every stored entity and relationship needs source provenance and a revision or time boundary. Re-index changed artifacts and delete invalid edges instead of allowing memory to silently diverge from the repository.

Should a scanner MCP server be allowed to edit code automatically?

Default to read and propose. Let the agent prepare a patch, then run tests and the underlying scanner before approval. An MCP explanation is not proof that a remediation is safe.

Final Recommendation

Choose by evidence model. Use documentation retrieval for external contracts, symbol intelligence for local code, static analysis for verified findings, and a knowledge graph for system relationships and durable memory. Then evaluate the combined stack on real tasks with revision-aware citations. More context is useful only when it is current, scoped, attributable, and connected to the decision.

Sources

• Context7 official repository
• Serena official repository
• Graphiti official repository
• Cognee official repository
• MCP reference servers
• Model Context Protocol specification

SaaS workflow MCP servers let AI clients search workspaces, create or update issues, read documentation, and trigger automations through a standard tool interface. The most useful setup is not the one with the most tools. It is the one that gives an agent enough context to plan work while keeping writes visible, reversible, and accountable.

This guide compares n8n, Jira, Linear, Notion, and Obsidian MCP patterns. It also explains when a server should retrieve context, when it should execute a workflow, and where a human approval gate belongs.

Short answer: Use one system as the source of truth, start with read tools, and require preview plus approval for issue creation, status changes, page edits, messages, or workflow execution.

What Is a SaaS Workflow MCP Server?

A SaaS workflow MCP server is an adapter between an MCP client and a hosted or local work application. The server publishes tools such as search, get issue, create task, update page, list workflow, or run automation. The MCP client makes those tools available to the model.

The server owns the real security boundary. It authenticates the user or service identity, limits the actions, calls the upstream API, and returns a structured result. A useful design separates read, propose, approve, and execute instead of presenting every action as a single opaque tool.

Which Workflow MCP Server Fits Your Job?

Choose by the record that must remain authoritative after the AI session ends.

An agent may use several servers in one flow, but only one system should own each record type. If Jira owns delivery status, do not let a parallel Notion table silently become a second status database.

How Does n8n MCP Work?

n8n mcp can describe two different directions of integration:

1. An AI client controls n8n. An n8n MCP server exposes node documentation, workflow inspection, validation, creation, or execution.
2. n8n acts as an MCP client. An n8n mcp client or n8n mcp client tool node connects a workflow to external MCP servers and makes their tools available inside the automation.

This distinction explains keyword variants such as n8n mcp integration, n8n mcp server, n8n mcp client node, n8n mcp client tool node, n8n mcp client stdio, and n8n nodes mcp. They are related, but they do not describe the same runtime direction.

Use the existing n8n MCP profile for the canonical n8n-mcp, n8n-mcp-server, mcp n8n, and mcp server n8n product details. This guide focuses on architecture and selection.

When should n8n be the orchestrator?

n8n is a strong orchestrator when the result must cross applications or run on an event or schedule. A practical pattern is:

1. A trigger receives an incident, form, or repository event.
2. Read tools collect evidence from approved systems.
3. The model proposes a structured plan.
4. Deterministic workflow nodes validate the plan.
5. A human approves high-impact actions.
6. Write nodes execute the approved changes.
7. The workflow records an audit summary.

The n8n mcp node should not become a universal escape hatch. Prefer narrow workflow inputs and outputs over passing unrestricted tool access through every branch.

What should n8n MCP client tool documentation explain?

Good n8n mcp client tool documentation should state transport support, authentication, tool discovery, input mapping, timeouts, retries, streaming behavior, and how errors appear in workflow execution. It should also explain whether credentials stay in n8n, travel to the remote server, or enter model context.

How Do Jira and Atlassian MCP Servers Fit Enterprise Work?

A Jira MCP server connects an AI client to issues, projects, comments, users, and workflows. Search variants such as jira mcp, mcp jira, mcp for jira, mcp server jira, and mcp server for jira express the same broad intent: let an agent work with Jira through MCP.

Atlassian Jira MCP can refer to a Jira-focused server or the broader Atlassian remote server that spans Jira and Confluence. The broader surface is helpful when requirements live in Confluence and execution lives in Jira. It also increases the importance of site, project, and space scoping.

Use the existing Atlassian MCP profile for the canonical product implementation. Before following any jira mcp setup, verify whether the server is vendor-hosted or community-run, which authentication flow it uses, and whether write tools can transition or delete issues.

What is a safe Jira workflow?

A safe Jira workflow converts a natural-language request into a previewable change set:

• Resolve the target site, project, and issue.
• Read current status, assignee, labels, and workflow options.
• Propose the exact fields and transition.
• Ask for approval when the change affects delivery or another person.
• Execute once with an idempotency key or duplicate check.
• Return the issue key, changed fields, and audit link.

This pattern prevents the common failure where an agent creates a duplicate issue because a search result was incomplete.

How Does Linear MCP Differ From Jira MCP?

Linear's official MCP server is a hosted, authenticated remote server. Its documentation describes tools for finding, creating, and updating issues, projects, and comments. It uses Streamable HTTP and an OAuth-based flow at its hosted endpoint.

The existing Linear MCP profile remains canonical for linear mcp server, mcp linear, and linear app mcp setup details.

Do not choose based on interface preference alone. Choose the server tied to the system your team already treats as authoritative.

What Can Notion MCP Do?

Notion's official hosted MCP server gives compatible AI tools access to a user's workspace through authentication. The official documentation describes search, documentation creation, task management, reporting, and campaign-planning use cases.

Use the existing Notion MCP profile for the canonical mcp notion implementation. In this hub, the key design question is scope: a convenient workspace-wide search can reveal far more than the current task needs.

Use a dedicated integration or user authorization with the smallest practical page access. Treat page content as untrusted input. A malicious instruction in a pasted document must not override the workflow policy.

When Does Obsidian MCP Make Sense?

An Obsidian MCP server fits local-first knowledge work: search a vault, inspect backlinks, summarize project notes, or create a structured note. Keyword variants include obsidian mcp, obsidian-mcp, mcp obsidian, obsidian mcp server, and obsidian mcp tools.

Obsidian integrations are commonly community projects, so capability and maintenance vary. Protect the filesystem boundary:

• Pin the server to one vault path.
• Resolve and validate paths before every operation.
• Deny hidden files, configuration secrets, and parent-directory traversal.
• Write through atomic replacement or version control.
• Preview frontmatter and links before saving.

For a team-wide system of record, a hosted knowledge platform may offer stronger centralized authorization. For private engineering notes, a local vault can keep context close to the developer.

How Should You Design Human Approval?

Approval should depend on impact, not on whether the model sounds confident. Read-only retrieval may proceed automatically. A state-changing operation should present the exact target, change, and expected consequence.

The approval record should include the actor, tool, normalized arguments, target account, timestamp, and result. A chat “yes” without a bound action is not a durable control.

How Can You Prevent Duplicate and Cascading Actions?

Workflow agents fail differently from question-answering agents. A retry can create two issues, send two messages, or run the same n8n workflow twice.

Use four controls:

1. Idempotency: attach a stable request key to every write.
2. Read-before-write: search for an existing object using a deterministic fingerprint.
3. Bounded retries: retry transient reads more freely than writes.
4. Compensation: define how to archive, revert, or annotate a partial result.

For multi-system workflows, store a transaction journal outside the model conversation. The journal maps one intent to every created or updated record.

How Do You Evaluate a Productivity MCP Server?

Build a test suite from real work rather than judging a polished demo.

Score task success, false writes, authorization failures, latency, trace quality, and recovery. One false write can outweigh many correct summaries.

How Does Graphify Complement SaaS Workflow MCP Servers?

Workflow MCP servers expose operational records. Graphify builds a knowledge graph from code, documentation, and design artifacts so an AI coding assistant can understand the software behind those records.

A useful combined workflow starts with a Jira or Linear issue, uses Graphify to find the affected services and dependencies, proposes an implementation plan, and then writes the evidence-backed plan back to the issue. The work tracker remains canonical for status; Graphify remains the structural context layer.

Frequently Asked Questions

How do I make an MCP server for a SaaS tool?

To answer how to make an mcp server or how to make mcp server, define the smallest required tools, add upstream authentication, validate every input against the SaaS API schema, enforce resource scope, and return structured results. Follow the dedicated MCP server-building guide for SDK and transport implementation; this article covers solution selection.

Is n8n an MCP server or an MCP client?

It can participate in either direction. An n8n-focused server lets an AI client inspect or operate n8n. An n8n MCP client tool lets an n8n workflow call tools exposed by other MCP servers.

Should an agent be allowed to create Jira or Linear issues automatically?

Only for a narrow, validated workflow with duplicate detection and bounded fields. General conversational access should preview the issue and request approval before creation.

Is Obsidian MCP safe for a private vault?

It can be, if the server is local, scoped to one vault, blocks path traversal, and uses previewable or versioned writes. Review the specific implementation; MCP alone does not enforce filesystem safety.

Do I need one MCP server for every SaaS product?

Not always. A workflow orchestrator can call several APIs, but separate servers can provide clearer permissions and ownership. Prefer the design that makes each credential and action auditable.

Final Recommendation

Start with one read-only workflow tied to a real job. Add a preview, a bound approval, idempotency, and an audit record before enabling writes. n8n excels at orchestration; Jira and Linear own work; Notion and Obsidian own knowledge. Keep those roles clear, and an MCP-enabled agent becomes a controlled operator instead of an invisible source of state changes.

Sources

• Linear MCP server documentation
• Notion MCP overview
• n8n documentation
• Model Context Protocol specification

A database MCP server connects an AI client to a data system through named tools and resources. Choose the server that matches the database and job, then restrict it to the smallest project, feature set, role, and network path possible. Supabase MCP is a strong managed Postgres option; PostgreSQL, MySQL, SQLite, MongoDB, Redis, Neo4j, Qdrant, Firebase, Elasticsearch, and dbt require different query and safety models.

Do not choose by database popularity alone. A read-only schema explorer, a migration tool, a vector-memory service, and an analytics assistant expose very different consequences when an agent calls the wrong operation.

Original Graphify editorial visual. The categories are abstracted from current database MCP use cases and do not reproduce vendor interfaces or artwork.

Which database MCP server should you choose?

Choose by data model, required action, and authority boundary. Start with read-only metadata and queries. Add writes, DDL, account administration, or deployment tools only after the workflow proves that it needs them.

The term MCP database does not identify one canonical server. Several official vendor projects exist, while other repositories are community maintained. Verify the owner, release, license, transport, and permissions before copying a configuration.

What can a database MCP server expose?

A database MCP server normally converts model requests into a small set of database-specific operations. The exact tools vary, but they usually fall into five groups:

1. Metadata: list databases, schemas, tables, collections, indexes, graph labels, or vector collections.
2. Read: run SQL, aggregation pipelines, Cypher, search queries, or semantic retrieval.
3. Write: insert, update, delete, cache, publish, or create graph relationships.
4. Administration: create projects, branches, indexes, users, or storage resources.
5. Documentation and diagnostics: search product docs, inspect logs, explain plans, or report configuration.

Tool names are not security controls. The database credential, server-side allowlist, project scope, query policy, and client approval gate determine what an agent can actually do.

How should you secure a database MCP server?

Build the connection as if an untrusted prompt could reach every enabled tool. Database values, tickets, documents, and log records can contain instructions that try to redirect an agent. A model can also generate a harmful query without malicious input.

Original Graphify editorial visual. The pipeline separates environment, identity, tool, query, approval, and audit controls.

Use this order:

1. Connect a development, branch, replica, or sanitized dataset—not production.
2. Create a dedicated database identity; never reuse an owner or administrator credential.
3. Limit the identity to the necessary schema, database, collection, graph, or index.
4. Start in read-only mode and disable mutating tool groups.
5. Constrain network egress and ingress to the MCP process and database endpoint.
6. Keep manual approval enabled for tool calls, especially generated queries.
7. Set timeouts, row limits, cost limits, and statement restrictions server-side.
8. Log tool name, sanitized parameters, identity, result size, decision, and error.
9. Test prompt-injection strings stored inside database rows and documents.
10. Rotate credentials and delete cached results or local logs according to policy.

Read-only does not make data safe. A read-only role can still expose personal data, secrets, proprietary embeddings, customer documents, or a large export.

What makes Supabase MCP different?

Supabase MCP is a hosted and local development interface for Supabase projects, not merely a generic Postgres query wrapper. Its official documentation lists database, docs, debugging, development, functions, branching, storage, and account-management tool groups.

The current remote URL supports three important restrictions:

https://mcp.supabase.com/mcp?project_ref=YOUR_PROJECT_REF&read_only=true&features=database,docs

• project_ref limits access to one project and disables account-level tools.
• read_only=true runs queries as a read-only Postgres user and disables mutating tools.
• features enables only selected tool groups.

The Supabase MCP documentation recommends a development project, project scoping, read-only mode, feature restriction, branching, and manual review. Those are layered controls, not interchangeable switches.

Graphify already has an exact-product Supabase MCP profile. This hub owns the broader selection and security intent; it does not replace that setup page.

Which PostgreSQL MCP server should you use?

“Postgres MCP” describes several implementations, so identify the repository before installing anything. Graphify’s current exact-product Postgres MCP profile covers crystaldba/postgres-mcp, a server focused on database analysis and performance work with restricted and unrestricted access modes.

Common search variants—including postgres mcp, postgres-mcp, PostgreSQL MCP server, MCP server Postgres, and Postgres MCP Pro—may lead to different packages or old reference implementations. Confirm:

• repository owner and package publisher;
• whether the server can write or run only read queries;
• whether it exposes plans, index advice, health checks, or arbitrary SQL;
• which PostgreSQL versions and extensions it supports;
• whether credentials appear in process arguments, environment variables, or config files;
• how it enforces statement timeouts and result limits.

For a first trial, use a dedicated read-only role on a non-production database. Query plans can still consume resources, so apply database-side timeouts even when writes are blocked.

How do MySQL MCP and SQLite MCP differ from Postgres MCP?

MySQL MCP servers connect to a networked relational database; SQLite MCP servers operate on a database file. Both can expose schema and SQL tools, but their containment problems differ.

What should you check in a MySQL MCP server?

Search results for MySQL MCP, MCP MySQL, and MySQL MCP server include community projects such as benborla29/mcp-server-mysql. Treat the repository name as part of the entity. Check its current maintenance, package provenance, TLS options, allowed statements, and database role before use.

A read-only MySQL user should receive only the necessary schema privileges. Avoid connecting an agent through an application account that can write every production table.

What should you check in a SQLite MCP server?

Search variants such as SQLite MCP, MCP SQLite, and MCP server SQLite may describe a local file tool or a broader database server. Restrict the process to an explicit database path. Prevent arbitrary path selection, symlink escapes, attachment of unrelated databases, unsafe extension loading, and writes outside the workspace.

SQLite is convenient for a disposable local test because a copied file is easy to isolate. That convenience disappears if the MCP process can browse the whole filesystem.

What does the official MongoDB MCP server provide?

The official MongoDB MCP Server connects agents to MongoDB databases and Atlas clusters. MongoDB’s product page and mongodb-js/mongodb-mcp-server repository document database and Atlas access for compatible clients.

MongoDB tasks differ from SQL tasks. An agent may inspect collections and indexes, run aggregation pipelines, sample documents, or manage Atlas resources depending on enabled tools. Restrict the connection string to the intended database, use a dedicated role, and review filters before a query scans or returns large collections.

Searches for MongoDB MCP, MongoDB MCP server, mongodb-mcp-server, MCP MongoDB, and MongoDB Atlas MCP server also surface community servers. Use the canonical vendor project when vendor support matters, and state clearly when a guide describes another implementation.

What can Firebase MCP access?

Firebase MCP can give AI development tools access to Firebase projects, app code, documentation resources, and services such as Cloud Firestore and Firebase Data Connect. The official Firebase MCP documentation is the source of truth for current tools and installation.

The phrases Firebase MCP and Firebase MCP server are broad because Firebase combines database, hosting, authentication, functions, and project configuration. Enable only the product areas needed for the task. A tool that reads Firestore data does not need permission to deploy a function or change hosting configuration.

Firebase Studio warns that an added MCP server can run code and potentially modify an app. Apply the same approval and environment isolation rules used for SQL servers.

When should you choose Neo4j MCP?

Choose Neo4j MCP when the agent must inspect or query nodes, relationships, labels, properties, and paths in a Neo4j graph. The current official neo4j/mcp server supports schema exploration and Cypher queries and provides a NEO4J_READ_ONLY option.

The older neo4j-contrib/mcp-neo4j Labs collection includes components such as mcp-neo4j-cypher. Its README now directs users who want the official product server to neo4j/mcp. That lifecycle distinction matters for searches such as neo4j mcp server, neo4j-mcp, mcp neo4j, mcp server neo4j, and mcp-neo4j-cypher.

Graph queries can traverse far more data than expected. Limit database scope, set query timeouts, cap returned paths, and keep write-capable Cypher disabled until the use case requires it.

Which vector database MCP server should you choose?

A vector database MCP server stores and retrieves items by semantic similarity; it is not a general replacement for a source database. Choose based on the existing vector platform, metadata-filter requirements, embedding pipeline, tenancy model, and delete/update semantics.

The official Qdrant MCP repository presents an example that can become a specialized code-search tool. Its tool descriptions are examples and may need customization. Searches for Qdrant MCP and Qdrant MCP server should resolve to that canonical owner when official provenance is required.

For Chroma MCP, Pinecone MCP server, MCP vector database, and MCP server vector database, verify the individual implementation rather than assuming the database vendor maintains it. Vector records may contain untrusted text, so treat retrieved content as data, not instructions.

When do Redis MCP and Elasticsearch MCP fit?

Redis MCP fits state, cache, streams, search, and fast agent-memory patterns; Elasticsearch MCP fits search and analysis over indexed documents. Neither should inherit a production administrator credential just because the server is convenient to configure.

The official Redis MCP repository exposes tools for Redis data structures, streams, JSON, search, and vector operations. Configure ACLs, TLS, key prefixes, expiry rules, and a dedicated logical database or instance. Write access can alter sessions, queues, rate limits, or cache behavior immediately.

Elastic’s elastic/mcp-server-elasticsearch repository now marks that server as deprecated and says it has been superseded by the Elastic Agent Builder MCP endpoint for Elastic 9.2.0+ and Elasticsearch Serverless. Articles targeting Elasticsearch MCP or Elasticsearch MCP server must surface that status instead of recommending a stale deployment as the default.

What is dbt MCP used for?

dbt MCP gives an agent context and tools for dbt Core, dbt Fusion, dbt Platform, product documentation, and supported SQL workflows. It belongs in this hub because analytics context includes models, metrics, lineage, tests, documentation, and warehouse execution—not only a raw database connection.

The official dbt MCP repository documents tools for dbt project and product context. The search variants dbt mcp and dbt-mcp refer to the same core entity, but current capabilities depend on authentication and configured toolsets.

Keep development and production targets explicit. A natural-language request that sounds like analysis can still run expensive SQL or reach sensitive warehouse tables.

How should you evaluate a database MCP server before adoption?

Run a permission-first pilot before measuring answer quality. Use a disposable environment and test both legitimate and adversarial requests.

Record these facts:

Test at least one denied write, one overbroad read, one prompt-injection string stored in a row, one expensive query, one secret-like value, and one tool call with an ambiguous target. A safe server should fail clearly and leave a usable audit trail.

Final recommendation

Use a platform-specific official MCP server when it exists and fits the task, but rely on database permissions—not branding—for safety. Supabase, MongoDB, Firebase, Neo4j, Qdrant, Redis, dbt, and Elastic publish current first-party material. PostgreSQL, MySQL, SQLite, Chroma, and Pinecone searches may require more implementation-level provenance checks.

Begin with one development data source, a dedicated read-only identity, a narrow tool set, manual approvals, and hard query limits. Expand authority only after the team can explain why each additional tool is necessary and how to reverse its effects.

Frequently asked questions

What is an MCP database server?

An MCP database server is a program that exposes database context or operations to an MCP-compatible AI client through declared tools and resources. It translates model requests into controlled database-specific actions.

Is Supabase MCP the same as Postgres MCP?

No. Supabase MCP includes Supabase platform and project tools in addition to database operations. A generic Postgres MCP server connects directly to PostgreSQL and exposes the operations implemented by that specific project.

Can a database MCP server be read-only?

Yes, if both the MCP tool set and the database identity enforce read-only access. Use both layers. A prompt or client setting alone is not sufficient.

Is a vector database MCP server safe from prompt injection?

No. Retrieved vector records can contain adversarial or irrelevant instructions. Treat retrieved text as untrusted data, constrain follow-up actions, and require confirmation for sensitive tools.

Which database MCP server is best for local testing?

A SQLite MCP server connected to a copied database file can be simple to isolate. A local Supabase development stack or disposable Postgres container is better when the application depends on Postgres behavior.

Should I connect an MCP server to production?

Avoid production for exploration and setup. If a production read is unavoidable, use a dedicated role, narrow database scope, manual approvals, hard limits, monitoring, and an incident owner.

Primary sources

• Supabase MCP documentation
• MongoDB official MCP server
• Firebase MCP server documentation
• Neo4j official MCP server
• Qdrant MCP server
• Redis official MCP server
• dbt MCP server
• Elasticsearch MCP lifecycle notice
• CrystalDBA Postgres MCP

Research checked July 14, 2026. Database MCP projects change quickly; verify the current official source, release, and permission model before installation.

Claude MCP connects Claude Code or Claude Desktop to external tools and data through Model Context Protocol servers. In Claude Code, use claude mcp add for local stdio or remote HTTP servers, choose the correct configuration scope, run claude mcp list, and inspect /mcp before you let a server act on real data. In Claude Desktop, prefer reviewed desktop extensions or authenticated remote connectors where available.

This guide covers the current setup paths, configuration files, commands, server selection, and troubleshooting. Product-specific pages remain the canonical source for exact servers; this page explains how those servers fit into Claude.

Which Claude MCP setup should you use?

Claude supports more than one MCP experience. Pick the client and connection type before copying a command.

Anthropic’s Claude Code MCP documentation recommends HTTP for remote servers and documents stdio for local processes. The legacy SSE transport is deprecated; use HTTP where the server offers it.

Original Graphify illustration: Claude connects to local code and files through a local process, and to cloud systems through an authenticated remote boundary.

How do you add an MCP server to Claude Code?

Use claude mcp add, place every option before the server name, and place -- before the executable for stdio servers. Then verify the saved definition and connection status.

How do you add a remote HTTP MCP server?

Use this form for a remote Streamable HTTP endpoint:

claude mcp add --transport http <name> <url>

Example with a placeholder endpoint:

claude mcp add --transport http docs https://mcp.example.com/mcp

For an OAuth-enabled server, add it first, open Claude Code, and use /mcp to authenticate. Avoid a static bearer token when the server provides a supported OAuth flow.

How do you add a local stdio MCP server?

Use this form for a reviewed executable that Claude Code should launch:

claude mcp add --transport stdio <name> -- <command> [args...]

Example with a generic local package:

claude mcp add --transport stdio local-docs -- npx -y example-docs-mcp

The double dash matters. Claude Code options such as --transport, --env, and --scope must appear before the server name. Server command arguments belong after --.

How do you pass environment variables?

Pass secrets to the server environment instead of embedding them in a shared file:

claude mcp add --transport stdio \
  --env SERVICE_API_KEY="$SERVICE_API_KEY" \
  service -- npx -y example-service-mcp

This keeps the literal value out of .mcp.json, but it may still be stored in local Claude configuration when passed as a value. Prefer environment expansion or the server’s OAuth flow for reusable setups. Never commit an API key.

What are the Claude MCP commands?

The core Claude MCP list command and management commands are:

claude mcp list

claude mcp get <name>

claude mcp remove <name>

claude mcp add-json <name> '<json>'

claude mcp add-from-claude-desktop

claude mcp reset-project-choices

claude mcp serve

Inside Claude Code, use:

/mcp

The /mcp panel shows connection status and available tool counts. It also starts OAuth login for supported remote servers. Treat claude mcp list as configuration evidence and /mcp as live-session evidence; you need both when debugging.

Which Claude Code MCP configuration scope should you choose?

Claude Code supports local, project, and user scopes. The scope controls where a server loads, who receives the definition, and where it is stored.

Add the --scope option before the name:

claude mcp add --transport http --scope project docs https://mcp.example.com/mcp

For the same server name, Claude Code uses this precedence: local, project, user, plugin-provided, then Claude connectors. A higher-precedence duplicate can make a correct lower-level definition appear ignored.

Original Graphify illustration: nested configuration scopes converge on one active definition when names or endpoints overlap.

What does .mcp.json do in Claude Code?

.mcp.json stores project-scoped MCP server definitions that a team can review and share through version control. Claude Code asks for approval before using a project-scoped server from this file.

A remote example:

{
  "mcpServers": {
    "docs": {
      "type": "http",
      "url": "${DOCS_MCP_URL:-https://mcp.example.com/mcp}",
      "headers": {
        "Authorization": "Bearer ${DOCS_MCP_TOKEN}"
      }
    }
  }
}

A local example:

{
  "mcpServers": {
    "repo-helper": {
      "type": "stdio",
      "command": "npx",
      "args": ["-y", "example-repo-mcp"],
      "env": {
        "REPOSITORY_ROOT": "${CLAUDE_PROJECT_DIR:-.}"
      }
    }
  }
}

Claude Code expands ${VAR} and ${VAR:-default} in command, arguments, environment, URL, and headers. If a required variable has no value or default, parsing fails. Commit variable names and safe defaults—not secret values.

What does claude --mcp-config do?

The search phrases claude --mcp-config and claude code --mcp-config refer to starting Claude Code with an explicit MCP configuration file. Use it for an isolated configuration or automation that should not depend on the normal saved scopes.

claude --mcp-config ./path/to/mcp-config.json

Check your installed Claude Code version’s claude --help output before scripting this flag. CLI surface area can change faster than third-party tutorials.

How do you set up MCP in Claude Desktop?

For current Claude Desktop releases, Anthropic presents two primary paths:

How do you install a local desktop extension?

1. Open Settings → Extensions.
2. Browse the extension directory.
3. Install a reviewed extension.
4. Configure required values in the extension interface.
5. Restart or inspect extension logs if tools do not appear.

Anthropic’s local MCP server guide explains Desktop Extensions (.dxt) and organization controls. A DXT package reduces manual JSON and dependency work, but you should still review its publisher and requested access.

How do you add a remote connector?

1. Open Settings → Connectors.
2. Choose a pre-built connector or Add custom connector.
3. Use the URL published on the provider’s official site.
4. Authenticate and review OAuth permissions.
5. Enable only the tools needed for the task.

Remote connectors are appropriate for cloud services. Local desktop extensions are appropriate when the server must reach files or applications on your computer. Anthropic’s comparison of desktop and web connectors recommends matching the connection type to the data boundary.

What about claude_desktop_config.json and stdio?

Some local servers still document a manual Claude Desktop configuration. Follow the server’s current official instructions and use an absolute executable path if the desktop application cannot resolve your shell PATH. Prefer the extension UI when the same integration ships as a reviewed DXT.

Do not copy a random claude_desktop_config.json block without checking the package name, command, arguments, environment, and publisher. A JSON configuration is executable setup, not inert documentation.

What are the best MCP servers for Claude?

The best Claude MCP servers cover distinct jobs with little overlap. Start with two or three read-oriented capabilities.

How do Context7 and Claude Code work together?

Queries such as Claude Code MCP Context7 and Context7 MCP Claude Code belong to the dedicated Context7 profile. The integration pattern is simple: Claude calls a documentation tool with a library identity and version, then uses the returned official documentation while coding.

The benefit is freshness and version targeting. The risk is context volume and misplaced trust. Ask for the narrow documentation slice you need and retain links or identifiers that let you verify it.

How do Serena and Claude Code work together?

Queries such as Claude Code Serena, Serena MCP Claude Code, Serena Claude, and Serena Claude Code belong to the Serena profile. Serena focuses on semantic code navigation and editing workflows. Review its repository scope and edit capabilities before enabling it across projects.

Graphify covers a complementary need: it turns code, documents, and design artifacts into a living knowledge graph. Use this structural context when Claude needs to reason across modules rather than retrieve isolated files.

How do you add Supabase, Postgres, or MySQL?

Use the provider’s current endpoint or package instructions, then apply least privilege:

• Claude Code add MCP Supabase: begin with the Supabase MCP profile and a restricted project role.
• Claude MCP Postgres / Claude Postgres MCP: use the Postgres MCP profile and a read-only connection for inspection.
• Claude MySQL MCP / Claude Snowflake MCP / Snowflake MCP Claude: separate schema and query access from mutation or administrative operations.

Never give a general coding session a production owner credential.

How do you add Playwright or Puppeteer?

For add Playwright MCP to Claude Code, install Playwright MCP Claude Code, and Claude Playwright MCP, follow the Playwright MCP profile. Use a test account, isolate browser state, and confirm before submissions, purchases, or destructive actions.

For Claude Code Puppeteer MCP or Puppeteer MCP Claude Code, verify the package and publisher because similarly named community servers exist. Do not run browser automation against a personal profile that contains unrelated authenticated sessions.

How do you add GitHub, Atlassian, Jira, or Notion?

• For Claude Code GitHub MCP and add GitHub MCP to Claude Code, use the GitHub MCP profile. Start with repository read access.
• For Atlassian MCP Claude Code and add Atlassian MCP to Claude Code, use the Atlassian MCP profile and review site scopes.
• For Jira MCP Server Claude Code, route through the Atlassian/Jira product documentation and separate search from issue mutation.
• For Claude MCP Notion, use the Notion MCP profile and restrict page access.

What about memory, filesystem, and other specialized servers?

Use Claude memory MCP or Claude Code memory MCP only after you understand retention, deletion, and cross-project isolation. Use Claude filesystem MCP with explicit allowed roots. A filesystem server should not receive your entire home directory by default.

Specialized searches—including Claude MCP SSH, Claude Outlook MCP, Claude MCP PDF, Claude Projects MCP, Claude Code Stripe MCP, Vercel MCP Claude Code, Excalidraw MCP Claude Code, Unity MCP Claude, Claude Mac MCP RStudio, Sequential Thinking MCP Claude Code, Windows-MCP Claude, Claude Python MCP, and browser MCP Claude—represent separate trust and capability profiles. Verify each publisher and keep the exact product page canonical rather than relying on a generic list.

How do you verify a Claude MCP installation?

Use this sequence after every change:

1. Run claude mcp get <name> and confirm the saved type, command or URL, and scope.
2. Run claude mcp list and check whether the server connects.
3. Open Claude Code and run /mcp.
4. Inspect the live tool count and authenticate if required.
5. Ask Claude to describe the available tools without calling them.
6. Run one read-only operation with test data.
7. Review the returned source, server logs, and permission prompt.
8. Test one expected failure, such as an out-of-scope path or unauthorized write.

A successful connection proves transport and initialization. It does not prove that the right server is running or that every tool is safe.

Why is Claude MCP not working?

Diagnose the first failed layer instead of reinstalling everything.

Claude Code warns when a tool output exceeds 10,000 tokens and uses a default maximum of 25,000 tokens for tools without their own limit, according to the current official documentation. Use MAX_MCP_OUTPUT_TOKENS only after fixing unnecessarily broad queries.

Why does stdio connect in a terminal but fail in Claude Desktop?

Desktop applications often inherit a different environment from your interactive shell. Use an absolute executable path, provide required environment variables explicitly, and inspect the extension or server logs. Do not solve PATH errors by running the whole desktop app with excessive privileges.

Why does a server show zero tools?

The server may expose only resources or prompts, may require authentication before publishing tools, or may have declared the tools capability without returning tools. Inspect /mcp, server logs, and the server’s official capability documentation.

How do you secure Claude MCP?

Apply controls at several layers:

• Choose provenance: install from the provider’s official page or a verified registry record.
• Minimize scope: prefer local or project scope over user scope for task-specific tools.
• Protect secrets: use OAuth or environment expansion; never commit tokens.
• Separate read and write: use different credentials or server profiles where possible.
• Constrain local access: allow specific directories, not an entire home folder.
• Review live tools: a package name does not tell you every action it exposes.
• Require confirmation: protect destructive, publishing, financial, and external-message actions.
• Isolate browser state: use test accounts and dedicated profiles.
• Log and revoke: keep enough evidence to investigate and remove access quickly.
• Treat external content as untrusted: files, issues, pages, and tool results can contain prompt-injection attempts.

For teams, Claude Code supports managed MCP configuration and allow/deny policies. A deny rule takes precedence over an allow rule. Central policy reduces configuration drift but does not replace server-side authorization.

Frequently asked questions

What is Claude MCP?

Claude MCP is Claude’s use of Model Context Protocol to connect to external servers that expose tools, resources, or prompts. Claude Code, Claude Desktop extensions, and remote connectors use different configuration experiences.

Is Claude an MCP client?

Claude Code and Claude Desktop act as MCP hosts and manage client connections to servers. The underlying Claude model is not itself the network client.

Where is Claude Code MCP configuration stored?

Local and user scopes are stored in ~/.claude.json. Project-scoped servers are stored in .mcp.json at the repository root.

What is the Claude MCP server config format?

Each entry sits under mcpServers and defines a local stdio command or a remote URL. Use claude mcp add to generate the correct shape when possible.

How do I list Claude MCP servers?

Run claude mcp list in the terminal. Inside Claude Code, run /mcp to inspect live status, tools, and authentication.

Can Claude Code itself run as an MCP server?

Yes. Run claude mcp serve to expose Claude Code’s tools over stdio to another MCP client. The consuming client remains responsible for user confirmation and safety controls.

Are Claude Desktop MCP servers the same as Claude Code servers?

They can point to the same server, but configuration, packaging, scope, and supported features differ. Claude Code can import selected Desktop servers on macOS and WSL with claude mcp add-from-claude-desktop.

Which Claude MCP servers should I install first?

Install one server for your highest-value recurring job and one for supporting context. A documentation server plus a repository or code-understanding server is a strong read-oriented starting point.

Recommended Claude MCP rollout

Start in a disposable repository. Add one server at local scope. Inspect its live tools. Complete a read-only task. Record permissions and data flow. Move the definition to project scope only after review, and keep secrets in environment variables or OAuth storage. Add a second server only when it closes a measured capability gap.

For current product instructions, use the dedicated MCP server directory and exact product profiles linked above. For protocol concepts, read What Is MCP?.