Best MCP Servers in 2026: 10 Worth Connecting, With Install Commands

The best MCP servers for most developers in 2026 are GitHub, Context7, Playwright, Supabase, Sentry, Linear, Notion, Figma and Stripe, plus one server that lets the agent reach you when it needs a decision. All ten are maintained by the company behind the product, most run as a hosted endpoint you add with one command, and most have a switch that keeps them read-only or scoped to one project.

If you are new to the protocol itself, read what MCP is and how it works first. This post assumes you know what a server is and want to know which ones are worth the context they take up.

How we picked

We used four rules:

• Maintained by the vendor. The server comes from the company whose API it wraps (or, for Playwright and Context7, from the team that builds the tool). No unofficial wrappers.
• Active and documented. Each one has current setup docs that cover Claude Code, Cursor or both.
• Easy to connect. A hosted Streamable HTTP endpoint, or a single npx command for servers that have to run locally.
• A safety switch. A read-only mode, a project scope, a narrow token, or a confirmation step for risky writes.

We checked every install command below against the vendor's own docs on October 29, 2026. One entry, AlertMCP, is our own product. It is marked as such, and you should weigh it accordingly.

The setup syntax for each client differs. The commands below use Claude Code because it is the most common; for Cursor, Codex, VS Code, Gemini CLI and the rest, our remote MCP server setup guide has the exact config format for each.

Quick comparison

1. GitHub MCP Server

What it does. GitHub's official server connects an agent to repositories, code search, issues, pull requests, Actions runs, Dependabot and code scanning alerts, discussions, gists, projects and notifications. Tools are grouped into toolsets. With no configuration you get the default set: context, repos, issues, pull_requests and users.

Why it matters. Your coding agent can already read your local checkout. This covers the rest of the job: triaging issues, opening and reviewing PRs, and finding out why a workflow failed without switching to the browser.

Good to know. The hosted endpoint is https://api.githubcopilot.com/mcp/. Per the remote server docs, you get read-only mode by appending /readonly to the URL or sending X-MCP-Readonly: true, and you narrow the toolsets with an X-MCP-Toolsets: repos,issues header. If you run the server locally, --read-only does the same. Give it a fine-grained token scoped to the repositories it actually needs.

Install (Claude Code 2.1.1 or later, run in your terminal):

claude mcp add-json github '{"type":"http","url":"https://api.githubcopilot.com/mcp","headers":{"Authorization":"Bearer YOUR_GITHUB_PAT"}}'

A read-only setup in Cursor, reading the token from an environment variable:

{
  "mcpServers": {
    "github": {
      "url": "https://api.githubcopilot.com/mcp/",
      "headers": {
        "Authorization": "Bearer ${env:GITHUB_PAT}",
        "X-MCP-Readonly": "true"
      }
    }
  }
}

Cost. The server is open source under the MIT license. Tools that drive paid GitHub features need that plan; Copilot cloud agent tools, for example, need a Copilot subscription.

2. Context7

What it does. Context7 from Upstash fetches version-specific documentation and code examples for the library you are using and hands them to the model. Two tools do the work: resolve-library-id turns a package name into a Context7 ID, and query-docs pulls the relevant section.

Why it matters. Models are trained on a snapshot. Ask about a framework that changed its API last quarter and you get old signatures, or functions that never existed. Context7 gives the model the current docs instead of its memory.

Good to know. It runs as a hosted endpoint at https://mcp.context7.com/mcp or locally with npx -y @upstash/context7-mcp. An API key is optional, but Context7 recommends one for higher rate limits, and npx ctx7 setup --claude (or --cursor) configures it for you. The server only reads documentation, but that documentation is third-party text, so it still counts as untrusted input.

Install (Claude Code):

claude mcp add --scope user --header "Authorization: Bearer YOUR_API_KEY" --transport http context7 https://mcp.context7.com/mcp

Cost. Per context7.com/plans in October 2026: Free is $0 with 1,000 calls a month, and Pro is $10 per seat per month with 2,000 calls per seat.

3. Playwright MCP

What it does. Microsoft's Playwright server lets an agent open pages, click, type, fill forms and read what happened. It works from the accessibility tree rather than screenshots, so it needs no vision model and its actions are deterministic. The --caps flag adds optional vision, pdf and devtools capabilities.

Why it matters. This is how an agent checks its own work. "Fix the checkout bug" becomes "fix it, open the page, run through checkout, and confirm the form submits."

Good to know. It runs locally, so there is no hosted endpoint. --headless is for CI, --isolated keeps the browser profile in memory instead of on disk, and --allowed-origins takes a semicolon-separated list of trusted origins the browser may request. The README also notes that coding agents may do better with Playwright's CLI plus skills than with the MCP server, which is worth testing if your client supports skills. If you mostly need performance traces and network debugging, Google's Chrome DevTools MCP is the closest alternative.

Install (Claude Code):

claude mcp add playwright npx @playwright/mcp@latest

The same server in a generic mcp.json, with an in-memory profile:

{
  "mcpServers": {
    "playwright": {
      "command": "npx",
      "args": ["@playwright/mcp@latest", "--isolated"]
    }
  }
}

Once a version works for you, replace @latest with that exact version so an upstream release cannot change what runs on your machine.

Cost. Free and open source under Apache-2.0.

4. Supabase MCP

What it does. Supabase's hosted server gives an agent tool groups for the database, debugging, development, Edge Functions, account management, docs and (experimental) branching. Storage tools exist but are off by default.

Why it matters. The risk in letting an agent touch a database is scope, and Supabase gives you the controls in the URL: project_ref pins the server to one project, read_only=true allows only read queries, and features=database,docs turns off every other group.

Good to know. Authentication is OAuth by default, so you don't need to create a personal access token unless you are wiring it into CI. The Supabase MCP docs are direct about prompt injection: data in your tables can contain instructions that steer the model. They tell you to keep manual approval on, to connect to production only when the task needs production evidence, and never to hand the server to customers, because it runs with your developer permissions.

Install (Claude Code, scoped to one project and read-only):

claude mcp add --scope project --transport http supabase "https://mcp.supabase.com/mcp?project_ref=YOUR_PROJECT_REF&read_only=true"

Cost. Free with a Supabase account. Branching requires a paid plan.

5. Sentry MCP

What it does. Sentry's hosted server lets an agent search errors, analyze performance, triage issues, read Sentry's documentation and manage projects. Sentry describes it as built for human-in-the-loop coding agents such as Cursor and Claude Code.

Why it matters. "Why is this endpoint throwing?" becomes a question the agent can answer with the real stack trace and event data, next to the code it is about to change.

Good to know. All hosted connections use OAuth. You can scope the server to one organization (/mcp/your-org) or one project (/mcp/your-org/your-project), and a scoped server hides the discovery tools it no longer needs, so Sentry recommends project scope where possible. The sentry-mcp README adds ?skills= and ?disable-skills= query parameters to narrow the tool set further. A local stdio version is available as npx @sentry/mcp-server@latest with a user auth token.

Install (Claude Code, project-scoped):

claude mcp add --transport http sentry https://mcp.sentry.dev/mcp/your-org/your-project

Cost. Sentry's MCP docs list no separate price. You need a Sentry account.

6. Linear MCP

What it does. Linear's server has tools for finding, creating and updating issues, projects and comments.

Why it matters. The agent can read the ticket it is working on, file follow-ups for the things it found but should not fix now, and update status when the PR lands.

Good to know. Linear runs a separate read-only endpoint, https://mcp.linear.app/mcp/readonly, which "only ever exposes read tools." Authentication is OAuth 2.1 with dynamic client registration, or a bearer API key; for read-only access, request only the read scope or create a key with only the Read permission. The old /sse endpoint is deprecated. Details are in Linear's MCP docs.

Install (Claude Code, then run /mcp to sign in):

claude mcp add --transport http linear-server https://mcp.linear.app/mcp

Swap the URL for https://mcp.linear.app/mcp/readonly if the agent only needs to read.

Cost. Linear's docs list no separate price for MCP. It uses your existing workspace.

7. Notion MCP

What it does. Notion's hosted server lets an agent search your workspace and connected sources and work with your pages, acting with the access of the person who authorized it.

Why it matters. Specs, meeting notes, roadmaps and runbooks tend to live in Notion. With access, the agent works from the real plan instead of the paraphrase you typed into the prompt, and it can file the summary when the job is done.

Good to know. Authentication is interactive OAuth: add the server, run /mcp, and complete the sign-in. On Business and Enterprise plans, a workspace owner can create an MCP token that a client sends as a bearer token with no browser step. There is an SSE fallback at https://mcp.notion.com/sse, which Notion says to use only if your client lacks Streamable HTTP. Limiting which clients members can connect requires the Enterprise plan (Notion's MCP guide).

Install (Claude Code):

claude mcp add --transport http notion https://mcp.notion.com/mcp

Cost. Notion lists no separate price for the MCP server.

8. Figma MCP

What it does. Figma's server gives an agent design context (variables, components, layout) from the frames you select, so generated code matches the design system. It can also pull FigJam and Make resources and use Code Connect mappings. A beta write-to-canvas feature lets agents build and update frames, components and variables in Figma itself.

Why it matters. Design-to-code is where agents most often guess. With the real variables and component names, the output uses your tokens instead of hard-coded hex values.

Good to know. The remote server at https://mcp.figma.com/mcp works without the desktop app; the desktop server requires a Dev or Full seat on a paid plan. Writing outside your drafts requires a Full seat. Read tools are rate-limited by seat, per Figma's limits page: View and Collab seats get up to 20 calls a month, while Dev and Full seats get 200 a day on Professional and Organization and 600 a day on Enterprise. Write tools are exempt.

Install (Claude Code): Figma recommends its plugin, claude plugin install figma@claude-plugins-official, which bundles the server. The manual route:

claude mcp add --transport http figma https://mcp.figma.com/mcp

Then run /mcp, select figma, and choose Authenticate.

Cost. The limits above depend on your Figma plan and seat. Write to canvas is free during the beta.

9. Stripe MCP

What it does. Stripe's server exposes a small set of tools that reach most of the Stripe API: stripe_api_search and stripe_api_details to find the right method, stripe_api_read for any GET, and stripe_api_write for writes, plus documentation search and an integration planner.

Why it matters. Billing questions ("which customers on the old price are still active?") and integration work both need live account data, and this is the vendor-supported way to give an agent that access.

Good to know. It has the best guardrails on this list. OAuth lets you grant access to a sandbox or a live account with different permissions for each, and an admin can turn MCP access on or off for the team separately for live mode and sandboxes. For unattended clients, Stripe wants an agent API key with only the permissions the client needs; per the Stripe MCP docs, the server stops accepting full-access secret keys and untagged restricted keys in December 2026. Certain writes, such as refunds and outbound payments, require you to approve the request on a Stripe page before the agent can retry it.

Install (Claude Code, then run /mcp to sign in):

claude mcp add --transport http stripe https://mcp.stripe.com/

Cost. Stripe lists no separate price for the MCP server.

10. AlertMCP (we build this one)

What it does. AlertMCP is our own server, so read this entry with that in mind. It gives an agent a way to reach you when you are away from the terminal. notify sends a one-way alert to your phone and desktop. ask sends a question with two to four buttons, safest option first, and your tap goes back to the agent. ask_text asks an open question you answer by typing. get_answer waits for the reply, and list_topics returns your topics and their delivery rules.

Why it matters. The nine servers above give an agent more it can do. None of them helps when it needs a decision and you have walked away. Our Claude Code notifications guide covers the full setup, including Claude Code's built-in options.

Good to know.

• The agent decides when to call ask, based on your instructions or its own judgement. AlertMCP does not intercept or answer the built-in permission dialogs of Claude Code, Cursor or Codex. For those, use Claude Code Remote Control, the Cursor iOS app or Codex in the ChatGPT app.
• get_answer waits at most 50 seconds per call and returns "pending" if nobody has answered yet, so the agent calls it again in a loop.
• Each workspace sets a deadline from 5 minutes to 24 hours. On timeout, the agent is told nobody answered, continues with the first (safest) option, or the ask escalates to team admins. You pick which.
• Alerts are encrypted in transit (HTTPS) and at rest (AES-256-GCM), but our relay has to read an alert to deliver it, so it is not end-to-end encrypted.
• It is not the only option. Pushary, ntfy-mcp-server and several Telegram- and Discord-based human-in-the-loop servers do similar jobs.

Install (Claude Code):

claude mcp add --transport http alertmcp https://api.alertmcp.com/mcp --header "Authorization: Bearer amcp_sk_…"

Then add one line to CLAUDE.md or AGENTS.md: "When a task takes longer than 2 minutes, or you need my approval, use alertmcp.notify / alertmcp.ask."

Cost. Free for up to 1,000 alerts a month and 5 devices. Team is $8 per seat per month.

How many servers should you run?

Fewer than you think. Our recommendation is three to six for most developers, chosen per project. That is a judgement, not a statistic: each server adds tool definitions the model has to pick between, a long list of overlapping tools makes the wrong pick more likely, and each server is one more thing that can act with your credentials.

Some clients soften the context cost. Claude Code's tool search is on by default and loads only tool names and server instructions at session start, fetching full definitions when they are needed. Claude Code also warns when a single tool result passes 10,000 tokens and caps it at 25,000 by default (MAX_MCP_OUTPUT_TOKENS changes that). Codex lets you trim a server with enabled_tools and disabled_tools in config.toml. Selection quality and attack surface still scale with the number of servers.

Scope servers to where you need them. In Claude Code, --scope local (the default) keeps a server to you in the current project, --scope project writes it to .mcp.json so the team shares it through version control, and --scope user makes it available everywhere. A sensible split:

• Every project: Context7 and GitHub, at user scope.
• Web apps: add Playwright, plus Supabase or Sentry at project scope.
• Product work: Linear and Notion.
• Design handoff: Figma, only where you implement designs.

Choosing MCP servers safely

An MCP server can read and act with whatever access you give it, and the model decides when to call it. Our guide to human-in-the-loop AI agents covers approval policy in depth; the short version for servers:

• Least privilege first. Use a fine-grained GitHub token limited to specific repos, a Linear key with only the Read permission, a Stripe agent key with only the permissions it needs, and a Supabase URL pinned to one project_ref. Never paste a full-access key because it was quicker.
• Start read-only. GitHub's /readonly, Linear's /mcp/readonly and Supabase's read_only=true all exist for this. Turn on writes for one server at a time, once you trust the workflow.
• Assume prompt injection. Anything the agent reads (an issue body, a database row, a web page, a Notion comment) can contain text written to steer it. Supabase and Stripe both warn about this in their docs. Be most careful when one session combines private data, untrusted content and a tool that can send data out.
• Keep approval on for writes. The MCP spec says there should always be a human able to deny tool invocations, and that clients must treat a server's own read-only or destructive hints as untrusted unless the server is trusted. Merges, deploys, refunds and deletes should wait for a person.
• Watch the supply chain. The OWASP Top 10 for Agentic Applications lists Agentic Supply Chain Vulnerabilities as ASI04 and cites a malicious npm package that impersonated postmark-mcp and quietly copied outgoing emails to the attacker (September 2025). Prefer vendor-hosted endpoints, install local servers only from the vendor's own package, and pin versions.
• Review shared configs. A cloned repository can ship a .mcp.json. Claude Code asks for approval before using project-scoped servers from that file in interactive sessions; read what it lists before you say yes.

Where to find more servers

The official MCP Registry is the canonical index. It is still in preview, with possible breaking changes or data resets before general availability. It stores metadata only, verifies that publishers own their namespace, and leaves security scanning to package registries and downstream marketplaces. When we paged its API on October 29, 2026, we counted more than 50,000 server names, and because it does not curate, that count includes test and spam entries.

Two servers we left off the main list:

• Slack's official server (https://mcp.slack.com/mcp) covers search, messages and canvases, but per Slack's docs only directory-published or internal Slack apps may use it, and workspace admins approve each client. If your client is one of Slack's partners (Claude.ai, Claude Code, Cursor, Perplexity), it is worth a look.
• Chrome DevTools MCP, mentioned under Playwright, for performance and network debugging.

For anything else, start with the vendor's own docs. A server maintained by the company that owns the API is almost always a better bet than a community wrapper with more stars.

Also from our team

Disclosure: these are also built by the team behind AlertMCP, which is why we kept them out of the ranked list. Image MCP Server gives coding agents tools to generate, edit, upscale and background-remove images and convert formats. Redesignr AI rebuilds an existing site in several design directions and exports clean HTML. PostMCP AI is an open-source (MIT) social media MCP server that drafts, schedules and reports on posts across seven networks.