An MCP server exposes tools, resources and prompts to AI clients (Claude, ChatGPT, Cursor, VS Code, Codex and others) over the Model Context Protocol. The client starts or connects to the server, lists its tools, and the model decides when to call them. That makes the server choice a security decision as much as a feature one: every tool you install is something a model can invoke on your behalf.
This list favours servers that are maintained by the protocol project itself or by the vendor whose API they wrap. The modelcontextprotocol/servers repository now keeps only a small set of reference servers (Everything, Fetch, Filesystem, Git, Memory, Sequential Thinking, Time); the older GitHub, PostgreSQL, SQLite, Slack, Sentry, Puppeteer and Redis reference servers were moved to the servers-archived repository, and most were replaced by official vendor servers. If you used one of those archived servers, migrate to the vendor version listed below.
Transports: stdio servers run as a local subprocess that the client launches (good for files, git and local databases); Streamable HTTP servers run as an independent service at a single /mcp endpoint and replaced the older HTTP+SSE transport (good for hosted SaaS servers with OAuth). The spec requires HTTP servers to validate the Origin header, recommends binding local servers to 127.0.0.1 and implementing authentication. Treat all tool output as untrusted input: text fetched from a web page, issue or support ticket can carry prompt-injection instructions, so pair write-capable servers with least-privilege tokens and keep tool-approval prompts on.
Tools, licences and pricing checked against vendor and repository pages on November 8, 2026.
1. GitHub MCP Server
MITBest for: Repository, issue and pull-request automation from an AI client · Free and open source; the hosted endpoint uses your GitHub account
GitHub's official MCP server connects AI tools to repositories, issues, pull requests and other GitHub APIs. GitHub hosts a remote endpoint at https://api.githubcopilot.com/mcp/, and you can also run it locally from the ghcr.io/github/github-mcp-server Docker image or a Go binary over stdio. Toolsets (--toolsets or GITHUB_TOOLSETS) limit which API areas are exposed, and --read-only skips every write tool.
Strengths
- + Official replacement for the archived reference GitHub server
- + Toolsets and read-only mode make least-privilege setups straightforward
- + Hosted remote option, so there is nothing to install
Trade-offs
- − A broad token plus write toolsets gives the model a lot of power over your repos
- − Issue and PR text is untrusted content that can carry prompt injection
2. Playwright MCP
Apache-2.0Best for: Browser automation, end-to-end testing and web research agents · Free and open source
Microsoft's Playwright MCP server drives a real browser and gives the model Playwright's accessibility tree instead of screenshots, so it works without a vision model. Install with npx @playwright/mcp@latest; it runs over stdio by default and can listen on a port (for example --port 8931, endpoint http://localhost:8931/mcp) for HTTP clients.
Strengths
- + Structured accessibility snapshots are cheaper and more deterministic than pixels
- + Maintained by the Playwright team; one npx command to start
- + Supports both stdio and HTTP
Trade-offs
- − Pages the agent visits are untrusted input and a prompt-injection vector
- − A logged-in browser profile exposes whatever that session can reach
3. Filesystem (reference server)
Apache-2.0Best for: Giving a desktop AI client scoped access to a project folder · Free and open source
The reference Filesystem server gives a model read and write tools (read_text_file, list_directory, search_files, edit_file with dry-run preview, write_file, move_file and more) restricted to directories you pass as arguments: npx -y @modelcontextprotocol/server-filesystem /path/one /path/two. With Docker you can mount directories read-only.
Strengths
- + Access limited to explicitly allowed directories
- + Clear split between read-only and write-capable tools
- + Maintained in the official MCP servers repository
Trade-offs
- − write_file overwrites and move_file removes the source; review tool calls
- − Reference implementation: meant as an example as much as a product
4. Fetch (reference server)
Apache-2.0Best for: Letting a model read web pages and documentation · Free and open source
The reference Fetch server retrieves a URL and converts it to Markdown, with max_length and start_index parameters for reading long pages in chunks. Run it with uvx mcp-server-fetch. It respects robots.txt for model-initiated requests unless you pass --ignore-robots-txt.
Strengths
- + Small and simple: one fetch tool
- + Markdown conversion keeps token use down
Trade-offs
- − The README warns it can reach local and internal IP addresses (SSRF risk)
- − Fetched pages are untrusted text that can contain injected instructions
5. Git (reference server)
Apache-2.0Best for: Local repository inspection and commits from an AI client · Free and open source
The reference Git server exposes 12 tools for status, diffs, staging, commits, log, show and branch operations on a local repository. Run it with uvx mcp-server-git. Its README notes it is in early development, so tools may change.
Strengths
- + Works offline against local repositories
- + Small, well-defined tool set
Trade-offs
- − Marked early development by its maintainers
- − No push or remote operations; pair with the GitHub server for that
6. MCP Toolbox for Databases
Apache-2.0Best for: One MCP server for many SQL and NoSQL databases · Free and open source; database and hosting costs are separate
Google's open-source MCP server for databases (formerly Gen AI Toolbox for Databases; the genai-toolbox repo was renamed mcp-toolbox). It offers prebuilt tools and a framework for custom, parameterised SQL tools across PostgreSQL, MySQL, SQL Server, BigQuery, AlloyDB, Spanner, Oracle, MongoDB, Redis, ClickHouse, Snowflake and more.
Strengths
- + Very broad database coverage, including SQL Server
- + Custom tools let you expose fixed, reviewed queries instead of free-form SQL
Trade-offs
- − Some features are still flagged beta in minor releases
- − Configuration is YAML-heavy compared with single-database servers
7. SQL MCP Server (Data API builder)
MITBest for: Exposing SQL Server or Azure SQL to agents with strict, role-based access · Free and open source; Azure hosting billed separately
Microsoft's SQL MCP Server ships inside Data API builder 1.7 and later. It deliberately avoids natural-language-to-SQL: agents call seven fixed DML tools (describe_entities, read_records, create_record, update_record, delete_record, execute_entity, aggregate_records) against entities you define, and DAB generates the T-SQL. It supports Streamable HTTP and stdio, with role-based permissions on every tool and no DDL.
Strengths
- + Deterministic query generation instead of model-written SQL
- + Per-entity permissions and the ability to disable DML tools per entity
- + Same config also serves REST and GraphQL
Trade-offs
- − You must model entities in dab-config.json before agents can use them
- − No schema-change (DDL) support by design
8. Sentry MCP
FSL-1.1-Apache-2.0Best for: Debugging production errors from inside an AI coding tool · No separate MCP price listed; uses your Sentry plan
Sentry's official MCP server lets an AI client search issues, inspect errors and work with Sentry projects. The hosted service at https://mcp.sentry.dev/mcp uses OAuth; a stdio mode (npx @sentry/mcp-server@latest with an access token) targets self-hosted Sentry and is described as a work in progress.
Strengths
- + Official replacement for the archived reference Sentry server
- + Hosted remote server with OAuth: no token pasting for most users
Trade-offs
- − Functional Source Licence, not OSI open source until each release converts to Apache-2.0 after two years
- − Stdio mode for self-hosted Sentry is still a work in progress
9. Cloudflare MCP servers
Apache-2.0Best for: Managing Cloudflare accounts and Workers from an AI client · No separate MCP price listed; uses your Cloudflare account
Cloudflare's recommended Cloudflare API MCP server (https://mcp.cloudflare.com/mcp) covers about 2,500 API endpoints through three Code Mode tools (docs, search, execute), with OAuth or an API token. Separate remote servers remain for documentation, containers and browser rendering; several older product servers (Workers Bindings, Observability, Radar and others) are deprecated in favour of the API server.
Strengths
- + Code Mode keeps the tool list to three entries despite the huge API surface
- + OAuth by default; API tokens for CI
Trade-offs
- − Executing arbitrary API calls needs carefully scoped tokens
- − Several older per-product servers are deprecated, so older guides are out of date
10. Stripe MCP
CommercialBest for: Payments, billing and support workflows that touch Stripe data · No separate MCP price listed; Stripe fees apply as usual
Stripe's hosted MCP server at https://mcp.stripe.com exposes API search, read and write tools plus documentation search. Interactive clients authenticate with OAuth; autonomous agents use agent API keys with only the permissions they need. Stripe says it will stop accepting full-access secret keys and untagged restricted keys from December 2026, and some actions (such as refunds) require human confirmation in the Dashboard.
Strengths
- + OAuth sessions are revocable per user and per environment
- + Human-confirmation step on sensitive actions
- + Docs explicitly warn about prompt injection when combined with other servers
Trade-offs
- − Write access to live payments demands sandbox testing first
- − Hosted only: there is no self-hosted version of the current server
