MCP servers worth installing

What it does

• Filesystem MCP Server. Node.js MCP server for local filesystem operations: read/write files, create/list/delete directories, move, search, metadata, and an allow-list of directories. All operations are restricted to those allowed directories. How: npx -y @modelcontextprotocol/server-filesystem /path/to/dir1 /path/to/dir2 (Claude Desktop mcpServers.filesystem). Docker: mcp/filesystem with binds mounted at /projects. Command-line allowed directories are required for protocol 2026-07-28; MCP Roots is deprecated. source
• GitHub MCP Server. GitHub-maintained MCP server that lets agents read repositories and files, manage issues and pull requests, inspect Actions, Dependabot, code scanning, and related GitHub APIs. Default toolsets are context, repos, issues, pullrequests, and users. How: Remote (recommended): HTTP url https://api.githubcopilot.com/mcp/ with OAuth, or Authorization: Bearer PAT. Local: docker run -i --rm -e GITHUBPERSONALACCESSTOKEN ghcr.io/github/github-mcp-server, or github-mcp-server stdio. Toolsets via GITHUBTOOLSETS or --toolsets. source
• Playwright MCP. Browser automation MCP server using Playwright accessibility snapshots (no vision model required). Core tools include browsernavigate, browsersnapshot, browserclick, browsertype, tabs, screenshots, and network inspection; extra groups via --caps. How: mcpServers.playwright command npx args "@playwright/mcp@latest". Headed by default; add --headless. Cursor: Settings → MCP → Add new MCP Server, command npx @playwright/mcp@latest. Claude Code: claude mcp add playwright npx @playwright/mcp@latest. HTTP: npx @playwright/mcp@latest --port 8931 then url http://localhost:8931/mcp. source
• Brave Search MCP Server. Official Brave MCP server over the Brave Search API: bravewebsearch, bravelocalsearch, bravevideosearch, braveimagesearch, bravenewssearch, bravesummarizer, braveplacesearch, and bravellmcontext. How: Requires BRAVEAPIKEY (or BRAVEAPIKEYFILE). Claude Desktop NPX: npx -y @brave/brave-search-mcp-server --transport http with env BRAVEAPIKEY. VS Code NPX uses --transport stdio. Docker image docker.io/mcp/brave-search. Default transport is STDIO. source
• Supabase MCP Server. Official hosted MCP for Supabase/Postgres: listtables, listextensions, listmigrations, applymigration, executesql, logs/advisors, Edge Functions, account tools, searchdocs, experimental branching, and Storage (off by default). How: Hosted URL https://mcp.supabase.com/mcp (local CLI: http://localhost:54321/mcp). Cursor: .cursor/mcp.json url that endpoint, then agent mcp login supabase. Scope with ?projectref=, ?readonly=true, ?features=database,docs. Claude Code: claude mcp add --scope project --transport http supabase "https://mcp.supabase.com/mcp". source
• Git. Reference MCP server with tools to read, search, and manipulate Git repositories. How: uvx mcp-server-git, or pip install mcp-server-git then python -m mcpservergit. Claude Desktop example: command uvx, args "mcp-server-git", "--repository", "path/to/git/repo". source
• Fetch. Reference MCP server for web content fetching and conversion for efficient LLM usage. How: TypeScript reference servers in this repository can be used directly with npx (same pattern as npx -y @modelcontextprotocol/server-memory). source
• Tools. Schema-defined functions the model can call (tools/list, tools/call). They can write to databases, call APIs, modify files, or run other logic; applications may require consent before execution. How: Protocol methods tools/list (discover definitions) and tools/call (execute). Clients typically surface approval dialogs and permission settings. source

Modes

• Remote GitHub MCP Server. GitHub-hosted HTTP server at https://api.githubcopilot.com/mcp/. Easiest setup; OAuth by default or a PAT in Authorization. GitHub Enterprise Server does not host this remote server. source
• Local GitHub MCP Server. Runs on the machine via Docker image ghcr.io/github/github-mcp-server (or a built binary with github-mcp-server stdio). OAuth on github.com or GITHUBPERSONALACCESSTOKEN, which takes precedence. source
• Read-Only Mode. Local GitHub MCP flag --read-only or GITHUBREADONLY=1 offers only read-only tools so repositories, issues, and pull requests cannot be modified. Write tools are skipped even if listed in --tools. source
• Insiders Mode. Early-access GitHub MCP tools. Remote: https://api.githubcopilot.com/mcp/insiders or header X-MCP-Insiders: true. Local: --insiders or GITHUBINSIDERS=true. source
• STDIO. Brave Search MCP default transport (BRAVEMCPTRANSPORT or --transport). Follows established MCP conventions for a locally spawned process. source
• HTTP. Brave Search MCP optional transport (--transport http or BRAVEMCPTRANSPORT=http). Default bind 127.0.0.1:8080; 0.0.0.0 is required in containers but the HTTP endpoint is unauthenticated. source
• headed mode. Playwright MCP default: the browser is visible. Use --headless to hide it. Persistent login state is stored under the ms-playwright mcp profile for the workspace. source
• project-scoped mode. Supabase MCP URL query projectref= limits tools to one project and disables account-management tools (listprojects, createproject, getcost, and similar). Combine with readonly=true. source

Pricing and limits

• Search: $5 per 1,000 requests. 50 queries per second. Credits are automatically applied to your account. Prepaid credits, no subscription; no minimums. source
• Answers: $4 per 1,000 requests + $5 per million input/output tokens. 2 queries per second. Credits are automatically applied to your account. source

Recent changes

• 2026-07-28: Specification 2026-07-28 makes MCP stateless: remove initialize/initialized and Mcp-Session-Id; every request carries protocol version in meta; servers MUST implement server/discover; Roots, Sampling, and Logging are deprecated (pass directories via tool args or server config instead of Roots). source
• 2026-07-28: Filesystem MCP documents that it serves both eras on stdio (2026-07-28 server/discover with no handshake, and 2025-era initialize). Roots is deprecated as of 2026-07-28; a 2026-07-28 connection cannot use Roots, so command-line allowed directories are the whole allow-list. source
• Brave Search MCP 2.x defaults to STDIO instead of HTTP (set BRAVEMCPTRANSPORT=http or --transport http to keep HTTP). braveimagesearch no longer returns base64 image data; the payload follows the Brave Search API response to cut latency and context size. source
• 2026-10-19: Maintainers triaged filesystem issue #3752 (unbounded path parameters / prompt-injection traversal report) as Priority Low and moved it to Servers V2 Incoming, stating security reports are handled off-thread. source

Alternatives

• Playwright CLI. Microsoft positions CLI+SKILLS as better for coding agents on large codebases: lower token cost (concise CLI output, skills on demand), default headless, install with npm install -g @playwright/cli. MCP stays for persistent browser state, snapshot introspection, and long agentic loops. source
• Puppeteer. Archived MCP reference for browser automation and web scraping at servers-archived. Current browser install is Playwright MCP (@playwright/mcp), not this reference. source
• PostgreSQL. Archived reference MCP: read-only database access with schema inspection (npx @modelcontextprotocol/server-postgres postgresql://localhost/mydb). Not maintained; hosted Supabase MCP is the current vendor Postgres path with executesql and optional readonly=true. source
• Tavily. Named on Brave’s Search API page as a competing agent-search provider. Brave’s cited independent test lists agent quality Tavily 13.67 vs Brave 14.89 and average latency Tavily 998 ms vs Brave 669 ms. source

Traps

• Reference servers in modelcontextprotocol/servers are educational SDK examples, not production-ready products. Evaluate your own threat model before using Filesystem, Fetch, or Git in a real agent. source
• Playwright MCP is not a security boundary. --allowed-origins and --blocked-origins do not serve as a security boundary and do not affect redirects. allowUnrestrictedFileAccess is a convenience guardrail, not a secure boundary. browserruncodeunsafe executes arbitrary JavaScript in the Playwright server process and is RCE-equivalent. source
• Filesystem tools take unbounded path strings with no schema pattern, so a prompt-injected model will still request ../ traversal. Issue #3752 (open, triaged Low on 2026-10-19) flags that; maintainers and reviewers note the official server’s runtime allowlist and symlink resolution are the load-bearing control, unlike many community filesystem servers. source
• Token passthrough is forbidden: an MCP server must not accept tokens that were not issued for it and must not forward them unchanged to downstream APIs. Confused-deputy OAuth (static client ID plus consent cookies) and SSRF via malicious resourcemetadata URLs (including 169.254.169.254) are specified attack classes. source
• Supabase MCP runs with the developer’s permissions. Prompt injection in row data (for example a support ticket that says to SELECT from another table) can make the client issue those queries. Use projectref, readonly=true, keep manual tool approval, and do not give this server to customers. SQL elicitation is a guardrail, not a guarantee. source
• Claude remote custom connectors are reached from Anthropic’s cloud IPs, not the laptop. Servers on a private network, VPN, or firewall will not connect. Local claudedesktopconfig.json servers are a separate path and are not available in Cowork or claude.ai. Free users are limited to one custom connector. Research cannot invoke tools from local MCP servers. source
• Brave Search MCP HTTP bind 0.0.0.0 is required in containers, but the HTTP endpoint is unauthenticated; only do that on a trusted network. Origin checks reject non-loopback browser Origin with HTTP 403 unless BRAVEMCPALLOWEDORIGINS is set. source
• GitHub MCP is available on every GitHub plan, but individual tools inherit the same paid GitHub or Copilot license as the underlying feature (for example Copilot Cloud Agent). GitHub Enterprise Server does not support remote MCP hosting. Enterprise Managed Users have PAT disabled unless an administrator enables it. Specific Copilot tools require a paid Copilot license. source

AuthorAndrey Reshetnikov, AI product and AI engineering