The Model Context Protocol is an open standard for connecting AI applications to external systems — data sources, tools, and workflows — through one interface instead of one bespoke integration per product. The official documentation describes it as "a USB-C port for AI applications," and lists Claude, ChatGPT, Visual Studio Code, Cursor, and MCPJam among the clients that speak it (modelcontextprotocol.io).

That standardization is why this list is possible at all. An MCP server is a process — local over stdio, or remote over Streamable HTTP — that advertises a set of tools, resources, and prompts. Any compliant client can call them. So the question stopped being "does this integration exist for my assistant" and became "which server do I point at this problem, and what does it cost me in context and blast radius."

This guide answers the first half. Below are 100 servers, grouped by the job they do, each with what it connects, when it earns a slot, and a direct link to its source or vendor documentation.

How this list was built

Read this section before the list. It determines how much the list is worth to you.

Sources. Every entry links to a primary source: the project's own repository, or the vendor's own documentation page for hosted servers. I started from the official reference repository maintained by the MCP steering group, which explicitly points to the MCP Registry for browsing published servers and keeps only a small set of reference implementations itself (modelcontextprotocol/servers). From there I worked through vendor documentation and the large community index at punkpeye/awesome-mcp-servers.

Inclusion is editorial. This is not a ranking. There is no ordering by stars, downloads, or install counts, and I have deliberately published no such numbers here. Public MCP usage data is fragmented across npm, PyPI, container registries, hosted endpoints, and client-side directories that each count something different. Any single number would be a guess dressed as a measurement. The numbering below is positional, for reference — #1 is not "better" than #97.

Selection criteria, in order:

1. The server connects a system a working team actually operates — a database, a repo host, a CI provider, a design file, a payment ledger.
2. There is a primary source you can read before you install.
3. The category is covered by at least one option, with a first-party option preferred where one exists.
4. No duplicates that do the same job the same way. Where two servers cover one system with meaningfully different tradeoffs (hosted versus local, read-only versus write-capable), both can appear.

What I did not verify. I did not install and exercise all 100. I did not test client compatibility matrices, and I make no claims about which client supports which server — support varies by client version and transport, and the only reliable answer is the one in the server's own README on the day you install it. Where a description summarizes a community project, it summarizes what the project says it connects. Read the repo's tool list before you wire it into anything that can write.

Deprecations are marked. Two entries are archived reference implementations and one is a vendor-deprecated server. They are here because they remain widely referenced and are useful to read; their status is stated inline.

Reading an entry

Each entry gives you three things: what it connects, best use, and a source link. That is the minimum needed to decide whether to open the repo. Everything else — tool names, auth scopes, transport support — changes fast enough that copying it here would age badly.

Setup, in four shapes

Almost every server you install will be one of these four shapes. Learn them once.

1. Local stdio, Node package. The client spawns a process and talks over stdin/stdout.

{
  "mcpServers": {
    "memory": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-memory"]
    }
  }
}

On Windows, wrap npx with cmd /c — this is documented in the official reference repository, and it is the single most common first-run failure:

{
  "mcpServers": {
    "memory": {
      "command": "cmd",
      "args": ["/c", "npx", "-y", "@modelcontextprotocol/server-memory"]
    }
  }
}

2. Local stdio, Python package. Same shape, different launcher. uvx avoids a global install:

uvx mcp-server-git --repository /path/to/repo

3. Remote HTTP with a header. The client connects to a URL. GitHub's hosted server, for example:

{
  "servers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp/"
    }
  }
}

4. Remote HTTP with OAuth, added by CLI. Increasingly the default for SaaS vendors. Linear documents both of these:

claude mcp add --transport http linear-server https://mcp.linear.app/mcp
codex mcp add linear --url https://mcp.linear.app/mcp

If you are wiring servers into something you built yourself rather than an off-the-shelf client, the transport and lifecycle details matter more; how to build an AI agent covers where MCP sits relative to the rest of an agent's plumbing.

---

The 100

Protocol reference servers (1–7)

These are maintained by the MCP steering group as educational examples of SDK usage and protocol features. The repository states plainly that they are reference implementations, not production-ready solutions, and that you should evaluate your own security requirements before deploying them. Read them to learn the shape of a server; harden or replace them before they touch anything that matters.

1. Filesystem — File operations with configurable access controls. Best use: giving an agent scoped read/write on a specific directory tree, and reading the source to understand how path allowlisting is implemented. Source

2. Fetch — Web content fetching and conversion into a form efficient for LLM consumption. Best use: single-URL retrieval where you do not need a browser or a crawler. Source

3. Git — Read, search, and manipulate Git repositories locally. Best use: repo archaeology — blame, log, and diff — without granting network access to a hosting provider. Source

4. Memory — Knowledge-graph-based persistent memory. Best use: a working reference implementation for cross-session recall, and a starting point when you want memory you control rather than memory the vendor controls. Source

5. Sequential Thinking — Structured, reflective problem decomposition through thought sequences. Best use: multi-step reasoning tasks where you want the intermediate steps materialized as tool calls you can inspect. Source

6. Time — Time and timezone conversion. Best use: eliminating the single dumbest recurring failure mode in scheduling agents, which is a model doing timezone math from memory. Source

7. Everything — A test server exercising prompts, resources, and tools. Best use: validating a new client integration or a proxy before you point it at anything real. Source

Code hosting, CI/CD, and deployment (8–15)

8. GitHub MCP Server — GitHub's first-party server, available as a remote endpoint and as a local container image. Best use: repository, issue, PR, Actions, and code-security workflows. Its configuration surface is the model others should copy: --toolsets to load only the tool groups you need, --tools for individual tools, --read-only to drop every mutating tool, and --lockdown-mode. Source

9. GitMCP — Serves a repository's own documentation and code as MCP context. Best use: pointing an agent at one specific open-source project so it answers from that project's actual source instead of training-data recall. Source

10. CircleCI — CircleCI's first-party server. Best use: pulling failed-build logs and pipeline state into the session where you are fixing the failure. Source

11. Buildkite — Buildkite's first-party server. Best use: pipeline and build inspection for teams running self-hosted agents. Source

12. Bitrise — Bitrise's first-party server for mobile CI. Best use: mobile build and artifact workflows where the CI provider holds the signing and device context. Source

13. Docker Hub — Docker's first-party Hub server. Best use: image discovery, tag inspection, and repository metadata during containerization work. Source

14. Vercel — Vercel's official remote server at https://mcp.vercel.com, with OAuth. Documented capabilities include searching Vercel documentation, managing projects and deployments, analyzing deployment logs, and querying Web Analytics. Vercel restricts connections to an approved client list and publishes an explicit security-practices section covering confused-deputy protection and prompt injection. Best use: deployment triage. Source

15. Netlify — Netlify's remote server, installable with npx -y add-mcp https://netlify-mcp.netlify.app/mcp, alongside a local option and a published skills repository. Best use: deploy, function, and blob-storage workflows on Netlify. Source

Browser control and web extraction (16–21)

16. Playwright MCP — Microsoft's Playwright-based browser automation server. Best use: deterministic browser control for testing and for scraping pages that require real rendering. The default choice in this category. Source

17. Browserbase — Browserbase's server for its hosted headless browser infrastructure. Best use: browser automation that needs to run somewhere other than the developer's laptop, at concurrency. Source

18. Browser MCP — Drives your existing local browser session. Best use: tasks behind a login you are already authenticated for, where you do not want to hand credentials to an automation service. Treat the permission implications as real. Source

19. Firecrawl — Crawling and structured extraction across a site. Best use: turning a documentation site or a competitor's catalog into clean structured text in one pass. Source

20. WebdriverIO — WebdriverIO's first-party server. Best use: teams whose existing browser test suite is already WebdriverIO and who want the agent operating inside the same framework. Source

21. YouTube Transcript — Retrieves transcripts for YouTube videos. Best use: summarizing conference talks and long-form video without downloading media. Source

Search, documentation, and research (22–27)

22. Exa — Hosted server at https://mcp.exa.ai/mcp, with web_search_exa and web_fetch_exa as defaults and optional advanced-search and agent tools enabled by appending them to the URL (?tools=web_search_exa,web_fetch_exa,agent_run). Works anonymously with rate limits; OAuth or API key raises them. Best use: agent-facing search where you want the result body, not a list of links. Source

23. Tavily — Hosted server at https://mcp.tavily.com/mcp/ providing search, extract, map, and crawl tools, with both API-key and OAuth authentication. Best use: research loops that alternate between searching and reading full pages. Source

24. Brave Search — Brave's official server, which replaced the archived reference implementation. Best use: web and local search where index independence matters. Source

25. Context7 — Pulls version-specific library documentation and code examples into the prompt, addressing the failure mode where a model writes against an API that changed or never existed. Ships in two modes: a CLI-plus-skill install that needs no MCP server, and an MCP server at https://mcp.context7.com/mcp. Best use: any coding session against a fast-moving framework. Source

26. Apify Actors — Hosted server at https://mcp.apify.com fronting thousands of scrapers and automation actors, with dynamic tool discovery (search-actors, fetch-actor-details, call-actor). The tool set is configurable by query parameter, and the documentation is explicit that leaving tools unspecified means your configuration can shift under you between releases. Best use: site-specific extraction where someone has already built and maintained the scraper. Source

27. Hugging Face — The official Hub server at https://huggingface.co/mcp, connecting model, dataset, and Space search plus Gradio applications, with per-user tool configuration at huggingface.co/settings/mcp. Best use: model and dataset discovery inside the session where you are choosing one. Source

Databases and warehouses (28–39)

Give every server in this section a read-only role unless you have a specific, reviewed reason not to. Several ship a read-only flag; use it.

28. PostgreSQL (reference, archived) — Read-only Postgres access with schema inspection. Archived by the steering group; kept here because it is the most-copied starting point for a database server. Read it, then use a maintained alternative. Source

29. Postgres MCP Pro — A maintained Postgres server with health and performance analysis alongside query execution. Best use: production Postgres work where you want index and plan analysis, not just SELECT. Source

30. SQLite (reference, archived) — Database interaction and business-intelligence tooling over SQLite. Archived. Best use: reading the implementation; SQLite's single-file model makes it the cheapest place to prototype an agent's data access. Source

31. MySQL — MySQL access with schema inspection and querying. Source

32. ClickHouse — ClickHouse's first-party server. Best use: analytical queries over event and log data where the warehouse is fast enough to keep an interactive loop interactive. Source

33. Snowflake — Snowflake Labs' server. Best use: governed warehouse access where roles and warehouses already encode who can read what. Source

34. BigQuery — Query and inspect BigQuery datasets. Best use: ad-hoc analysis where the cost model rewards writing one correct query instead of five exploratory ones. Source

35. DuckDB — Local analytical queries over files and in-process databases. Best use: analyzing a CSV or Parquet dump on the machine, with no server to stand up. Source

36. MongoDB — MongoDB's first-party server, covering both database operations and Atlas administration, plus an Assistant knowledge-base search. Notable for configuration discipline: --readOnly appears in every example in the README by default, and it ships --indexCheck to reject queries that would collection-scan, --maxDocumentsPerQuery, --maxBytesPerQuery, and a confirmationRequiredTools list that elicits user confirmation before destructive operations. Best use: the reference example of how a database server should be configured. Source

37. Elasticsearch (vendor-deprecated) — Elastic's server exposing list_indices, get_mappings, search, esql, and get_shards. The README now carries a deprecation notice stating it will receive only critical security updates and has been superseded by the Elastic Agent Builder MCP endpoint in Elastic 9.2.0+ and Serverless. Listed because the tool surface is a clean model for search-index servers and many teams are still running it. Check the deprecation notice before adopting. Source

38. Supabase — Community-maintained server under the Supabase organization. Best use: project, table, and edge-function work on Supabase. Source

39. Neon — Neon's first-party server. Best use: serverless Postgres with branch-per-environment workflows, where creating and destroying a branch is cheap enough for an agent to do it per task. Source

Vector, graph, and cache stores (40–45)

40. Qdrant — Qdrant's first-party server. Best use: semantic memory for agents where you want the vector store to be an explicit, inspectable component rather than a hidden feature of a framework. Source

41. Chroma — Chroma's first-party server. Best use: local-first retrieval during development, before you commit to hosted infrastructure. Source

42. Weaviate — Weaviate's first-party server. Best use: hybrid keyword-plus-vector retrieval over a schema you already model. Source

43. Milvus — Zilliz's server for Milvus. Best use: large-scale vector search where collection and partition management is part of the job. Source

44. Neo4j — Servers maintained under the Neo4j contrib organization. Best use: relationship queries — dependency graphs, org charts, fraud rings — where the answer is a path, not a row. Source

45. Redis — Redis's first-party server for key-value stores. Best use: inspecting cache and queue state during incident work, and as scratch storage for agent runs. Source

Cloud, infrastructure as code, and Kubernetes (46–54)

46. AWS MCP Servers — The AWS Labs collection covering many AWS services. Best use: the starting point for anything AWS; check which specific server in the collection covers your service before wiring up a generic alternative. Source

47. Cloudflare — Cloudflare's first-party servers. Best use: Workers, DNS, and edge configuration work. Source

48. Alibaba Cloud Ops — Alibaba Cloud's first-party operations server. Best use: teams operating in Alibaba Cloud regions. Source

49. Terraform — HashiCorp's first-party server. Best use: provider and module lookup, and reasoning about configuration, during Terraform authoring. Keep plan and apply behind human review regardless of what the tooling permits. Source

50. Pulumi — Pulumi's first-party server. Best use: infrastructure work in a general-purpose language, where the agent can read the same program you do. Source

51. Kubernetes (Flux159) — Cluster operations over the Kubernetes API. Best use: general cluster inspection and management from a single server. Source

52. kubernetes-mcp-server (manusa) — An alternative Kubernetes implementation. Best use: when the tool surface or the auth model of the first option does not fit your cluster's RBAC. Having two credible options in this category is worth knowing. Source

53. Docker (ckreiling) — Container lifecycle management on a Docker host. Best use: local container operations during development — build, run, inspect, tear down. Source

54. Portainer — Portainer's first-party server. Best use: environments where Portainer is already the container control plane and its access model is what you want the agent bound by. Source

Observability and product analytics (55–60)

55. Sentry — Sentry's remote service at https://mcp.sentry.dev, with a stdio option for self-hosted instances. The README is unusually direct about scope: the tool selection targets human-in-the-loop coding agents and debugging workflows rather than general-purpose Sentry administration. Supports skill-level scoping via --disable-skills and ?skills=. Best use: taking an error from alert to root cause without leaving the editor. Source

56. Grafana — Grafana's first-party server covering dashboards, datasource querying across Prometheus, Loki, ClickHouse, CloudWatch, Elasticsearch and others, incidents, Sift investigations, alerting, and OnCall. Ships read-only mode, RBAC scope guidance, a health-check endpoint, OpenTelemetry metrics and tracing, and a --slow-request-threshold flag. Best use: the single highest-leverage observability server if Grafana is your pane of glass. Source

57. Prometheus — Direct PromQL querying. Best use: metric investigation when you want to bypass a dashboard layer and ask the time-series database directly. Source

58. VictoriaLogs — Community server for VictoriaLogs. Best use: log querying for teams running the VictoriaMetrics stack. Source

59. Rootly — Rootly's server for incident management. Best use: pulling incident timelines and status into a postmortem draft. Source

60. PostHog — PostHog's first-party server. Best use: product analytics questions — funnels, retention, feature-flag state — answered where the code lives. Source

Code quality, security, and testing (61–63)

61. SonarQube — Static analysis results as tools. Best use: pulling the specific issues on a branch into a fix session, instead of asking a model to re-derive them by reading files. Source

62. Snyk — Snyk ships MCP through its CLI; the Snyk Language Server repository documents the client registration flow, which launches snyk mcp -t stdio, and covers Open Source, IaC, Code, and Secrets scanning. Best use: dependency and code vulnerability results inside the session, with the CLI's existing auth and org scoping. Source

63. k6 — Grafana k6 load testing driven through MCP. Best use: generating and running a load scenario against a change before it ships, rather than after. Source

Design and front-end (64–69)

64. Figma MCP Server — Figma's official server, offered as a remote hosted endpoint and a desktop local version. Documented capabilities include generating code from selected frames, extracting variables, components, and layout data, retrieving Make resources, and writing native Figma content back to the canvas. Figma restricts connections to clients listed in its MCP Catalog and notes the write features are free during beta and expected to become usage-based. Best use: design-to-code with your own design system as the source of truth. Source

65. Framelink Figma Context MCP — A widely used community alternative for feeding Figma layout data to coding agents. Best use: when you need Figma context in a client not on Figma's catalog, or you want to control exactly what gets extracted. Source

66. Magic (21st.dev) — Generates UI components through MCP. Best use: first-draft component scaffolding you then rewrite against your own conventions. Source

67. shadcn/ui — Serves shadcn/ui component source and usage to the agent. Best use: keeping generated components aligned with the actual library version installed, rather than a remembered one. Source

68. Storybook addon-mcp — Storybook's official addon. Best use: letting an agent read your existing stories so new components match established patterns and props. Source

69. Next.js DevTools MCP — Vercel's first-party Next.js devtools server. Best use: debugging rendering, routing, and build behavior in Next.js applications. Source

Project tracking, knowledge, and communication (70–76)

70. Atlassian Rovo MCP Server — Atlassian's official remote server connecting Jira and Confluence, secured with OAuth and granular permission controls, with admin-managed allow/block lists for AI domains. Atlassian publishes plan-specific limits in its documentation and states the server does not currently support FedRAMP or HIPAA requirements and does not store or cache Jira or Confluence content. Best use: pulling ticket and page context into an editor or chat session. Source

71. Linear — Linear's remote server at https://mcp.linear.app/mcp, with tools for finding, creating, and updating issues, projects, and comments. Two read-only paths are documented: a dedicated /mcp/readonly endpoint, and requesting only the read OAuth scope on the standard endpoint so the underlying token cannot reach write APIs. Enterprise-managed authorization via Okta is supported. Best use: turning a planning document into structured issues, and turning standup notes into issue comments. Source

72. Notion — Notion now prioritizes its remote MCP server with OAuth; the local repository remains published but the README states it may be sunset and that issues there are not actively monitored. The local server documents tools including retrieve-page-markdown and update-page-markdown for token-efficient page editing instead of block JSON. Best use: reading and writing workspace documentation. Read the notice at the top of the README before choosing local. Source

73. Slack — The archived reference Slack server is now maintained by Zencoder. Best use: channel and message operations. Confirm the write scopes you grant; a Slack token is one of the highest-blast-radius credentials in most organizations. Source

74. Microsoft 365 — Covers Microsoft 365 services through Graph. Best use: mail, calendar, and file operations for organizations standardized on Microsoft. Source

75. Microsoft Teams — Teams messaging and channel operations. Best use: reading thread context into a summary or a ticket. Source

76. Discourse — Discourse's first-party server. Best use: searching and reading community forums as a support or research source. Source

Spreadsheets and document conversion (77–80)

77. Airtable — Base, table, and record operations. Best use: the enormous class of internal tools that are, structurally, an Airtable base with opinions. Source

78. Excel — Reading and writing .xlsx files. Best use: local spreadsheet work where the file, not a SaaS API, is the system of record. Source

79. Google Sheets — Sheets read and write. Best use: shared operational trackers that a team already edits by hand. Source

80. mcp-pandoc — Document format conversion via Pandoc. Best use: normalizing DOCX, Markdown, LaTeX, and HTML into one format before an agent reads a mixed pile of files. Source

Payments, commerce, and cross-app automation (81–84)

81. Stripe — Stripe hosts a remote MCP server at https://mcp.stripe.com with OAuth-based client access. The same repository ships agent skills and official plugins for Claude Code, Codex, Cursor, and Grok Build, plus SDKs for integrating Stripe billing with agent frameworks. Best use: building and testing payment flows, and querying account state. The skills-alongside-MCP pattern here is worth studying — I cover why in the 100 best AI agent skills. Source

82. PayPal — PayPal's agent toolkit with MCP support, covering invoices, orders and payments, refunds, disputes, shipment tracking, catalog, subscriptions, and transaction reporting. Sandbox mode is the documented default. Best use: invoice and subscription operations. Source

83. Zapier MCP — Zapier's hosted server, fronting its existing app connections and applying account-level restrictions, managed connections, and workspace controls. Zapier documents plan usage and action history; verify the current quota rules before routing a high-volume agent through it. Best use: the long tail — the app your agent needs once a quarter, for which no dedicated server exists. Source

84. Pipedream — MCP support within Pipedream's integration platform. Best use: an alternative long-tail bridge, particularly when you want the connector logic to live in code you can edit. Source

Data engineering, notebooks, and ML (85–89)

85. dbt — dbt Labs' first-party server. Best use: model lineage, compilation, and run state during analytics engineering work. Source

86. Confluent (Kafka) — Confluent's first-party server. Best use: topic, schema, and connector inspection during streaming work. Source

87. Apache Airflow — DAG and task inspection and control. Best use: answering "why did last night's run fail" without opening the Airflow UI. Source

88. Jupyter — Datalayer's server for notebook interaction. Best use: letting an agent execute and read cells in a live kernel rather than reasoning about notebook JSON. Source

89. Optuna — Optuna's first-party server for hyperparameter optimization. Best use: driving and inspecting studies conversationally while the optimization runs. Source

Media and 3D (90–92)

90. ElevenLabs — The official ElevenLabs server for text-to-speech and audio processing, including voice cloning, transcription, and speech-to-speech. Configurable output modes: files writes to disk, resources returns base64 in the MCP response with no disk I/O, both does both. ELEVENLABS_MCP_BASE_PATH doubles as the security boundary for local file reads — paths resolving outside it are rejected. Best use: audio generation in containerized environments, where resources mode avoids a shared filesystem entirely. Source

91. Blender — Drives Blender through MCP. Best use: procedural 3D scene construction and modification described in language, executed in a real DCC application. Source

92. DaVinci Resolve — Controls DaVinci Resolve. Best use: timeline and project operations in video post-production. Source

Local development environment and code execution (93–97)

93. Desktop Commander — Terminal, file, and process control on the local machine. Best use: general local automation. This is one of the highest-privilege servers on the list; scope it deliberately. Source

94. Serena — Semantic code retrieval and editing toolkit. Best use: large codebases where symbol-level navigation beats reading files top to bottom, and where reducing tokens read per edit directly reduces cost. Source

95. MCP Language Server — Exposes Language Server Protocol capabilities — definitions, references, diagnostics, rename — as MCP tools. Best use: making an agent's edits type-aware instead of text-aware. One of the highest-value-per-token servers in this list. Source

96. mcp-run-python — Pydantic's sandboxed Python execution server. Best use: letting an agent compute rather than estimate, without giving it your shell. Source

97. container-use — Dagger's server giving agents isolated containerized environments. Best use: running several agents in parallel without letting them collide on one filesystem or one set of ports. Source

Gateways and aggregators (98–100)

Once you pass roughly a dozen servers, the constraint stops being availability and becomes tool-list size. These sit between the client and many servers.

98. MetaMCP — Aggregates and manages multiple MCP servers behind a single endpoint. Best use: one connection point across a team, with server composition managed centrally rather than in every developer's config file. Source

99. MCPJungle — A self-hosted registry and gateway for MCP servers. Best use: organizations that need an internal catalog with access control in front of it. Source

100. Pica — A platform server fronting many third-party integrations. Best use: broad SaaS coverage from one server when maintaining dozens of individual connections is not worth the operational cost. Source

Use MCP servers in AGNT

AGNT can connect MCP servers to persistent agents, visual workflows, and long-running goals, then record the tool calls in local execution traces. You keep the workspace and credentials under your control while choosing the model provider. Download AGNT and add the MCP servers you actually need.

---

Selection matrix

Pick by the job, not by the vendor logo.

If your job is	Start with	Why this one
Fix a failing build	#8 GitHub, #10 CircleCI or #11 Buildkite	Logs and PR context in the same session as the fix
Debug a production error	#55 Sentry, then #56 Grafana	Sentry scopes its tools to debugging on purpose; Grafana covers everything around it
Query a warehouse safely	#36 MongoDB, #32 ClickHouse, #33 Snowflake	Read-only flags and per-query limits exist and are documented
Build UI from a design	#64 Figma official, or #65 Framelink	Official if your client is on Figma's catalog; community if not
Stop hallucinated API calls	#25 Context7	Version-specific docs injected at prompt time
Search the web as an agent	#22 Exa or #23 Tavily	Both return page bodies, not link lists
Give an agent memory	#4 Memory, or #40 Qdrant / #41 Chroma	Reference implementation first; dedicated vector store when you need scale
Edit a large codebase	#95 MCP Language Server + #94 Serena	Symbol-level operations cost far fewer tokens than file reads
Run untrusted generated code	#96 mcp-run-python or #97 container-use	Isolation is the feature
Reach an app with no server	#83 Zapier or #84 Pipedream	The long tail, at the cost of an extra hop
Manage 15+ servers	#98 MetaMCP or #99 MCPJungle	Tool-list size becomes the binding constraint

Operating notes

Six things that matter more than which servers you pick.

Scope the toolset, always. GitHub's server takes --toolsets repos,issues,pull_requests or GITHUB_TOOLSETS; Apify takes ?tools=actors,docs; Exa takes ?tools=; Sentry takes ?skills= and --disable-skills; MongoDB takes --disabledTools by name, operation type, or category. Every tool you load costs context on every single turn, whether or not it gets called. This is the same budget problem I work through in the 100 best AI agent tools — the arithmetic does not change because the tools arrived over MCP.

Default to read-only. MongoDB puts --readOnly in every README example. GitHub has --read-only and --lockdown-mode. Grafana has a read-only mode. Linear has both a /mcp/readonly endpoint and a read-only OAuth scope. Turn writes on per-server, deliberately, after you have watched the server work.

Environment variables, not command-line arguments, for secrets. MongoDB's README states the reason plainly: command-line arguments are visible in process lists and get logged in various system locations. This applies to every server on this list.

Confirm destructive operations where the client supports it. MongoDB's confirmationRequiredTools defaults to a list including drop-database, drop-collection, and delete-many, and additionally confirms any aggregation containing $out or $merge because those write to a collection. If your client supports elicitation, use it.

Prompt injection is the live threat, not a theoretical one. Vercel's documentation spells out the attack: a malicious instruction embedded in fetched content telling the agent to exfiltrate data to an external host. Any server that reads untrusted web content sits upstream of every server that can write. Assume content is hostile, and do not colocate a fetch tool and a write-capable credential without a human in the loop.

Watch for deprecation. In assembling this list, Elastic's server carried a deprecation notice, Notion said its local server may be sunset, and Tavily's legacy SSE path and Apify's /sse endpoint had both been retired in favor of Streamable HTTP. Re-read the README on every major upgrade.

FAQ

Local stdio or remote HTTP?
Stdio when the data is local or the credential should never leave the machine — filesystem, git, database on a private network. Remote HTTP with OAuth when a SaaS vendor hosts it, because you get the vendor's auth model, permission scoping, and server-side updates without pinning a package version. Several vendors on this list — Sentry, Notion, Apify — offer both and explicitly recommend the remote one.

Should I install all 100?
No. Every loaded tool consumes context on every turn. Run the smallest set that covers your current work, and swap rather than accumulate. If you genuinely need many, put a gateway (#98–100) in front of them.

What does "official" mean here?
That the server lives in the vendor's own GitHub organization or is documented on the vendor's own site. It does not mean higher quality by default — several community servers here are more actively maintained than first-party equivalents. It does mean the auth model and the deprecation timeline are the vendor's responsibility.

How do I find servers not on this list?
The MCP Registry at registry.modelcontextprotocol.io, which the official servers repository points to directly, plus the community index at awesome-mcp-servers.

Are MCP servers safe to install?
An MCP server is a program running with your credentials. The official reference repository states its own servers are educational examples, not production-ready solutions, and that you should implement safeguards based on your own threat model. Read the tool list, check what write operations exist, prefer read-only, and treat an unaudited server from an unknown author exactly as you would treat an unaudited dependency — because it is one.

Do MCP servers replace agent skills?
They solve different problems, and several vendors now ship both. Exa publishes skills in skills/ alongside its MCP server. Stripe ships plugins and skills next to its hosted server. Netlify publishes a skills repository. Sentry offers a Claude Code plugin that delegates to a subagent. The pattern is consistent: MCP provides the capability, skills provide the procedure for using it correctly.

What is the minimum useful setup?
Filesystem (#1), Git (#3), your repo host (#8), your error tracker (#55), and Context7 (#25). Five servers, and they cover the majority of a working day. Add the sixth only when you hit the wall that requires it.

What to install first

If you are starting today, install these in this order and stop after each one until you have watched it work:

1. #1 Filesystem, scoped to a single project directory. Confirm the path allowlist behaves as documented before you widen it.
2. #8 GitHub, launched with --read-only. Turn off read-only after you have seen a week of tool calls you agree with.
3. #25 Context7, which costs almost nothing in tools and removes an entire class of wrong answers.
4. #55 Sentry or #56 Grafana, whichever holds the data you look at when something breaks.
5. #95 MCP Language Server, once your codebase is large enough that reading whole files has become the dominant cost.

Then re-read the tool list on each one at your next upgrade. In a standard moving this fast, the README is the only documentation that is current.