MCP servers are the connective tissue between your local AI agent and the tools it needs to be useful. The official MCP registry lists over 2,000 servers as of March 2026, which creates a real selection problem: which ones are worth installing, which ones are safe, and which ones will still be maintained six months from now? This guide answers those questions. Every server listed here has been verified against its official source, assigned a trust level based on who maintains it, and given a plain-English explanation of what it actually does. Install commands are taken directly from official documentation — not inferred or approximated. The servers are grouped by category and ordered within each category by trust level. For each server, the security risk level reflects the access it requires, not the quality of the code.
Get more guides like this in your inbox
No spam. Unsubscribe anytime.
How to Read This Guide
Each server entry includes a Trust Level (Steering Group, Official Company, or Community), a Risk Level (Low, Medium, or High), and the exact install command verified from the official source. Trust Level reflects who maintains the server. Risk Level reflects what access the server requires — a server with Low trust but Low risk (read-only, no credentials) may still be appropriate; a server with Medium trust and High risk (write access, API credentials) requires more careful review. The install commands use npx -y which downloads and runs the server without a permanent install. If you prefer a permanent install, use npm install -g <package> and then reference the binary directly in your config.
Category 1: Filesystem and Local Data
These servers give your agent access to files, databases, and local data sources. They are the most commonly used MCP servers and the most privacy-preserving — all data stays on your machine.
Server | Trust | Risk | What it does
--------------------|----------------|--------|----------------------------------
Filesystem | Steering Group | Medium | Read/write files in scoped dirs
Git | Steering Group | Medium | Read, search, commit in git repos
SQLite | Steering Group | Medium | Query local SQLite databases
Memory | Steering Group | Low | Persistent knowledge graph memory
Time | Steering Group | Low | Current time and timezone conversion1. Filesystem Server
The filesystem server is the most fundamental MCP server for local agent work. It gives your agent the ability to read, write, create, move, and delete files within a set of directories you specify at startup. The key security feature is that the allowed directories are locked in at launch — the agent cannot access anything outside the paths you provide. You can specify multiple directories. The server enforces these boundaries at the OS level, not just by convention. Trust Level: Steering Group (highest). Risk Level: Medium — it can write and delete files within the scoped directories. Always scope it to a project folder, never your entire home directory.
// Claude Desktop config
{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem",
"/home/user/projects", "/home/user/documents"]
}
}
}
// Hermes Agent config.yaml
mcp_servers:
- name: filesystem
command: npx
args: ["-y", "@modelcontextprotocol/server-filesystem", "/home/user/projects"]2. Git Server
The Git server gives your agent the ability to read repository history, search commits, create branches, stage files, and commit changes. It operates on a single repository specified at startup. This is the right server for coding agents that need to understand the history of a codebase, not just its current state. The server can read diffs, blame output, and log history — giving the agent full context for code review tasks. Trust Level: Steering Group. Risk Level: Medium — it can create commits and branches. If you want read-only access, the server supports a --read-only flag.
{
"mcpServers": {
"git": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-git",
"--repository", "/home/user/myproject"]
}
}
}3. Memory Server
The Memory server implements a persistent knowledge graph that survives across agent sessions. Without it, every conversation with your agent starts from scratch — it has no memory of previous sessions, no accumulated knowledge about your preferences or projects. The Memory server stores entities (people, projects, concepts), their properties, and the relationships between them in a local JSON file. The agent can create, update, search, and delete memory nodes. This is the server that transforms a stateless LLM into something that feels like a persistent assistant. Trust Level: Steering Group. Risk Level: Low — it reads and writes a single local JSON file. The default storage location is ~/.hermes/memory.json or equivalent.
{
"mcpServers": {
"memory": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-memory"]
}
}
}4. SQLite Server
The SQLite server gives your agent read and write access to a local SQLite database. It exposes tools for executing SQL queries, inspecting schema, and reading table contents. This is the right server for agents that need to work with structured local data — personal finance databases, research notes, task managers, or any application that uses SQLite as its storage layer. The server also includes business intelligence tools for summarizing and analyzing data. Trust Level: Steering Group (archived but functional). Risk Level: Medium — it can execute arbitrary SQL including writes. Consider a read-only connection string if you only need query access.
{
"mcpServers": {
"sqlite": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-sqlite",
"--db-path", "/home/user/data/mydb.sqlite"]
}
}
}Category 2: Web and Search
These servers give your agent the ability to fetch web content and search the internet. They are essential for agents that need to research topics, verify information, or read documentation. The privacy tradeoff is real: these servers make outbound network requests, which means your queries leave your machine.
Server | Trust | Risk | What it does
--------------------|----------------|--------|----------------------------------
Fetch | Steering Group | Low | Fetch and convert web pages to text
Brave Search | Official Co. | Low | Web search via Brave Search API
Sequential Thinking | Steering Group | Low | Structured reasoning chains5. Fetch Server
The Fetch server retrieves web pages and converts them to clean text or Markdown suitable for LLM consumption. It strips navigation, ads, and boilerplate, leaving the content the agent actually needs. This is the server to install if you want your agent to be able to read documentation, articles, or any public web page. The server respects robots.txt by default. Security note: The Fetch server should never be configured to access internal network ranges (192.168.x.x, 10.x.x.x, 172.16-31.x.x) or cloud metadata endpoints (169.254.169.254). A prompt injection attack could instruct the agent to fetch internal URLs and exfiltrate the response. Trust Level: Steering Group. Risk Level: Low for public URLs; Medium if your agent has access to internal networks.
{
"mcpServers": {
"fetch": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-fetch"]
}
}
}6. Brave Search Server
The Brave Search server gives your agent the ability to search the web using Brave's Search API. Unlike Google or Bing, Brave's search index is independent and does not track queries. This makes it the most privacy-respecting web search option for local agents. The server requires a Brave Search API key (free tier available at api.search.brave.com). It supports both web search and local search (businesses, locations). Trust Level: Official Company (Brave Software). Risk Level: Low — queries go to Brave's API, which has a published privacy policy.
{
"mcpServers": {
"brave-search": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-brave-search"],
"env": {
"BRAVE_API_KEY": "your-api-key-here"
}
}
}
}7. Sequential Thinking Server
The Sequential Thinking server implements a structured reasoning protocol that allows the agent to work through complex problems step by step, revise its thinking, and branch into alternative reasoning paths. It is not a data source — it is a cognitive tool. The server gives the agent a scratchpad for multi-step reasoning that is separate from the main conversation context. This is particularly useful for tasks that require planning, debugging, or working through problems with many interdependencies. Trust Level: Steering Group. Risk Level: Low — it has no external access and stores nothing persistently.
{
"mcpServers": {
"sequential-thinking": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-sequential-thinking"]
}
}
}Category 3: Developer Tools
These servers connect your agent to development infrastructure — version control platforms, issue trackers, and CI systems. They are the highest-value servers for software developers using local agents for coding work.
Server | Trust | Risk | What it does
--------------------|----------------|--------|----------------------------------
GitHub (official) | Official Co. | High | Full GitHub API — repos, PRs, issues
GitLab | Community | High | GitLab API — projects, MRs, issues
Linear | Official Co. | Medium | Project management and issue tracking
Sentry | Official Co. | Medium | Error tracking and issue analysis8. GitHub MCP Server (Official)
The official GitHub MCP server (github.com/github/github-mcp-server) gives your agent full access to the GitHub API — creating and reviewing pull requests, managing issues, reading repository contents, searching code, and managing releases. This is distinct from the archived reference server in the MCP steering group repository. The official server is maintained by GitHub itself and is the recommended integration. It requires a GitHub Personal Access Token with the scopes appropriate for the operations you want the agent to perform. Trust Level: Official Company (GitHub/Microsoft). Risk Level: High — with a full-scope token, the agent can push code, merge PRs, and manage repository settings. Use a fine-grained token scoped to specific repositories.
{
"mcpServers": {
"github": {
"command": "npx",
"args": ["-y", "@github/mcp-server"],
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "github_pat_..."
}
}
}
}9. Linear MCP Server
The Linear MCP server connects your agent to Linear's project management API. It can create, update, and search issues, manage projects and cycles, and read team and member information. For development teams using Linear as their issue tracker, this server allows the agent to create issues from code review findings, update issue status during development, and search for related issues when debugging. Trust Level: Official Company (Linear). Risk Level: Medium — it can create and modify issues but cannot delete projects or manage billing.
{
"mcpServers": {
"linear": {
"command": "npx",
"args": ["-y", "@linear/mcp-server"],
"env": {
"LINEAR_API_KEY": "lin_api_..."
}
}
}
}Category 4: Databases
These servers give your agent access to database systems — both local and self-hosted. They are the right choice for agents that need to query, analyze, or modify structured data.
Server | Trust | Risk | What it does
--------------------|----------------|--------|----------------------------------
PostgreSQL | Official Co. | Medium | Query Postgres databases
Redis | Steering Group | Medium | Read/write Redis key-value store
Qdrant | Official Co. | Low | Vector search for RAG pipelines10. PostgreSQL MCP Server
The PostgreSQL server (now maintained by Supabase as an official integration) gives your agent the ability to query Postgres databases, inspect schema, and execute SQL. The original reference implementation was read-only; the Supabase-maintained version supports both read and write operations. For self-hosted Postgres instances, this is the primary database integration. Trust Level: Official Company (Supabase). Risk Level: Medium for read-only connections; High for read-write connections. Always use a database user with the minimum required permissions — never connect with a superuser account.
{
"mcpServers": {
"postgres": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-postgres",
"postgresql://user:password@localhost:5432/mydb"]
}
}
}11. Qdrant MCP Server
Qdrant is a self-hosted vector database used to build RAG (Retrieval-Augmented Generation) pipelines. The Qdrant MCP server gives your agent the ability to search, insert, and manage vector collections. This is the server to install if you want your agent to search over a private knowledge base — your documents, notes, or code — using semantic similarity rather than keyword matching. Qdrant runs locally via Docker and stores all data on your machine. Trust Level: Official Company (Qdrant). Risk Level: Low for read-only search; Medium for write access (inserting and deleting vectors).
// First run Qdrant locally: docker run -p 6333:6333 qdrant/qdrant
{
"mcpServers": {
"qdrant": {
"command": "npx",
"args": ["-y", "@qdrant/mcp-server-qdrant"],
"env": {
"QDRANT_URL": "http://localhost:6333",
"COLLECTION_NAME": "my-knowledge-base"
}
}
}
}Category 5: Productivity and Knowledge
These servers connect your agent to note-taking apps, wikis, and productivity tools. They are the right choice for personal knowledge management workflows where you want your agent to read and write your notes.
Server | Trust | Risk | What it does
--------------------|----------------|--------|----------------------------------
Obsidian | Community | Medium | Read/write Obsidian vault notes
Notion | Official Co. | Medium | Read/write Notion pages and databases
Google Drive | Official Co. | Medium | Read/search Google Drive files12. Obsidian MCP Server
The Obsidian MCP server connects your agent to your local Obsidian vault via the Obsidian Local REST API plugin. It can read notes, create new notes, search by content or tag, and follow wikilinks between notes. For practitioners using Obsidian as a personal knowledge base, this server allows the agent to reason over your accumulated notes without any data leaving your machine. Setup requirement: You must first install the Obsidian Local REST API community plugin in Obsidian and enable it. The plugin exposes a local HTTP server that the MCP server connects to. Trust Level: Community (mcp-obsidian by MarkusPfundstein, 1.2k+ stars). Risk Level: Medium — it can create and modify notes in your vault.
// First: install "Local REST API" plugin in Obsidian and enable it
// Then get the API key from the plugin settings
{
"mcpServers": {
"obsidian": {
"command": "npx",
"args": ["-y", "mcp-obsidian"],
"env": {
"OBSIDIAN_API_KEY": "your-api-key",
"OBSIDIAN_HOST": "http://127.0.0.1:27123"
}
}
}
}13. Notion MCP Server
The official Notion MCP server gives your agent the ability to read and write Notion pages, search across your workspace, manage databases, and create new content. It requires a Notion integration token with access to the specific pages and databases you want the agent to work with. Notion's permission model is granular — you can give the integration access to only the pages it needs. Trust Level: Official Company (Notion). Risk Level: Medium — it can create and modify pages within the scope of the integration's permissions.
{
"mcpServers": {
"notion": {
"command": "npx",
"args": ["-y", "@notionhq/notion-mcp-server"],
"env": {
"OPENAPI_MCP_HEADERS": "{"Authorization": "Bearer ntn_...", "Notion-Version": "2022-06-28"}"
}
}
}
}Category 6: Infrastructure and DevOps
These servers connect your agent to infrastructure management tools — containers, orchestration, and cloud platforms. They carry the highest risk level of any category because they can affect running systems.
Server | Trust | Risk | What it does
--------------------|----------------|--------|----------------------------------
Docker | Official Co. | High | Manage containers and images
Kubernetes | Community | High | Manage k8s resources and workloads
Cloudflare | Official Co. | High | Manage Workers, KV, R2, D114. Docker MCP Server
The Docker MCP server gives your agent the ability to list, start, stop, and inspect containers, pull images, and view logs. For practitioners running self-hosted AI infrastructure — Ollama, Qdrant, Postgres, Open WebUI — in Docker, this server allows the agent to manage that infrastructure directly. Trust Level: Official Company (Docker). Risk Level: High — the agent can start and stop containers, which can affect running services. Never give this server access to production infrastructure. Use it only for local development environments.
{
"mcpServers": {
"docker": {
"command": "npx",
"args": ["-y", "@docker/mcp-server"]
}
}
}15. Cloudflare MCP Server
The official Cloudflare MCP server gives your agent access to Cloudflare's developer platform — Workers, KV storage, R2 object storage, D1 databases, and AI Gateway. For practitioners using Cloudflare as their edge infrastructure, this server allows the agent to deploy Workers, manage KV namespaces, and query D1 databases directly from the agent interface. Trust Level: Official Company (Cloudflare). Risk Level: High — it can deploy and modify production Workers. Use with a scoped API token that has only the permissions the agent needs.
{
"mcpServers": {
"cloudflare": {
"url": "https://mcp.cloudflare.com/sse",
"transport": "http"
}
}
}Category 7: Communication
These servers connect your agent to messaging and communication platforms. They are useful for agents that need to send notifications, read messages, or integrate with team communication tools.
Server | Trust | Risk | What it does
--------------------|----------------|--------|----------------------------------
Slack | Official Co. | Medium | Read/write Slack messages and channels
Google Colab | Official Co. | Medium | Execute code in Colab notebooks16. Slack MCP Server
The Slack MCP server (now maintained by Zencoder as an official integration) gives your agent the ability to read channel history, send messages, search messages, and manage channel membership. The original reference implementation is archived; the Zencoder-maintained version is the current recommended integration. It requires a Slack Bot Token with the appropriate OAuth scopes. Trust Level: Official Company (Zencoder). Risk Level: Medium — it can send messages on behalf of the bot. Scope the bot token to only the channels and permissions the agent needs.
{
"mcpServers": {
"slack": {
"command": "npx",
"args": ["-y", "@zencoder/mcp-server-slack"],
"env": {
"SLACK_BOT_TOKEN": "xoxb-...",
"SLACK_TEAM_ID": "T..."
}
}
}
}17. Google Colab MCP Server
Announced March 30, 2026, the Google Colab MCP server is the first major cloud compute MCP integration from a major cloud provider. It allows any MCP-compatible agent to connect to Google Colab notebooks, execute code, and read outputs. For practitioners who want to run GPU-accelerated workloads without local hardware, this server bridges local agents with Colab's free and Pro GPU tiers. Trust Level: Official Company (Google). Risk Level: Medium — code execution happens in Colab's sandboxed environment, but the server has access to your Google account's Colab notebooks.
// Requires Google authentication — follow official setup at colab.google/mcp
{
"mcpServers": {
"colab": {
"url": "https://colab.research.google.com/mcp",
"transport": "http"
}
}
}Category 8: AI and Specialized Tools
These servers provide AI-specific capabilities — agent observability, structured reasoning, and specialized data access.
Server | Trust | Risk | What it does
--------------------|----------------|--------|----------------------------------
AgentOps | Official Co. | Low | Agent observability and tracing
Playwright | Official Co. | Medium | Full browser automation (local)
Grafana | Official Co. | Medium | Self-hosted observability queries18. AgentOps MCP Server
AgentOps is an observability platform for AI agents — it traces tool calls, records session history, and provides debugging dashboards. The MCP server gives your agent the ability to log its own actions to AgentOps for later review. For practitioners building and debugging agent workflows, this is the equivalent of adding structured logging to your agent. It is particularly useful when diagnosing why an agent made a specific decision or took an unexpected action. Trust Level: Official Company (AgentOps). Risk Level: Low — it sends telemetry data to AgentOps' servers. Review their privacy policy if you are logging sensitive tool outputs.
{
"mcpServers": {
"agentops": {
"command": "npx",
"args": ["-y", "@agentops/mcp-server"],
"env": {
"AGENTOPS_API_KEY": "your-api-key"
}
}
}
}19. Playwright MCP Server
The official Microsoft Playwright MCP server gives your AI agent full browser automation capabilities — navigating URLs, clicking elements, filling forms, taking screenshots, and extracting page content. Unlike the Fetch server (which only retrieves static HTML), Playwright executes JavaScript and interacts with dynamic pages. For private AI practitioners, this is the correct tool for automating web workflows that require authentication, multi-step interactions, or JavaScript-rendered content. Because it runs entirely on your local machine, no page content is sent to a third party. Trust Level: Official Company (Microsoft). Risk Level: Medium — the agent can interact with any website you are authenticated to, including banking and email. Scope its allowed origins carefully.
{
"mcpServers": {
"playwright": {
"command": "npx",
"args": ["-y", "@playwright/mcp@latest"]
}
}
}20. Grafana MCP Server
The official Grafana MCP server connects your AI agent to a self-hosted Grafana instance, enabling it to search dashboards, query datasources (Prometheus, Loki, Tempo), investigate incidents, and read alert states. For practitioners running self-hosted observability stacks, this server closes the gap between your monitoring data and your AI agent — you can ask natural-language questions about your infrastructure without leaving your agent environment. Because Grafana is self-hosted, all data stays on your infrastructure. Trust Level: Official Company (Grafana Labs). Risk Level: Medium — the agent has read access to all dashboards and datasources your Grafana user can see. Use a read-only service account token.
{
"mcpServers": {
"grafana": {
"command": "npx",
"args": ["-y", "@grafana/mcp-grafana"],
"env": {
"GRAFANA_URL": "http://localhost:3000",
"GRAFANA_API_KEY": "your-service-account-token"
}
}
}
}Honourable Mentions
The following servers did not make the top 20 but are worth knowing about for specific use cases. Each is production-ready and actively maintained.
Server | Trust | Risk | Why It Matters
--------------------------|----------------|--------|-----------------------------------------------
Time (Anthropic) | Steering Group | Low | Current time + timezone conversion — essential for scheduling agents
Redis (Official) | Official Co. | Medium | Key-value store access for caching and session data
Playwright MCP (Browser) | Official Co. | Medium | Full JS-capable browser automation, local-only
Bitwarden MCP | Official Co. | Low | Retrieve credentials from local Bitwarden vault
Wazuh MCP | Community | Low | Query your self-hosted SIEM for security alerts
Prometheus MCP | Community | Low | Query Prometheus metrics directly from your agent
Terraform MCP (Official) | Official Co. | High | IaC management — read configs, plan, apply
Kubernetes MCP | Community | High | Cluster operations via kubectl through natural language
Nextcloud MCP | Community | Medium | Self-hosted file and notes access via Nextcloud API
ntfy MCP | Community | Low | Push notifications to self-hosted ntfy server
Sentry MCP | Official Co. | Medium | Query error events and performance data from SentryA Recommended Starter Stack
If you are setting up a local agent for the first time, this four-server stack gives you the most capability with the lowest risk and no API keys required. All four servers are Steering Group maintained, run entirely locally, and have no external network dependencies. Install them in this order: Memory first (so the agent can start building its knowledge of your setup), then Filesystem (scoped to your projects directory), then Fetch (for documentation lookups), then Sequential Thinking (for complex reasoning tasks). Once this stack is running, add Git if you do coding work, and Qdrant if you want semantic search over your documents.
// Recommended starter stack — all local, no API keys required
{
"mcpServers": {
"memory": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-memory"]
},
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem",
"/home/user/projects"]
},
"fetch": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-fetch"]
},
"sequential-thinking": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-sequential-thinking"]
}
}
}Monitoring MCP Servers for Security Updates
Installing an MCP server is not a one-time action — it is an ongoing maintenance commitment. The CVE-2026-27825 vulnerability in mcp-atlassian (CVSS 9.8, unauthenticated RCE) was patched in version 0.17.0. Practitioners who installed the server and never updated were exposed until they manually upgraded. The same pattern applies to every server in this guide. The most practical approach is to watch the GitHub repository of every MCP server you install. On GitHub, click 'Watch' → 'Custom' → 'Security advisories' to receive email notifications only when a security advisory is published. For servers distributed via npm, npm audit will flag known vulnerabilities in installed packages. Pin exact versions in your config files rather than using latest — this ensures you are aware of every version change before it takes effect.
Full Reference Table
The following table summarizes all servers covered in this guide with their trust levels, risk levels, and primary use cases.
# | Server | Trust | Risk | Primary Use Case
---|---------------------|----------------|--------|---------------------------
1 | Filesystem | Steering Group | Medium | Read/write project files
2 | Git | Steering Group | Medium | Code history and commits
3 | Memory | Steering Group | Low | Persistent agent memory
4 | SQLite | Steering Group | Medium | Local database queries
5 | Fetch | Steering Group | Low | Web page retrieval
6 | Brave Search | Official Co. | Low | Privacy-respecting web search
7 | Sequential Thinking | Steering Group | Low | Structured reasoning
8 | GitHub (official) | Official Co. | High | GitHub API — PRs, issues, code
9 | Linear | Official Co. | Medium | Issue tracking
10 | PostgreSQL | Official Co. | Medium | Self-hosted database queries
11 | Qdrant | Official Co. | Low | Vector search / RAG
12 | Obsidian | Community | Medium | Personal knowledge base
13 | Notion | Official Co. | Medium | Wiki and database access
14 | Docker | Official Co. | High | Container management
15 | Cloudflare | Official Co. | High | Edge infrastructure
16 | Slack | Official Co. | Medium | Team messaging
17 | Google Colab | Official Co. | Medium | Cloud GPU code execution
18 | AgentOps | Official Co. | Low | Agent observability
19 | Playwright | Official Co. | Medium | Full browser automation
20 | Grafana | Official Co. | Medium | Self-hosted monitoring queries