Top 10 MCP Servers for Developers: Pros, Cons, and Risks

There are already thousands of ready-made MCP servers, and the collections usually look the same: a name, one sentence, and a link. Here are only 10 servers that are useful for a developer daily. For each, it is written who it is suitable for, what the downsides are, and what permissions you grant it. All repositories have been checked as of November 5, 2026: the projects are live, none are archived.

Main disclaimer: MCP Server is code that works with your tokens, files, and browser. The popularity of a repository does not make it safe, so there are as many downsides in each block as there are upsides.

Contents

• 🧭 How we chose the servers
• 💻 Code and repositories: GitHub, Git, Filesystem
• 📚 Documentation and search: Context7, Brave Search, Fetch
• 🌐 Browser: Playwright MCP and Chrome DevTools MCP
• 🗄️ Data and errors: MCP Toolbox for Databases and Sentry
• 📊 Comparison table
• ⚠️ Archived servers that are still recommended
• 🎯 What to choose for the task
• 🛡️ Before installation: a short checklist
• ❓ Frequently asked questions
• 📚 Sources

🧭 How we chose the servers

Selection criteria:

• Who supports it. Preference is given to official servers from product authors (GitHub, Microsoft, Google, Brave, Sentry) and reference servers from the MCP team.
• Activity. For each of the ten, the last commit was no older than two weeks at the time of checking.
• Permission control. Can the server be limited to read-only mode, specific folders, or toolsets.
• Usefulness for the developer. Servers for trading, design, or 3D were not included here.

There is no GitHub stars rating here. In popular collections, different servers often have the same number of stars: these are the stars of the parent repository modelcontextprotocol/servers, not a specific server. Such numbers say nothing about quality.

⚠️ Important: reference servers from the MCP repository (Filesystem, Git, Fetch) are called training examples by their authors, not production solutions (README modelcontextprotocol/servers). They are well-suited for local work, but for a server that other people connect to, your own risk assessment is required.

💻 Code and repositories: GitHub, Git, Filesystem

1. GitHub MCP Server — repositories, issues, and pull requests

What it does: gives the agent access to GitHub: read code, search for files, work with issues and PRs, view GitHub Actions runs and security alerts (github/github-mcp-server).

Who it's for: those who conduct code reviews, analyze bugs and CI failures without leaving their AI client.

Downsides:

• Without configuration, the default set is enabled: context, repos, issues, pull_requests, users. These are dozens of tools that take up the model's context.
• A token with broad permissions plus untrusted text in an issue is a classic scenario for data leakage from private repositories.

Status and transport: official from GitHub. There is a remote server (https://api.githubcopilot.com/mcp/) with OAuth or PAT and a local version via Docker.

claude mcp add github -e GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN ghcr.io/github/github-mcp-server

💡 In practice: enable only the necessary groups via --toolsets repos,issues (in Docker — the GITHUB_TOOLSETS variable), and for code analysis — the --read-only mode (GITHUB_READ_ONLY=1). The authors explicitly state that a smaller set of tools helps the model choose the right tool and reduces the context size.

If even one toolset is too much, you can enable specific tools via --tools (in Docker — GITHUB_TOOLS). For example, for review without modification rights:

github-mcp-server --tools get_file_contents,issue_read,pull_request_read --read-only

--tools can be combined with --toolsets: tools are added to the selected groups. The --read-only mode has priority, so write tools will not appear even if specified explicitly. The names must match exactly, otherwise the server will not start.

⚠️ Important: for working with public repositories, there is --lockdown-mode (GITHUB_LOCKDOWN_MODE=1). In this mode, the server does not show issues, PRs, and author comments without push access to the repository, and these are the ones that most often become a source of prompt injection. But the authors explicitly call it a best-effort content filter, **not an authorization boundary**: it does not change what your token can read or write, and filtered content may be accessible through other tools. Lockdown mode complements minimal token permissions but does not replace them.

2. Git — history, diff, and commits of a local repository

What it does: reads status, diff, log, and branches, can perform add, commit, checkout, and merge (src/git).

Who it's for: if your AI client does not have built-in git functionality, and you need to "explain what changed in this branch" or "find the commit after which the test broke."

Downsides:

• Without the --repository parameter, the server reads and writes to any git repository that the process has access to. This is the only limitation it offers.
• In Claude Code and other agents with terminal access, it is often redundant: the agent already executes git commands.

Status and transport: MCP reference server, STDIO via uvx or Docker.

uvx mcp-server-git --repository /path/to/your/repo

3. Filesystem — reading and editing files in allowed folders

What it does: file operations within the folders you provided at startup (src/filesystem).

Who it's for: for AI clients without file access (chat applications, custom agents) and for scenarios like "let the model read the documentation folder, but don't change anything."

Downsides:

• The --read-only mode applies to all allowed folders at once. To make some folders read-only, you need to run two servers.
• For coding agents (Claude Code, Cursor), it usually duplicates built-in tools.

Status and transport: MCP reference server, STDIO via npx or Docker.

{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "--read-only", "/path/to/docs"]
    }
  }
}

💡 Example: connect a folder with internal specifications in --read-only mode to your own Spring AI agent. The agent answers questions based on the documents but cannot accidentally rewrite them.

📚 Documentation and search: Context7, Brave Search, Fetch

4. Context7 — up-to-date library documentation

What it does: pulls documentation and code examples for a specific library version into the agent's context. It has two tools: resolve-library-id and query-docs (upstash/context7).

Who it's for: those working with recent framework versions. The model is trained on old data and confidently generates APIs that no longer exist. Context7 provides it with the documentation for the version you specified in the request.

Downsides:

• Documentation in Context7 is added by the community. Upstash explicitly states that it does not guarantee its accuracy, completeness, or security.
• The backend (API, parsing, crawling) is closed; the repository only contains the MCP server code. Your requests go to Upstash servers.
• An API key is not required but recommended due to request limits.

Status and transport: from Upstash. Remote server https://mcp.context7.com/mcp with a key in the Authorization: Bearer header. There is a mode without MCP: CLI + Skills.

npx ctx7 setup --claude

💡 Example: "Configure Spring Security for a resource server with JWT, use context7." Without Context7, the model often suggests the outdated WebSecurityConfigurerAdapter; with it, it uses the current approach from the documentation.

5. Brave Search — internet search for an agent

What it does: searches via Brave Search API: web, news, videos, images, local places, plus AI summaries (brave/brave-search-mcp-server).

Who it's for: those building their own agent (e.g., on Spring AI or with a local model via Ollama) where built-in web search is missing. Claude Code and Cursor already have search, so Brave is often redundant there.

Cons:

• Requires a Brave Search API key. Some features, like advanced snippets and full local search, are only available on the Pro plan.
• Search results are untrusted content. They can lead to indirect prompt injection into the agent.

Status and transport: official from Brave, version 2.x. STDIO by default, HTTP is enabled via --transport http. The old Brave Search reference server has been archived, and the MCP authors directly point to the official one as a replacement.

{
  "mcpServers": {
    "brave-search": {
      "command": "npx",
      "args": ["-y", "@brave/brave-search-mcp-server"],
      "env": { "BRAVE_API_KEY": "YOUR_API_KEY" }
    }
  }
}

🧑‍💻 My experience: I set up Brave Search MCP for SEO preparation of WebsCraft articles: to see what's already in search results for a topic and find angles that haven't been covered yet. Keep in mind that Brave Search API doesn't provide query volume, so you'll still need Google Search Console or SEO services for that. Brave is good for reviewing search results but not for assessing demand.

6. Fetch — read a page by URL

What it does: downloads a page and converts it into text suitable for the model (src/fetch).

Who it's for: in conjunction with Brave Search: Brave finds pages, Fetch reads them. Also for "read the changelog at this link and tell me what will break on update."

Cons:

• The authors themselves mark the server as a potential risk: it can access internal addresses. Private IPs and cloud metadata are blocked by default, but the --allow-private-ips flag disables this protection.
• Like any internet content, a page can contain instructions for the model.

Status and transport: MCP reference server, STDIO via uvx or Docker. By default, it respects robots.txt for requests initiated by the model.

uvx mcp-server-fetch

🧑‍💻 My experience: I used Fetch in my project for a simple task: the user provides a link, and the agent familiarizes itself with the page content and works with it further. For this, Fetch fulfills the need without custom code for downloading and parsing HTML. It's worth knowing that errors (robots.txt denial, unavailable page, HTTP error) are returned by the server as a regular result with isError: true. The model sees the reason and can inform the user why the page couldn't be read.

🌐 Browser: Playwright MCP and Chrome DevTools MCP

7. Playwright MCP — browser automation

What it does: the agent opens pages, clicks, and fills out forms. It works through the accessibility tree, not screenshots, so it doesn't require a vision model (microsoft/playwright-mcp).

Who it's for: testing user scenarios ("register, add item to cart, proceed to checkout") and exploratory automation.

Cons:

• The authors themselves recommend coding agents use Playwright CLI + Skills instead of MCP: the CLI uses fewer tokens because it doesn't load large tool schemas and page trees into context.
• The README explicitly states that Playwright MCP is not a security boundary. The --allowed-origins and --blocked-origins parameters are for convenience, not protection.
• By default, a persistent browser profile is used: cookies and sessions are saved between runs.

Status and transport: official from Microsoft, STDIO via npx, Node.js 18+.

claude mcp add playwright -- npx @playwright/mcp@latest --isolated

8. Chrome DevTools MCP — debugging and performance

What it does: gives the agent DevTools capabilities: record performance trace, view network requests, console with source-mapped stack, take a screenshot (ChromeDevTools/chrome-devtools-mcp).

Who it's for: backend developers who need to understand why the frontend isn't working without manually digging into DevTools. And those optimizing website speed: the repository has a ready-made skill for improving LCP.

Cons:

• Usage statistics collection is enabled by default. It's disabled with the --no-usage-statistics flag.
• Performance tools may send trace URLs to the Google CrUX API. This is disabled via --no-performance-crux.
• The model can see and change everything in the browser. Do not open sessions with sensitive data in it.

Status and transport: from the Chrome DevTools team (Google), STDIO via npx, officially supported only Chrome and Chrome for Testing.

{
  "mcpServers": {
    "chrome-devtools": {
      "command": "npx",
      "args": ["-y", "chrome-devtools-mcp@latest", "--isolated", "--no-usage-statistics"]
    }
  }
}

💡 Which to choose between the two: Playwright — to go through a scenario like a user. Chrome DevTools — to understand why a page is slow or crashing. For testing flows, choose the first; for debugging and Core Web Vitals, choose the second.

🗄️ Data and errors: MCP Toolbox for Databases and Sentry

9. MCP Toolbox for Databases — PostgreSQL and other databases

What it does: connects the agent to databases. Works in two modes: pre-built tools (list_tables, execute_sql) and custom tools that you describe in tools.yaml (googleapis/mcp-toolbox). Supports PostgreSQL, MySQL, SQL Server, Oracle, MongoDB, Redis, ClickHouse, Snowflake, and Google Cloud services.

Who it's for: those who want to explore schema and data from their IDE, and those building agents for production: instead of arbitrary SQL, the model is given pre-defined safe queries. There's a Java SDK for Java developers.

Cons:

• The pre-built toolset includes execute_sql. If connected with a database user who has write permissions, the model can modify data.
• True security only comes with custom tools in tools.yaml and a separate read-only database role. This is work, not "plug and play."

Status and transport: from Google (formerly called Gen AI Toolbox, repository genai-toolbox). STDIO or HTTP.

{
  "mcpServers": {
    "toolbox-postgres": {
      "command": "npx",
      "args": ["-y", "@toolbox-sdk/server", "--prebuilt=postgres", "--stdio"]
    }
  }
}

⚠️ Please note: database connection parameters are set via environment variables; a list of them can be found in the Prebuilt Tools documentation. For a production database, use a separate read-only role.

10. Sentry MCP — errors and traces from production

What it does: gives coding agents access to issues, errors, traces, and logs in Sentry (getsentry/sentry-mcp). Designed for scenarios where a human is involved in the process, not for autonomous agents.

Who it's for: teams already using Sentry: "debug this production error and suggest a fix" directly in Claude Code or Cursor.

Cons:

• AI search (search_errors, search_issues, etc.) in local mode requires an LLM provider key: OpenAI, Anthropic, or OpenRouter. Without it, these tools are unavailable.
• The license is FSL-1.1, not a classic open source license.
• For self-hosted Sentry, the authors call the STDIO mode "work in progress."

Status and transport: official from Sentry. Remote server https://mcp.sentry.dev/mcp with OAuth or local STDIO package @sentry/mcp-server. The old Sentry reference server from the MCP repository is archived.

claude plugin marketplace add getsentry/sentry-mcp
claude plugin install sentry-mcp@sentry-mcp

📊 Comparison Table

MCP reference servers are currently transitioning from MIT license to Apache-2.0, so both are indicated in the table.

⚠️ Archived Servers That Are Still Recommended

The most common mistake in popular collections is linking to modelcontextprotocol/servers-archived. These servers are no longer supported, and for some, official replacements already exist (list in MCP README).

⚠️ Important: an archived server is not necessarily compromised today. But there will be no more security fixes for it, and you are running it with your own tokens.

🎯 What to Choose for the Task

⚠️ Important: do not connect all MCP servers simultaneously without necessity. Each server adds a description of its tools to the model's context, and the more there are, the more often the model chooses the wrong one. How many tools can be kept in context without loss of quality depends on the model, AI client, and task complexity, so there is no universal number. Start with a minimal set and add servers when there is a real need for them. Why this happens and what to do about it is discussed in the article Tool RAG: What to Do When an Agent Has Too Many Tools.

🛡️ Before Installation: Quick Checklist

1. Who is the author? Official server from the product provider or a community implementation?
2. Is it not archived? Check the date of the last commit and if the code is in servers-archived.
3. What permissions are you granting? Token with minimal scopes, read-only mode, folder or repository restrictions.
4. Is the version fixed? @latest is convenient, but updates arrive without your verification.
5. What does the server send externally? Telemetry, external APIs, closed backend.
6. Where does the content come from? Search, pages, issues, and documents may contain instructions for the model.

❓ Frequently Asked Questions

Are all MCP servers free?

The code for most servers is open and free, but the service behind it may be paid. Brave Search requires an API key, and some features are only available on the Pro plan. Context7 works without a key with lower limits. AI search in Sentry in local mode requires an LLM provider key.

Can I run an MCP server locally?

Yes. Most servers on this list work locally via STDIO: the client launches the process itself. Remote options are available for GitHub, Context7, and Sentry.

How many servers can be connected simultaneously?

Technically, as many as you want. Practically, the limit depends on the model, client, and task: each server adds a description of its tools to the context, and the model starts making mistakes more often in its choices. Start with a minimal set for a specific task and narrow down the servers themselves, such as GitHub via --toolsets or --tools.

Why shouldn't I take servers from servers-archived?

They are no longer supported and vulnerabilities will not be fixed. For Brave Search, GitHub, and Sentry, there are already official replacements from the product authors.

How to check an MCP server for security?

Look at the author, repository activity, the permissions it requests, and what it sends externally. Run with a minimal token and, where possible, in read-only mode. Repository popularity does not guarantee security.

📚 Sources

• modelcontextprotocol/servers — reference servers and archived list
• MCP Registry
• GitHub MCP Server
• Context7 (Upstash)
• Brave Search MCP Server
• Playwright MCP (Microsoft)
• Chrome DevTools MCP
• MCP Toolbox for Databases (Google)
• Sentry MCP