There are thousands of MCP servers on public registries. Most are not worth installing, and the reason is not that they are badly built.
Every server you connect loads its tools and schemas into the agent's context before it does any work. Connect twelve and you have degraded performance on the task that needed three. The config should look like a small toolbox, not an app store account you forgot to clean up.
Most workflows need three to five. Add the fourth when you have felt the absence of it, not before.
The baseline
| Server | Job | Auth | Cost |
|---|---|---|---|
| GitHub | Repos, issues, PRs, Actions | OAuth | Free |
| Context7 | Version-correct library docs | None | Free |
| Filesystem | Local file access, scoped | Local | Free |
| Playwright | Browser automation | Local, no credentials | Free |
| Sentry | Errors with full context | OAuth | Free with any account |
Filesystem, GitHub and a codebase context server cover the baseline for almost everyone. The rest is workflow-specific.
GitHub
The best general-purpose starting point: repositories, issues, pull requests, Actions, and genuinely good scope controls. If you are building side projects, connect it in read-only mode and you have removed most of the risk while keeping most of the value.
Context7
Solves one specific and very common failure: your agent confidently writing code against a library version that shipped two years ago. Built by Upstash, it pulls version-specific documentation and examples from source, covering a large set of fast-moving frameworks.
One quirk worth knowing. Context7 works best when you tell the agent to consult it before coding. Left installed and never mentioned, some clients will not reliably choose it. A standing rule in your client config that pulls Context7 docs for any code-related question fixes this, rather than typing the instruction every time.
Filesystem
The official server is the secure default: access strictly limited to allowed directories. Good for reading a repo and explaining its architecture, and for basic edits.
Desktop Commander is the unrestricted alternative, adding full terminal access, process management and ripgrep search. More capable and considerably more dangerous. The scoping in the official server is the feature, not a limitation.
Playwright
Microsoft's first-party server. It drives pages through Playwright's accessibility tree rather than screenshots, so the agent works from structured element roles and text instead of pixels. That makes it deterministic in a way vision-based automation is not, and much cheaper, since no image tokens are involved.
Good for end-to-end test generation, exploratory browser work and verifying a deploy. Still pre-1.0.
Sentry
Changes the debugging loop rather than speeding it up. The normal version is lossy: see the error, copy the stack trace, paste it into chat, describe the missing context, get a guess. With Sentry connected the agent sees the complete issue including breadcrumbs, environment and related events, and the fix suggestions improve correspondingly.
Free with any Sentry account, hosted with OAuth. The trade-off of a managed server is that it goes down when Sentry does.
Add by what you actually do
Backend: PostgreSQL and Sentry. The Postgres server lets an agent explore schema, understand relationships and query in plain language.
Frontend: Playwright and Figma. Figma for implementing designs and pulling design tokens.
Research-heavy work: Context7 and a search server. Brave, Exa, Tavily and Perplexity all maintain their own, most wanting an API key. For search-data servers specifically, see our SEO MCP server guide.
Performance work: Chrome DevTools MCP is a different thing from Playwright. It records performance traces, lists network requests and reads console messages from a live browser, which turns "the page feels slow" into something an agent can investigate.
Web content: Firecrawl has an unusually good on-ramp, with a keyless mode needing no account, OAuth for interactive clients, and API-key mode for CI. Fetch is the reference server that retrieves a page as markdown and respects robots.txt by default.
Issue tracking: Linear's first-party hosted server is the one most automation templates lean on.
The security part
Two things worth taking seriously.
Prefer official servers. Use the implementation from the service provider, GitHub's own, Sentry's own, rather than an unreviewed community fork. You are handing a server your credentials and letting it act on your systems.
Browser servers carry prompt-injection risk. A poisoned page can contain instructions that redirect the agent, and the agent has no reliable way to distinguish page content from your instruction. This is not theoretical and it is the main reason to think carefully before pointing a browser server at arbitrary URLs while it holds authenticated sessions.
Grant the narrowest credentials that work. Read-only where read-only suffices. Scope filesystem access to the project directory, not your home folder.
MCP is not always the right shape
Worth knowing before you install anything: MCP is one of three ways to extend a coding agent, and it is not always the best.
MCP gives a live connection to a system. Right when the agent benefits from a persistent session and repeated inspection.
CLI is often more token-efficient for high-volume tasks. Playwright's own documentation makes this point: if you already know the exact test you want to run, invoking the CLI beats maintaining a browser session through MCP.
Agent skills teach an agent how to do a repeatable job. MCP gives it a connection to where the job happens. They solve different problems and many good workflows use both.
Reaching for MCP when a CLI call would do is how configs get bloated.
What it costs
Most of the core servers are free. The reference servers, Playwright, Chrome DevTools and Context7 all cost nothing to run. GitHub and Sentry are free with an account.
What you pay for is the underlying service. A hosted server still needs an account, and several search servers require a paid API key.
FAQ
How many MCP servers should I run? Three to five for most workflows. Filesystem, GitHub and a codebase context server are the baseline. Add more only when you have felt the absence.
Does installing more servers make my agent better? No, generally the opposite. Each server adds tools and schemas to the context window before any work begins, which degrades performance on the actual task.
Are MCP servers safe? Depends on the server, the client and the credentials you grant. Prefer official implementations, scope access narrowly, and treat browser servers as higher risk because of prompt injection from page content.
Do MCP servers work with all coding agents? MCP is an open protocol published by Anthropic in November 2024, and most serious coding agents now speak it. Client support for specific features still varies. We cover the marketing side of the ecosystem in our guide to MCP servers for marketers.
What should a solo developer start with? GitHub in read-only mode plus Context7. That covers most of the value with minimal risk.
Is Context7 worth it? If you work with fast-moving libraries, yes. It is the fix for agents inventing API signatures from stale training data. Set a client rule so it gets consulted automatically.
How this guide was researched
Desk research, not hands-on benchmarking. Server capabilities, auth models and workflow patterns were cross-checked across multiple independent sources in 2026, including several written by teams running these servers in production.
Much of the published writing in this category comes from companies selling one of the servers or an agent platform, and recommendations follow accordingly. Auth models and feature sets change as servers ship updates, so check the vendor's own documentation before granting credentials.
