What is MCP and why it took off
Model Context Protocol — an open protocol that Anthropic introduced at the end of 2024, and by 2026 it was adopted by practically all major vendors: clients on the OpenAI, Google side, IDEs like Cursor, Zed, VS Code, and desktop assistants. The idea is ridiculously simple: instead of writing a separate hack for each integration for a specific model, you spin up an MCP server that provides three types of entities — tools (actions), resources (data), and prompts (templates), — and any MCP-compatible client picks them up.
Technically, this is JSON-RPC 2.0 over two transports: stdio for local processes and streamable HTTP (which replaced the old SSE) for remote ones. The LLM itself decides when to call a tool, the client proxies the call to the server, and the server returns the result into context. The key shift in 2026 was the move from «tacking on a couple of functions» to full-fledged agent pipelines, where one agent orchestrates a dozen servers at once.
How we selected the 20 servers
There were four criteria: a live repository (commits in the last months, not an abandoned PoC), real production load in the community, transport security, and quality of tool descriptions (bad tool descriptions = model stumbles). Fresh releases and forks we constantly monitor — current selections go into the REDDYX catalog. Below — what is actually put into work, not hype for GitHub stars.
Databases and Storage
- PostgreSQL MCP — read-only and read-write modes, schema introspection, safe parameterized query. Classic, with which almost everyone starts.
- SQLite MCP — local analytics without infrastructure, ideal for prototypes and examining dumps.
- Supabase MCP — project management, migrations, RLS policies, and Edge Functions straight from chat. Set read-only on the prod branch.
- Redis MCP — working with cache and queues, vectors via Redis Stack for lightweight RAG.
- ClickHouse MCP — columnar analytics on large volumes; the agent itself builds aggregations on your event tables.
Files, Code, and Development
- Filesystem MCP — basic file access with a sandbox in allowed directories. Reference implementation from Anthropic.
- Git MCP — history, diff, blame, commits. The agent reads the change context instead of guessing.
- GitHub MCP — official server: issues, PR, reviews, Actions, code search. One of the most used in 2026.
- GitLab MCP — analog for those on self-hosted and corporate instances.
- Sentry MCP — extracts stack traces and error groups; the agent fixes bugs by seeing real telemetry.
Browser, Search, and Web
- Playwright MCP — controlling a real browser via the accessibility tree, not screenshots. More stable for auto-tests and scraping.
- Puppeteer MCP — Chromium alternative if you're already in its ecosystem.
- Brave Search MCP — web search without tracking, a private source of fresh data for the agent.
- Fetch MCP — fetches a URL and converts HTML to clean Markdown, stripping junk before feeding into context.
- Firecrawl MCP — crawls entire sites with JS rendering, returns structured result.
DevOps, Knowledge, and Productivity
- Docker MCP — containers, images, logs; the agent spins up the environment and reads the output.
- Kubernetes MCP — kubectl operations under the hood, debugging pods and deployments in the language of tasks.
- Slack MCP — reading and posting in channels, searching history — the agent as a team member.
- Notion MCP — knowledge base as a resource: the agent reads the wiki and appends pages.
- Memory MCP — knowledge graph for long‑term memory between sessions, so the agent doesn’t forget the project context.
Comparison of key servers
| Server | Category | Transport | Runtime Language | Risk Profile |
|---|---|---|---|---|
| PostgreSQL MCP | DB | stdio / HTTP | Node / Python | High (writes to DB) |
| Filesystem MCP | Files | stdio | Node | Medium (sandbox) |
| GitHub MCP | Code | HTTP | Go | Medium (token scopes) |
| Playwright MCP | Browser | stdio | Node | Medium |
| Brave Search MCP | Search | stdio | Node | Low (read-only) |
| Kubernetes MCP | DevOps | stdio | Go | High (cluster) |
| Memory MCP | Memory | stdio | Node | Low |
The rule is simple: the higher the risk profile, the stricter the token scopes and read-only mode needed at startup. Connecting a production database to an autonomous agent without limits — not a great idea.
HOW TO CONNECT: WORKING EXAMPLE
Most clients read a JSON config with a list of servers. Here is a minimal working config with three servers — files, PostgreSQL and GitHub:
{
"mcpServers": {
"filesystem": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-filesystem", "/home/user/projects"]
},
"postgres": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-postgres"],
"env": {
"DATABASE_URL": "postgresql://user:pass@localhost:5432/app?sslmode=require"
}
},
"github": {
"command": "npx",
"args": ["-y", "@modelcontextprotocol/server-github"],
"env": {
"GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_xxxxxxxx"
}
}
}
}Want to test the server before connecting to the client — run the official inspector, it will show all tools and resources and let you invoke them manually:
npx @modelcontextprotocol/inspector \
npx -y @modelcontextprotocol/server-filesystem /home/user/projectsThe inspector launches a local UI where you can see the JSON-RPC traffic of both sides — indispensable when debugging your own servers.
SECURITY: MAIN PITFALLS 2026
Over the past year, the community has racked up bumps, and here's what trips them up most often:
- Prompt injection via resources. If the server passes unverified web content or someone else's issues into the context, there may be an instruction 'delete everything'. Isolate untrusted sources.
- Excessive token scopes. Classic: a PAT with full repo access instead of narrow. Give minimum rights.
- Blind trust in remote HTTP servers. Check who holds the endpoint; for sensitive data prefer local stdio.
- Tool poisoning. A malicious tool description can override agent behavior — only use servers from repositories you trust.
Practical minimum: read-only by default, separate service account per server, audit calls in logs. Lists of vetted and fresh servers are handy to keep at hand — we maintain them in the REDDYX catalog with tags on repo activity.
Frequently Asked Questions
What is an MCP server in simple terms?
An MCP server is a mediator program that, via the Model Context Protocol from Anthropic, provides an LLM with a set of tools and data: access to a database, files, and APIs. The model decides when to call them, and the server executes the action and returns the result to the context.
Do I need an Anthropic API key to use MCP?
No. MCP is an open protocol, not a keyed product. Servers work with any MCP-compatible client regardless of which model is under the hood — Claude, GPT, or a local LLM. The key is needed only for the model itself, not the protocol.
How does MCP differ from regular function calling?
Function calling is tied to a specific model's API and requires rewriting the integration for each vendor. MCP standardizes this: one server works with all clients. In addition to tools, it adds resources and prompts — things missing from plain function calling.
Which MCP server should I set up first?
Start with Filesystem and Git — they're safe, give the agent context of your project, and don't touch production. Then add GitHub and PostgreSQL as needed, making sure to start in read-only mode.
The MCP ecosystem is growing faster than you can read changelogs: new servers for niche APIs appear every week. If you don't want to miss out — jump into the Telegram channel REDDYX AI — new repos every 30-60 minutes.