MCP servers list

Filesystem

Secure file operations with configurable access controls.

Reaches: The directories you allow at start-up, with the process user's rights inside them.

Writes. Creates, edits, moves and deletes files. The allow-list is the only boundary, and it is set once at launch rather than per request.

Git

Tools to read, search and manipulate Git repositories.

Reaches: Local repositories on the host, with whatever credentials the checkout already carries.

Writes. History rewriting, staging and commits are ordinary Git operations, and an agent can reach them without a second opinion.

Fetch

Web content fetching and conversion for efficient LLM usage.

Reaches: Any URL the host can route to, including internal addresses and cloud metadata endpoints.

Reads, but the read is the risk. This is a request-forgery surface unless the destination is constrained.

Memory

Knowledge graph-based persistent memory system.

Reaches: Its own store.

Writes, but only to itself. The concern is retention rather than blast radius: whatever an agent learns persists across sessions.

Everything

Reference and test server exercising prompts, resources and tools.

Reaches: Nothing external.

None. It exists to exercise a client, and it is the right server to point at a gateway when you are testing policy rather than production.

Sequential Thinking

Dynamic and reflective problem-solving through thought sequences.

Reaches: Nothing external.

None. Reasoning scaffolding with no reach outside the conversation.

Time

Time and timezone conversion capabilities.

Reaches: Nothing external.

None.

GitHub

Repository management, file operations and GitHub API integration.

GitLab

GitLab API, enabling project management.

Slack

Channel management and messaging capabilities.

Google Drive

File access and search for Google Drive.

Google Maps

Location services, directions and place details.

PostgreSQL

Read-only database access with schema inspection.

SQLite

Database interaction and business intelligence capabilities.

Redis

Interact with Redis key-value stores.

Puppeteer

Browser automation and web scraping.

Sentry

Retrieving and analyzing issues from Sentry.io.

Brave Search

Web and local search using Brave's Search API.

EverArt

AI image generation using various models.

AWS KB Retrieval

Retrieval from AWS Knowledge Base using Bedrock Agent Runtime.

Who owns the credential

A server does not have permissions of its own. It borrows a token, a checkout or a connection string, and every tool it exposes inherits that whole scope. Read the credential before you read the tool list.

Which calls change something

Group the tools into reads and writes before deployment, not after an incident. The four servers above with no external reach need no gate. Filesystem and Git do.

Whether the boundary is per request

Most server-side controls are configured once at start-up. An allow-list of directories cannot tell a routine edit from a deletion, because it never sees the individual call.

Whether it is still maintained

Thirteen of the original reference servers are archived. An archived server can still be installed, still works, and still holds the same credentials it always did.

Best MCP servers for production

The checklist for moving a server from a capable demo to a controlled production path: ownership, credential scope, isolation, side effects and failure behaviour.

MCP gateway

Where a policy decision sits relative to the server, and what a gateway can enforce that a server's own configuration cannot.

Protected resource metadata (RFC 9728)

The discovery document a client reads to find out how to authorize against a server, and what a wrong value in it breaks.

MCP tool poisoning

What happens when a tool description rather than a tool call carries the instruction, and why schema review belongs in deployment.