MCP Management

MCP Management

Comprehensive guide for finding, configuring, securing, and building MCP servers for Claude Code and Claude Desktop.

Quick Navigation

• Find Servers: See Discovering MCP Servers
• Configure Servers: See references/server-configs.md
• Build Custom Servers: See references/building-servers.md
• Security: See references/security-essentials.md
• Troubleshooting: See references/troubleshooting.md
• Enterprise: See references/enterprise-config.md

Platform Differences

Discovering MCP Servers

Primary Registries

Specialized Directories

Evaluation Criteria

When selecting an MCP server:

1. Maintenance: Recent commits? Active issues?
2. Security: Reviewed code? Known vulnerabilities?
3. Token cost: How many tokens does it consume?
4. Transport: HTTP (remote) vs stdio (local)?
5. Trust: Official vs community vs unknown author?

Pre-Installation Workflow

CRITICAL: Before installing ANY MCP server, follow this workflow:

1. Fetch and Read the README

Always retrieve the server's README.md from GitHub or the registry:

# View README directly
gh repo view owner/repo-name

# Or fetch raw README
curl -s https://raw.githubusercontent.com/owner/repo/main/README.md

Look for:

• Required environment variables
• Prerequisites (Node 18+, Python 3.10+, API keys)
• Configuration options and defaults
• Usage examples and limitations
• Security considerations

2. Check for Deprecations

3. Verify Prerequisites

# Check Node version (18+ typically required)
node --version

# Check Python version (3.10+ for MCP SDK)
python3 --version

# Check if package exists
npm view @package/server-name

4. Review Security Implications

Before proceeding, confirm:

• What filesystem paths can it access?
• What network requests can it make?
• What environment variables does it read?
• Is the source code available and reviewed?

5. Install Following README Instructions

Only after completing steps 1-4, install using the README's recommended method.

Transport Types

Quick Setup Examples

Claude Code (CLI)

# Add remote server
claude mcp add --transport http github https://api.githubcopilot.com/mcp/

# Add local server
claude mcp add --transport stdio postgres -- npx -y @modelcontextprotocol/server-postgres

# List servers
claude mcp list

# Remove server
claude mcp remove github

Claude Desktop (JSON)

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_xxx"
      }
    }
  }
}

MCP vs CLI Decision

Token budget matters: GitHub MCP ~40k tokens. Context7 ~500 tokens. Enable sparingly.

Security Essentials

Critical risks (2025 research: 43% of servers have command injection flaws):

1. Prompt injection: Malicious content in fetched data manipulates Claude
2. Tool poisoning: Malicious tool descriptions trick model into unsafe actions
3. Credential exposure: API keys in version control or logs

Mitigations:

• Only install from trusted registries
• Review server code before installing unknown servers
• Use scoped tokens with minimal permissions
• Never commit credentials to version control
• Enable project-scope servers only after review

See references/security-essentials.md for detailed patterns.

Building MCP Servers

Language Selection

Python Quick Start (FastMCP)

from mcp.server.fastmcp import FastMCP

mcp = FastMCP("my-server")

@mcp.tool()
async def my_tool(param: str) -> str:
    """Tool description for Claude."""
    return f"Result: {param}"

if __name__ == "__main__":
    mcp.run(transport="stdio")

TypeScript Quick Start

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";

const server = new McpServer({ name: "my-server", version: "1.0.0" });

server.registerTool("my_tool", {
  description: "Tool description for Claude",
  inputSchema: { param: z.string() }
}, async ({ param }) => ({
  content: [{ type: "text", text: `Result: ${param}` }]
}));

const transport = new StdioServerTransport();
await server.connect(transport);

Critical: For stdio transport, NEVER write to stdout (corrupts JSON-RPC). Use stderr or logging libraries.

See references/building-servers.md for complete patterns.