MCP Advisor — an instruction source, not a dependency
An MCP server gives Claude Code real access to your tools. It is also the least examined thing
in your stack, because it does not look like code you own. Claude Code's docs say it plainly:
"Verify you trust each server before connecting it. Servers that fetch external content can
expose you to prompt injection risk."
The distinction that governs everything below: a library is text you run; an MCP server is text
the model obeys. Its tool descriptions are prompts. A server that reads issue titles, web
pages, or customer emails is piping attacker-influenced text into a session that can write files
and run commands. That is not a reason to avoid MCP — it is the reason a human picks each one.
I never add one without asking
Suggesting an MCP is my job. Installing one is yours. mcp-install-gate.py enforces this on
claude mcp add, add-json, add-from-claude-desktop, and any write to .mcp.json — so the
rule holds even if nobody read this file. When I propose a server I will tell you: who publishes
it, what it can read, what credential it needs, and which scope I am proposing — and then wait.
Decision: is an MCP server even the right answer?
The docs give the honest trigger:
"Connect a server when you find yourself copying data into chat from another tool, like an
issue tracker or a monitoring dashboard."
That is the bar. Repetition of a manual paste — not novelty.
| Situation |
Answer |
| Pasting the same dashboard/ticket/query output repeatedly |
An MCP earns its place |
| One-off lookup |
Just paste it. A permanent instruction source for a five-minute task is a bad trade |
A CLI already does it (gh, aws, psql) |
Use the CLI — it is already governed by the command gates and needs no new trust |
| Reading our own database |
Prefer a read-only server and a read-only credential |
| It would need broad write access to production |
Almost certainly no. Ask what specifically must be automated |
gh beats a GitHub MCP for most tasks. A CLI runs under the permission and hook layers you
already have; a server adds a new instruction source and a new credential. Reach for MCP when the
tool has no usable CLI, or when structured tool-calling genuinely beats parsing CLI output.
Discovery — start with the reviewed list
- Anthropic Directory — reviewed connectors, same MCP
infrastructure. Start here; "reviewed by someone" is the cheapest trust you will ever get.
- Vendor-published servers (Notion, Sentry, Stripe, Figma) — the vendor is accountable and
identifiable. Second best.
- Community/random GitHub servers — treat exactly like adding an unvetted dependency that can
also talk to the model. Read the source, or don't add it.
claude mcp list / claude mcp get <name> / /mcp — what is already connected. Check this
first: the answer is often "we already have it."
The vetting bar (all four, before I suggest it)
- Who publishes it, and would you name them in an incident review? Anonymous server, no.
- Pinned, not floating.
npx -y some-server@latest re-downloads whatever was published this
morning — the plugin's own pin, don't float rule applies here at least as hard, because this
dependency also writes prompts.
- Least credential. A read-only DB user, a scoped token. An MCP server with your admin key
has your admin key.
- Blast radius matches scope. See below.
→ references/vetting-servers.md
Decision: which scope?
| Scope |
Lives in |
Loads |
Use when |
| local (default) |
~/.claude.json |
Only this project, only you |
Trying it out; anything personal |
| project |
.mcp.json, checked in |
Everyone who opens the repo |
The whole team genuinely needs it |
| user |
user config |
All your projects |
Your own tooling across repos |
--scope project is a decision about other people. It ships to every teammate, who each see
it as ⏸ Pending approval until they accept — they are being asked to trust your vetting. Do
not use project scope to save yourself one command.
→ references/adding-safely.md
Secrets never go in .mcp.json
.mcp.json is committed. Reference the environment (${VAR}), never a literal key — the repo's
security-scan.py will block the obvious cases, and the non-obvious ones are the ones that hurt.
Note that headersHelper executes arbitrary shell commands: a .mcp.json from an untrusted
repo is code, not config.
After connecting
/mcp shows status; a server that fails to start is a silent capability gap.- Re-read what changed. New tools mean new instructions in your context; the model's
behaviour can shift for reasons that have nothing to do with your prompt.
- An org can make vetting mandatory rather than advisory with
allowedMcpServers /
deniedMcpServers in managed settings — that is layer 5, and it is the only way to stop a
determined engineer. See docs/org-policy.md.
Deep guides (read on demand, do not preload)
- Judging a server before it earns your trust: publisher, pinning, credential scope, the
prompt-injection surface, reading a server's tool descriptions as the prompts they are, and
the questions to ask about one you did not write →
references/vetting-servers.md
- The mechanics:
claude mcp add for stdio/HTTP/SSE, scopes and where each lives, .mcp.json
and the approval flow teammates see, env-var indirection for tokens, and removing a server
→ references/adding-safely.md
1---2name: mcp-advisor3description: Discover, evaluate, and safely connect MCP servers. Use when a task keeps requiring data pasted in from another tool (Jira, Sentry, Figma, Postgres, Notion, Slack), when someone asks "is there an MCP for this", "should we add an MCP server", "find an MCP", "connect Claude to X", or when choosing a scope (local/project/user), vetting a third-party server, or deciding whether an MCP is worth its supply-chain cost. Also use before running `claude mcp add` or editing `.mcp.json`.4---56# MCP Advisor — an instruction source, not a dependency78An MCP server gives Claude Code real access to your tools. It is also the least examined thing9in your stack, because it does not look like code you own. Claude Code's docs say it plainly:1011> *"Verify you trust each server before connecting it. Servers that fetch external content can12> expose you to **prompt injection risk**."*1314The distinction that governs everything below: **a library is text you run; an MCP server is text15the model obeys.** Its tool descriptions are prompts. A server that reads issue titles, web16pages, or customer emails is piping attacker-influenced text into a session that can write files17and run commands. That is not a reason to avoid MCP — it is the reason a **human** picks each one.1819## I never add one without asking2021Suggesting an MCP is my job. Installing one is yours. `mcp-install-gate.py` enforces this on22`claude mcp add`, `add-json`, `add-from-claude-desktop`, and any write to `.mcp.json` — so the23rule holds even if nobody read this file. When I propose a server I will tell you: who publishes24it, what it can read, what credential it needs, and which scope I am proposing — and then wait.2526## Decision: is an MCP server even the right answer?2728The docs give the honest trigger:2930> *"Connect a server when you find yourself copying data into chat from another tool, like an31> issue tracker or a monitoring dashboard."*3233That is the bar. Repetition of a manual paste — not novelty.3435| Situation | Answer |36|---|---|37| Pasting the same dashboard/ticket/query output repeatedly | **An MCP earns its place** |38| One-off lookup | Just paste it. A permanent instruction source for a five-minute task is a bad trade |39| A CLI already does it (`gh`, `aws`, `psql`) | **Use the CLI** — it is already governed by the command gates and needs no new trust |40| Reading our own database | Prefer a **read-only** server and a read-only credential |41| It would need broad write access to production | Almost certainly no. Ask what specifically must be automated |4243**`gh` beats a GitHub MCP for most tasks.** A CLI runs under the permission and hook layers you44already have; a server adds a new instruction source and a new credential. Reach for MCP when the45tool has no usable CLI, or when structured tool-calling genuinely beats parsing CLI output.4647## Discovery — start with the reviewed list4849- **[Anthropic Directory](https://claude.ai/directory)** — reviewed connectors, same MCP50 infrastructure. Start here; "reviewed by someone" is the cheapest trust you will ever get.51- **Vendor-published servers** (Notion, Sentry, Stripe, Figma) — the vendor is accountable and52 identifiable. Second best.53- **Community/random GitHub servers** — treat exactly like adding an unvetted dependency that can54 also talk to the model. Read the source, or don't add it.55- `claude mcp list` / `claude mcp get <name>` / `/mcp` — what is already connected. **Check this56 first**: the answer is often "we already have it."5758## The vetting bar (all four, before I suggest it)59601. **Who publishes it, and would you name them in an incident review?** Anonymous server, no.612. **Pinned, not floating.** `npx -y some-server@latest` re-downloads whatever was published this62 morning — the plugin's own *pin, don't float* rule applies here at least as hard, because this63 dependency also writes prompts.643. **Least credential.** A read-only DB user, a scoped token. An MCP server with your admin key65 has your admin key.664. **Blast radius matches scope.** See below.6768→ `references/vetting-servers.md`6970## Decision: which scope?7172| Scope | Lives in | Loads | Use when |73|---|---|---|---|74| **local** (default) | `~/.claude.json` | Only this project, only you | Trying it out; anything personal |75| **project** | **`.mcp.json`, checked in** | Everyone who opens the repo | The whole team genuinely needs it |76| **user** | user config | All your projects | Your own tooling across repos |7778**`--scope project` is a decision about other people.** It ships to every teammate, who each see79it as `⏸ Pending approval` until they accept — they are being asked to trust *your* vetting. Do80not use project scope to save yourself one command.8182→ `references/adding-safely.md`8384## Secrets never go in `.mcp.json`8586`.mcp.json` is committed. Reference the environment (`${VAR}`), never a literal key — the repo's87`security-scan.py` will block the obvious cases, and the non-obvious ones are the ones that hurt.88Note that `headersHelper` **executes arbitrary shell commands**: a `.mcp.json` from an untrusted89repo is code, not config.9091## After connecting9293- `/mcp` shows status; a server that fails to start is a silent capability gap.94- **Re-read what changed.** New tools mean new instructions in your context; the model's95 behaviour can shift for reasons that have nothing to do with your prompt.96- An org can make vetting mandatory rather than advisory with `allowedMcpServers` /97 `deniedMcpServers` in managed settings — that is layer 5, and it is the only way to stop a98 determined engineer. See [`docs/org-policy.md`](../../docs/org-policy.md).99100## Deep guides (read on demand, do not preload)101102- Judging a server before it earns your trust: publisher, pinning, credential scope, the103 prompt-injection surface, reading a server's tool descriptions as the prompts they are, and104 the questions to ask about one you did not write → `references/vetting-servers.md`105- The mechanics: `claude mcp add` for stdio/HTTP/SSE, scopes and where each lives, `.mcp.json`106 and the approval flow teammates see, env-var indirection for tokens, and removing a server107 → `references/adding-safely.md`
Kaakati