I Tested 12 MCP Servers for a Month — Only These 6 Made the Cut

Article Content

After a month of daily use in Claude Code and Cursor, the author had around 12 MCP servers wired into their config. Most survived exactly one day; only 6 remain in every session they open. This list covers what each server actually gives the agent, what it costs in config and context, and which ones got pulled without hesitation.

Every install command was checked against the publisher's own repo or package registry — not copied from a secondhand list.

What MCP Is, and Why Context Cost Matters More Than the Feature Table

Model Context Protocol is an open standard from Anthropic, now common across Claude Desktop, Claude Code, Cursor, Windsurf, VS Code agent mode, Cline, OpenAI's Codex CLI, and other clients. One protocol, any model, any data source: local files, Git repos, databases, browsers, the live web.

What you install is a server — a small program that exposes typed tools to the model. Ask "what changed on my branch" and the model doesn't guess; it calls the Git server's git_status tool and reads the real output. Local servers run over stdio (usually a one-line npx or uvx); remote servers run over HTTP with OAuth. Declare it once in JSON and every compatible client loads it.

The author's three selection criteria were: does it eliminate a step I'd otherwise do by hand, can it be configured in under ten minutes, and does it blow up the context window. That third one is the most overlooked and the most dangerous — every server's tool schemas occupy model context for the entire session, and the fuller it gets, the "dumber" the model becomes in practice. Two servers on this list earn their spot with a single tool each; the rest of the entries exist precisely to remind you not to install everything.

Tool schemas and the context window: Every tool an MCP server registers with the client carries a JSON Schema describing parameter names, types, enum values, defaults, and purpose. When a client starts a session, it serializes the tool schemas of all connected servers into the system prompt or tool list; that token cost is resident for the whole session and grows linearly with server count. A moderately complex server (like GitHub MCP) may expose 20+ tools, whose schemas easily consume thousands of tokens; stack a dozen servers and the context window is heavily occupied by static descriptions, leaving less room for actual dialogue and code, and making the model more likely to miss early instructions in long sessions. That's the mechanism behind "the more you install, the dumber it gets" — not a drop in model capability, but effective context diluted by tool metadata.

The Six That Stayed, and What Each One Solves

Filesystem: Giving Desktop Agents Disk Access

Claude Desktop originally had no way to touch your disk; the official Filesystem server fills that gap with read, write, search, and move — and it can only operate inside directories you explicitly pass. The design detail the author values most is built-in scoping: point it at ~/code instead of your entire home directory and it simply can't leave. "Rename these functions in the package and update the tests" goes from fantasy to a workable request.

GitHub MCP Server: The Biggest Change for GitHub Workflows

The old community GitHub server is archived; GitHub now maintains two forms itself: a remote server connected via OAuth at api.githubcopilot.com/mcp/ (no token wrangling, supports VS Code, Claude Desktop, Cursor), and a local Go build for clients that don't support remote. Capabilities cover repo browsing, issue and PR automation, Actions run analysis, and Dependabot alerts. "Triage my open issues and draft replies" and "why did the last workflow fail" — the answers come from live data, not the model's memory of your repo. This is the one the author credits with most changing how their week works.

Playwright MCP: Accessibility Trees Instead of Screenshots

Screenshot-based automation is a blunt instrument; Playwright MCP feeds the model the page's accessibility tree — structured, deterministic, readable without a vision model. Click, type, navigate, read back. Verifying a fix on a running app, grabbing a docs page, smoke-testing a form all feel natural.

The author also relays, in good faith, the caveat from Microsoft's own README: for pure coding agents, the CLI plus skills is more token-efficient, since both the tool schemas and the accessibility tree eat context. Keep it for sessions that need persistent browser state (long exploratory runs, self-healing test loops); for a quick page look, a lighter command does the job.

Accessibility tree: While rendering the DOM, the browser builds a semantic accessibility tree consumed by assistive technologies like screen readers. It filters out purely decorative divs and styling, keeping only roles, names, states (checked/disabled), and hierarchy — making it more compact than raw HTML and more structured than a screenshot. Playwright MCP maps each interactive node to a referenced element identifier, so the model issues deterministic instructions like "click ref=12" and then reads back the updated tree to verify the result. Compared with a vision model parsing screenshots, its output is text, stable, and reproducible, unaffected by resolution, theme, or animation; the cost is that the tree itself still consumes tokens, and complex pages can produce thousands of lines, which is why Microsoft recommends the CLI for pure coding scenarios.

Context7: Pulling Framework Docs Past the Training Cutoff

Frameworks always iterate faster than model training cutoffs. Context7 resolves the library you name, pulls current documentation and code examples, and hands them to the model mid-conversation. The difference is between "here's what React class components looked like in 2023" and an answer based on the API you actually installed. If you regularly have agents write code against a specific framework, this pays for itself immediately.

Fetch: The Security Default Most Worth Praising

Converts web pages into chunked markdown so the agent can keep reading until it finds what it needs. It also has the most thoughtful security default of any server the author tested: it refuses private, loopback, and link-local addresses — including cloud metadata endpoints — re-checks on every redirect hop, and provides documented switches to relax restrictions when you genuinely need to.

SSRF and cloud metadata endpoints: Server-side request forgery (SSRF) is when an attacker induces a server to make requests to internal addresses, bypassing network boundaries. In the MCP context, an agent manipulated by prompt injection could be made to have Fetch grab http://169.254.169.254/ (the instance metadata endpoint common to AWS, GCP, and Azure), which returns the cloud host's temporary credentials. Fetch by default refuses private ranges (10/8, 172.16/12, 192.168/16), loopback (127/8, ::1), and link-local (169.254/16) addresses, and re-resolves the target IP on every HTTP redirect to prevent a public URL from hopping to the internal network. This default matters because most similar fetch tools do a single DNS check, which a redirect can bypass.

Git: The Best Starter Writable Server

One command uvx mcp-server-git, one argument (the repo path), and the agent can read status, diff, log, and history, and create commits when you allow it. Far better than pasting diffs into chat, and it's the safest first writable server — every action lands in Git's own safety net.

Why I Removed Sequential Thinking and Memory

Sequential Thinking is one of the most recommended servers on the internet; the author cut it after a week. It gives the model a tool to record numbered thinking steps with revisions and branches. Modern reasoning models already think in multiple rounds; this tool's calls add tokens to every session while rarely changing the outcome. On strong models it's a tax; on weak models it's a fig leaf.

Memory is genuinely clever — a knowledge-graph store the model reads and writes across conversations — but it only wins when you maintain it carefully. Left alone, it accumulates trivia and injects stale "facts" into later sessions. Running a long-lived assistant project and actually pruning the graph? Worth a try. Otherwise the honest default is off.

The author also skipped the archived reference servers: the old Postgres, SQLite, Puppeteer, Google Drive, and Slack entries now live in the servers-archived repo, which the project itself calls teaching reference implementations rather than production-ready. Before installing, confirm whether an "official" server is still on the current reference list or already archived — that distinction matters.

The Security Section Most Lists Skip

An MCP server is a capability grant with real side effects — file writes, commits, opening PRs, browser sessions. The author follows four rules:

• Narrow the scope before installing. Filesystem gets only the project directory, never home; Git points at a single repo. The argument list is the permission boundary.
• Assume prompt injection can reach your tools. An agent that fetches web pages or reads issues may encounter text designed to manipulate it. Turn off writable servers in sessions that read untrusted content, and review before bulk operations.
• Pin and vet packages. npx -y pulls the latest version on every start. Prefer verified publishers (@modelcontextprotocol, @microsoft, @github, @upstash, @brave), and lock versions in shared configs.
• Least-privilege tokens. OAuth remote servers are convenient because they're powerful — check which account and which scopes you approved. The author's GitHub connection can open PRs; if yours only needs to read issues, tighten it.

Supply-chain risk of npx -y: npx -y resolves and downloads the latest version from the npm registry on every start, meaning a config that passes today may pull a hijacked or mis-published new version tomorrow — incidents common in the npm ecosystem (dependency confusion, stolen maintainer accounts). It's especially dangerous for MCP servers because they run with your user privileges and hold capabilities over files, Git, and OAuth tokens. Mitigations include: hardcoding exact versions in config (@playwright/mcp@1.2.3 rather than @latest), preferring packages with npm provenance signatures, verifying integrity with lockfiles in CI or shared configs, and running npm view <pkg> repository before first install to confirm the publisher's repo matches the docs.

Two-Minute Setup, and Who Shouldn't Bother

In Claude Code: claude mcp add playwright npx @playwright/mcp@latest. In Cursor: Settings → MCP, same command to configure. Claude Desktop reads claude_desktop_config.json, where each entry is a command, arguments, and optional environment variables. One Windows gotcha: wrap npx in cmd /c, or the server fails silently. Restart the client after editing config and confirm the green "connected" status — a mistyped package name fails silently in most clients.

This setup is not for these people: those who only use chat assistants for writing and research and don't write code (they need at most one or two research servers, not a developer's full stack); those on locked-down work machines (every line of npx becomes a ticket); those hoping MCP will make a weak model smart (it won't — tools amplify a strong model's capabilities and a weak model's mistakes); and newcomers to AI coding agents (start with one, Filesystem or Git, learn the loop before expanding — a dozen half-understood tools is exactly how people conclude "MCP is useless").

Final Verdict

Five servers survived the rotation: Filesystem, GitHub, Playwright, Context7, Fetch, plus a sixth for repo-heavy days, Git. Together they cover a developer's real loop: files, repos, issues, browsers, current docs, and the open web. The rest are either situational (Memory, Brave Search), redundant on modern models (Sequential Thinking), or reference implementations that belong archived, not in production.

Install these five, narrow the scope of each, then judge every future server with one question: does it eliminate a step I'd otherwise do by hand? If not, uninstall — the context it consumes is real.