MCP Servers

What Is MCP?

MCP stands for Model Context Protocol. It's a standard way for AI tools to connect to external services. Think of MCP servers as plugins for Claude Code. Each server gives Claude Code the ability to read from or write to an external tool.

Without MCP, Claude Code can only work with files on your machine. With MCP, it can read your Slack messages, check your GitHub PRs, query your database, and pull designs from Figma. All within the same conversation.

What MCP Servers Do

An MCP server is a small program that sits between Claude Code and an external service. It translates Claude Code's requests into API calls and returns the results.

Claude Code  →  MCP Server  →  External Service
   "read PR #42"  →  GitHub MCP  →  GitHub API
                   ←  PR diff, comments, status

Each server exposes a set of tools that Claude Code can call. The GitHub MCP server might expose tools like get_file_contents, list_pull_requests, and create_pull_request. Claude Code discovers these tools automatically and uses them when your prompt calls for it.

Popular MCP Servers

You don't need all of these. Most people start with one or two and add more over time.

How to Set Up an MCP Server

MCP servers are configured in a .mcp.json file at your project root. Each entry defines a server name, how to start it, and what credentials it needs.

Here's a minimal example connecting the GitHub MCP server:

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "<your-token-here>"
      }
    }
  }
}

When Claude Code starts, it reads .mcp.json, launches the configured servers, and discovers their tools. Now you can say "show me my open PRs" and Claude Code will call the GitHub MCP server to fetch them.

For servers that use OAuth (like Slack or Figma), the setup involves an authorization flow instead of a static token. The MCP server documentation for each service walks you through this.

A Complete Example: GitHub + Linear

Here's a real .mcp.json that connects two services:

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "<your-github-token>"
      }
    },
    "linear": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-linear"],
      "env": {
        "LINEAR_API_KEY": "<your-linear-key>"
      }
    }
  }
}

With both connected, you can ask Claude Code things like: "Find the Linear ticket for the auth bug, then check if there's a related PR on GitHub." Claude Code coordinates across both servers in a single response.

Security Considerations

MCP servers have real access to your tools. Treat them with the same care as any API integration.

Only connect servers you trust. Each MCP server runs as a process on your machine with the credentials you provide. Use official or well-maintained community servers.

Use scoped tokens. Don't hand an MCP server your all-access admin token. Create a personal access token with the minimum permissions needed. For GitHub, read-only access to repos and PRs is enough for most workflows.

Keep tokens out of version control. Never commit .mcp.json with real tokens. Either use environment variables that reference your system keychain, or add .mcp.json to .gitignore and share a .mcp.json.example template with your team.

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "$GITHUB_TOKEN"
      }
    }
  }
}

Using $GITHUB_TOKEN tells the server to read from your shell environment, keeping the actual secret out of the file.

Tips for Getting Started

Start with one server. GitHub is the easiest to set up and the most immediately useful. Get it working before adding more.

Verify before expanding. After connecting a server, test it with a simple query: "List my open PRs" or "Show me recent Slack messages." If that works, you know the connection is solid.

Check server documentation. Each MCP server has its own setup guide with specific token scopes, OAuth flows, and supported tools. Five minutes reading the docs saves an hour of debugging.

Watch for rate limits. MCP servers make real API calls. If you ask Claude Code to "search all 500 repos for security issues," you might hit GitHub's rate limit. Be specific in your requests to keep API usage reasonable.