The pitch for MCP is simple enough that it took a while for people to notice how big it was: a standard way for an AI assistant to use your actual tools. Not copy-paste, not an integration someone built into one product — a protocol, so that any assistant can talk to any tool.
Two things happened this year that make it worth a proper look. First, in December 2025 Anthropic handed MCP to the Agentic AI Foundation under the Linux Foundation, with AWS, Google, Microsoft, OpenAI, Bloomberg and Cloudflare as platinum members. It's a real standard now, not one vendor's protocol. Second, the July 2026 spec revision broke almost everything, which means most of the MCP advice you'll find online is describing a protocol that no longer exists.
Let's do the corrections first, because they're the part nobody's written about.
What the 2026 Spec Broke
The 2026-07-28 revision is the largest change in MCP's history, and its theme is statelessness.
Sessions are gone. The Mcp-Session-Id header no longer exists. Servers that need state across calls now mint explicit handles passed as ordinary tool arguments. The upside is that remote MCP servers are now trivially load-balanceable; the cost is that anything built on session IDs broke.
The handshake is gone. No more initialize / notifications/initialized. Every request now describes itself, and servers must implement a new server/discover method to advertise what they support.
Sampling is deprecated — and so are Roots and Logging. This one matters because nearly every MCP explainer written before mid-2026 presents sampling (the server asking your client's model to generate something) as a core primitive. The official migration advice is to call an LLM provider's API directly instead. Elicitation survives, but its mechanism was rebuilt entirely.
SSE is formally deprecated. Streamable HTTP is the one remote transport. And on the auth side, Dynamic Client Registration is deprecated in favor of Client ID Metadata Documents — expect churn in OAuth libraries for a while.
The other correction: half the "official" servers are dead
The modelcontextprotocol/servers repo now maintains only seven reference servers — Everything, Fetch, Filesystem, Git, Memory, Sequential Thinking, and Time. The official GitHub, Postgres, SQLite, Slack, Google Drive, Redis and Brave Search servers have all been archived. Any tutorial pointing you at @modelcontextprotocol/server-postgres or server-github is pointing at dead code. The live equivalents are vendor-maintained, and they're better.
The Servers Worth Running
Roughly 10,000 MCP servers exist. You want about six. Here's what earns a slot for someone running a business solo.
Filesystem — official, still the best first install
@modelcontextprotocol/server-filesystem. Fourteen tools covering read, write, search, directory trees and file metadata. You pass allowed directories as arguments and it refuses to touch anything outside them. This is the one that makes an assistant feel like it works on your actual machine rather than in a box.
Scope it tightly. Pass the two or three project directories you actually want reachable, never your home folder.
GitHub — the model for how vendors do this now
GitHub's own github/github-mcp-server, available as a remote endpoint at api.githubcopilot.com/mcp/ with OAuth, or locally via Docker. Twenty-plus toolsets covering issues, PRs, repos, actions and code security, and you can enable only the ones you need.
The feature that matters: --read-only. Most of what you want an assistant doing with your repos is reading them.
Playwright — browser automation done right
Microsoft's playwright-mcp, at nearly 37,000 stars. The architectural decision that makes it good: it drives the browser through structured accessibility snapshots rather than screenshots. No vision model, no pixel-guessing — deterministic, far cheaper in tokens, and it works reliably. Run it with --isolated so each session starts from a clean profile.
Google Workspace — finally official
Google shipped first-party remote MCP servers in May 2026 (developer preview): separate OAuth endpoints for Gmail, Drive, Docs, Sheets, Slides, Calendar, Chat and People. Being able to say "find the invoice thread from last month and summarize what we agreed" and have it actually work is the single biggest quality-of-life addition of the year.
Setup friction is real — you enable both the API and its MCP service variant in Google Cloud and configure OAuth credentials. The community taylorwilsdon/google_workspace_mcp remains the lower-effort path.
Your project tracker
Linear has the cleanest implementation on this list: hosted at mcp.linear.app/mcp, OAuth, and — the part to notice — a dedicated read-only endpoint at /mcp/readonly. Notion and Slack both ship official hosted servers too; Slack's landed in February 2026 and returns natural-language responses built for LLM consumption rather than raw API payloads.
Stripe and Google Analytics — for the business half
Stripe runs an official hosted server at mcp.stripe.com covering customers, payments, subscriptions, refunds and invoices. Enormously useful, and the one I'd think hardest about before connecting — see the security section.
Google Analytics ships google-analytics-mcp, officially Google-owned and read-only by design. Asking questions about your traffic in plain language beats the GA4 interface, which is not a high bar but is a real improvement.
Zapier — the escape hatch
One remote endpoint, 9,000+ apps, 40,000+ actions, with Zapier holding the OAuth credentials and handling rate limits. If the tool you need has no MCP server, it almost certainly has a Zapier integration. Note each successful call consumes two tasks from your Zapier plan.
Security: This Is the Section That Matters
MCP gives a language model the ability to take actions in your real accounts. That is exactly as risky as it sounds, and the incidents are no longer hypothetical.
| When | What happened |
|---|---|
| Apr 2025 | Tool poisoning demonstrated against Cursor — hidden instructions inside a tool's description, which the model reads and you never see. Exfiltrated SSH keys and config files |
| May 2025 | GitHub MCP injection — a malicious public issue redirected the agent into private repos and leaked their contents |
| Jul 2025 | CVE-2025-6514 — remote code execution in mcp-remote, CVSS 9.6, affecting 437,000+ downloads |
| Sep 2025 | First malicious server in the wild — postmark-mcp, a squatted npm package impersonating Postmark, silently BCC'd every email you sent to the attacker. One line of code |
| Feb 2026 | SmartLoader — attackers cloned a legitimate server, propped it up with five fake GitHub accounts forking it to fake a contributor network, and got it into legitimate MCP registries. Payload was an infostealer after developer credentials and crypto wallets |
Three attack classes are worth understanding by name. Tool poisoning hides instructions in tool descriptions — your client shows you a friendly tool name while the model reads something else entirely. Rug pulls exploit the fact that a server can change a tool's description after you approved it. Shadowing is the nastiest: a malicious server's description alters how the assistant uses a different, trusted tool, so the compromise never appears in the logs of the tool you'd think to check.
Notice the pattern in that table. Only one entry is a protocol flaw. The rest are supply chain — npm packages and GitHub repos, the same attack surface that has plagued software for a decade, now pointed at something holding your OAuth tokens.
The NSA thought this was serious enough to publish a guidance sheet on it in mid-2026. Its central instruction is the right mental model: treat every tool result as untrusted input.
The rules I actually follow
Prefer vendor-hosted remote servers with OAuth. Stripe, Linear, GitHub, Notion, Google and Slack all run their own. Both of the worst incidents were random npm packages — that's the risky category, not the protocol.
Pin versions. npx -y foo@latest re-fetches on every launch. That's the rug-pull delivery mechanism, running on your machine, by design.
Use read-only modes. github-mcp-server --read-only, Linear's /mcp/readonly, a read-only database role in the connection string. Most of what you want is reading.
Don't mix untrusted content with write access in one session. This is the pattern behind the GitHub, Supabase and Amazon Q incidents: the agent reads attacker-controlled text — an issue, a support ticket, a PR — while holding credentials that can act. Separate the sessions.
Check the namespace, not the name. Registry namespaces are reverse-DNS and verified. Display names are not. That's precisely how the fake Postmark server worked.
How This Fits an Automation Stack
The thing I didn't expect: n8n makes an excellent credential broker. It speaks MCP in both directions — the MCP Client Tool node lets a workflow consume external servers, and the MCP Server Trigger node exposes your own workflows as tools to Claude or ChatGPT.
That second direction is the interesting one. Rather than wiring ten separate servers into your assistant, each with its own OAuth grant and its own trust question, you hold the credentials in n8n where they already live and expose a curated handful of workflow-shaped tools. You control exactly what's reachable, the blast radius is whatever you chose to expose, and you get n8n's execution log for free.
For local models, LM Studio has supported MCP since v0.3.17 with a Cursor-style config. But heed their own documented warning: many MCP servers were built for frontier models and use enormous numbers of tokens on tool definitions alone, which "can quickly bog down your local model and trigger frequent context overflows." With a local stack, tool-catalog size is the binding constraint — connect two servers, not ten. The protocol's own roadmap lists progressive discovery for large tool catalogs as a priority, which tells you this is a known problem.
Where to Start
If you've never run one: install the filesystem server scoped to a single project directory and use it for a week. It's official, it's the least dangerous thing on this list, and it's enough to tell you whether this changes how you work.
Then add one vendor-hosted server for whatever you touch most — GitHub if you write code, Google Workspace if you live in email, Linear if you run projects. Use the read-only variant. Notice whether you reach for it.
My honest assessment after a year: MCP is the most useful infrastructure development for operators since the assistants themselves, and the security story is genuinely immature. Those are both true at once. The protocol just got a stable governance home and a serious spec revision; the ecosystem around it is still the wild npm years. Treat every server you install like you'd treat a browser extension with access to your bank — because functionally, some of them are.