Issue 00 · Autumn 2026日本語 · RSS
AgentKoji

How to Choose MCP Servers

Before hunting for recommended MCP servers, have criteria: who maintains it, transport, scope, output size, and how to narrow its permissions once installed.

MCP servers are everywhere, and adding one hands the agent a new tool and a new entry point. These are the criteria we use to choose existing servers and how we narrow permissions afterward; it’s not a list of picks. How MCP works is in MCP Servers 101 and Five Design Rules; if you haven’t installed Claude Code, start with Getting Started with Claude Code. We checked with a local Claude Code 2.1.301, an empty temp HOME, and no login (2026-10-16).

Who’s behind it

The docs warn to verify you trust each server before connecting; servers that fetch external content can expose you to prompt injection (https://code.claude.com/docs/en/mcp, checked 2026-10-16). They point to the Anthropic Directory for reviewed connectors. We check whether the service’s own vendor publishes it, whether it’s maintained, and whether it pulls in text written by others (web pages, mail, tickets). Text that looks like instructions can steer the agent.

Transport

Stdio servers run locally; HTTP is recommended for remote servers and SSE is deprecated (same source). A stdio server is a program running with your user’s permissions. We registered dummy servers that create a marker file on start, then ran claude mcp list:

Checking MCP server health…

dummy-shared: /bin/sh -c touch /tmp/mcpsel/ran-shared; cat - ⏸ Pending approval (run `claude` to approve)
dummy-local: /bin/sh -c touch /tmp/mcpsel/ran-local; cat - ✘ Failed to connect — -32601: Method not found

Just listing launched the registered command: ran-local appeared. This is our local observation on Claude Code 2.1.301 (2026-10-16), not documented behavior (the failure is because the dummy doesn’t speak MCP). Treat registering a stdio server as approving that command to run as you, and read it first.

Scope

local (default) is you in this project, project is shared via .mcp.json, user is you across all projects (same source). Start with local; move to project once the team adopts it. .mcp.json servers don’t run until approved: dummy-shared showed “Pending approval” and never created ran-shared. Read the command before approving.

Output size

Claude Code warns when MCP tool output exceeds 10,000 tokens and caps it at 25,000 by default, adjustable with MAX_MCP_OUTPUT_TOKENS (same source). Prefer servers that let you limit or page results.

Narrow permissions after install

mcp__server matches all of a server’s tools, mcp__server__tool one tool, and mcp__* in a deny or ask rule all MCP tools (https://code.claude.com/docs/en/permissions, checked 2026-10-16).

{
  "permissions": {
    "allow": ["mcp__dummy-docs__search"],
    "deny": ["mcp__dummy-docs__delete_page"]
  }
}

Allow reads; deny or ask for writes and deletes (names are dummies). Settings files skip mcp__ rules with parentheses; use --disallowedTools to match parameters (same source). Check that rules you wrote actually apply. For splitting reads and writes, see Permission Design for AI Agents.

Summary