MCP Servers in Production: A 2026 Field Directory

The Model Context Protocol registry is a directory of hundreds of servers in 2026. Most are hobby projects that solve one person's specific problem. Some are production-grade infrastructure that a serious engineering organisation should feel comfortable mounting inside a Claude Code session or a Cursor agent.

This is a field directory of the ones actually in production use as of mid-2026 — grouped by what they do, with practical notes on which to prefer and which to avoid. For the broader context on how MCP is being used, see our 18-month field report. For the wider AI-tool landscape, the coding-assistants benchmark shows which agents implement MCP as a first-class primitive.

What "production-grade" means for an MCP server

Before the directory, the criteria. A production-grade MCP server has some combination of:

• Active maintenance in the last 60 days (not just "released once and abandoned")
• A documented authentication model (an API key or OAuth flow, not "no auth")
• Rate-limiting handled inside the server rather than punted to the client
• A test suite the maintainers actually run
• An issue tracker with responded-to bugs

Many servers in the public registry meet zero of these. A few meet all of them. The list below is drawn from the latter category.

Category 1: Databases

Postgres. The official Postgres MCP server from the reference implementation is the most-deployed MCP server in production, based on public discussion. It exposes a read-only SQL surface with a curated set of queries you configure. Safe to deploy for a Claude Code or Cursor agent to query an internal database without giving destructive access.

MongoDB and Redis. Community servers exist and are maintained. The MongoDB one is more mature; the Redis one has narrower use cases (agents rarely need direct Redis access).

BigQuery. The BigQuery MCP server is production-usable for read-only analytical queries. Combined with a well-scoped service account, it turns Claude into a competent ad-hoc analyst against your warehouse.

Category 2: Developer tools

GitHub. The official GitHub MCP server is one of the two or three most-deployed servers overall. It exposes repos, issues, PRs, and actions to the agent. Well-scoped OAuth. Excellent choice for coding agents that need to open PRs or triage issues.

GitLab. Community MCP server. Feature parity with the GitHub one but less battle-tested.

Linear. The Linear team ships a first-party MCP server that has become the reference for how a SaaS company should ship MCP. Full CRUD on issues, projects, and cycles. Auth via Linear's OAuth. Widely deployed.

Sentry. Sentry's official MCP server exposes issues, events, and releases. Useful for debugging agents that need to reason across production error data.

Filesystem. The reference filesystem server is essential for any local coding-agent workflow. Deploy it scoped to a specific directory tree; never mount it at the filesystem root.

Category 3: Communication and collaboration

Slack. The community Slack MCP servers have been consistently underwhelming. Auth is fragile, the surface is large, and the risk of an agent misfiring a message into a channel is real. If you must, deploy scoped to a single test channel first.

Notion. The official Notion MCP server is mature. Reads and writes pages, databases, blocks. Auth via Notion integrations. Widely used.

Google Workspace. Google's official MCP servers for Drive, Gmail, and Calendar are workable but the auth story requires careful OAuth setup. Read-only deployments are much easier than read-write.

Category 4: Web and search

Brave Search. Simple, reliable, low friction to deploy. Free tier is generous. The default choice for giving an agent web search.

Perplexity. Perplexity's MCP server gives agents access to Perplexity's own retrieval-augmented search. Higher quality answers than raw web search; costs more.

Playwright / Puppeteer. For agents that need to actually navigate the web, Microsoft's Playwright MCP server is the current best choice. Battle-tested browser automation, headed or headless.

Category 5: Financial and business data

Stripe. Stripe's official MCP server exposes customers, invoices, subscriptions, and payments. Read-focused; write operations require explicit user confirmation. Well-scoped. The reference for how a payments company should ship MCP.

Plaid. Plaid's MCP server exposes account, transaction, and identity data. Auth handled through Plaid Link. Production-ready.

Category 6: What to avoid

Several patterns keep appearing in the registry that are worth flagging.

Servers with no auth and no scope. If a server exposes a tool called executeshell or runpython without authentication, treat it as radioactive. The blast radius is unbounded.

Servers pointing at unmaintained scrapers. A number of MCP servers wrap unofficial scrapers of well-known consumer services (Twitter/X, TikTok, Instagram). They break on every platform change, they violate the target service's ToS, and the maintainer typically abandons them within six months.

Servers built by a single developer with no organisation behind them. For personal projects this is fine. For production deployments, prefer servers maintained by an organisation with a stake in the underlying product (Linear's, Stripe's, Notion's, Sentry's) or by the MCP reference-implementation team.

Servers that require you to install unusual runtimes. Some experimental servers require rare Python builds or exotic native dependencies. The maintenance cost of these usually exceeds the value.

Deployment discipline

Three practices consistently distinguish teams running MCP in production from teams that had a bad experience:

One: treat each server the same as any third-party dependency. Pin the version, read the changelog, do not upgrade on every release.

Two: run each server with the narrowest scope you can manage. A GitHub MCP server scoped to a single organisation is safer than one scoped to your account. A Postgres MCP server scoped to a read-only replica is safer than one against your primary.

Three: log every tool call server-side. When an agent does something surprising, the log is how you figure out what happened.

The near future

Two trends are visible in the current directory. The first is that first-party MCP servers from established SaaS companies are becoming the norm. Where in 2024 you would have relied on a community MongoDB server, in 2026 you increasingly get one shipped by the vendor. The second is that a curated public registry with signed servers is beginning to appear. This is overdue — the "no auth, no signing, install and run" model that the ecosystem started with cannot scale to enterprise adoption without a real supply-chain story.

Sources

• Model Context Protocol specification — spec.modelcontextprotocol.io
• Reference server implementations — github.com/modelcontextprotocol/servers
• Linear MCP documentation — linear.app/docs/mcp
• Stripe MCP documentation — stripe.com/docs/mcp