MCP Servers Explained: How to Connect Them (and the Real Security Risks)
A practical guide to MCP servers in 2026: remote vs local, how to actually connect one, which are worth using, and the real supply-chain security risks to know about first.
If you already know what MCP is conceptually, this is the practical next step: what an actual MCP server is, how to connect one, which are worth using, and — the part most guides skip — the real security risks that come with plugging a third-party server into an AI assistant with access to your accounts and files.
What an MCP server actually is, concretely
An MCP server is a small program that exposes a specific set of tools or data to an AI assistant through the Model Context Protocol’s standard interface. A GitHub MCP server lets Claude or another assistant read issues, open pull requests, and search code in your repos. A Notion MCP server lets it read and write pages in your workspace. The assistant doesn’t need custom code for each one; it just needs to know how to speak MCP, and the server translates that into whatever the underlying service actually requires.
Since Anthropic released MCP in November 2024, the ecosystem has grown to over 17,000 publicly listed servers. OpenAI and Google DeepMind adopted the protocol in early 2025, and it was donated to the Linux Foundation’s Agentic AI Foundation in December 2025 — the kind of neutral governance move that tends to happen once a standard has actually won, not before.
Remote vs. local: the distinction that actually matters
Remote (HTTP/SSE) servers run on the service provider’s infrastructure and connect over the internet, typically secured with OAuth. As of 2026 this is the default for major integrations: GitHub, Vercel, Linear, Notion, Supabase, Stripe, and Figma all publish hosted endpoints, so there’s no local install required. You authenticate once and the server runs entirely outside your machine.
Local (STDIO) servers run directly on your computer. They’re faster since there’s no network round-trip, and they work offline, but you’re responsible for installing and updating them yourself, and they run with whatever permissions you’ve granted on your own machine.
For most people, remote servers from the platforms above are the simpler and safer starting point. Local servers make more sense for tools that genuinely need to touch your filesystem or run offline.
How to actually connect one
The exact command depends on your client, but the pattern is consistent. In Claude Code, connecting a remote HTTP server looks like:
claude mcp add -s user -t http github https://api.githubcopilot.com/mcp/The -t http flag tells Claude Code this is a streamable HTTP endpoint rather than a local process. Most major AI coding tools support MCP the same general way, including Claude Code, Claude Desktop, Cursor, Windsurf, VS Code with GitHub Copilot, Cline, Zed, Replit, and Continue.dev — the specific config file or command differs, but the underlying concept (register a server, grant it scoped access, the assistant can now call its tools) is the same everywhere.
Which servers are actually worth using
GitHub’s MCP server is the most-installed server of all time and the obvious starting point for anyone doing coding work with an AI assistant — issues, PRs, code search, and repo context without leaving your assistant. Beyond that, the servers worth knowing about map to what you already use: Notion and Supabase for teams that live in those tools, Stripe for anything touching billing or payments data, Figma for design handoff, Linear and Vercel for engineering workflows, and Zapier as a bridge into thousands of other apps it already integrates with.
The honest advice: don’t install servers speculatively. Connect the one or two that map directly to a task you’re already doing by hand, confirm it actually saves time, and expand from there.
The security risks nobody should skip
This is the part worth taking seriously before connecting anything unfamiliar. In September 2025, researchers found the first confirmed malicious MCP server in the wild: a compromised npm package called postmark-mcp, which looked like a legitimate email integration tool but had a hidden backdoor that silently BCC’d every outgoing email to an attacker-controlled address. Password resets, invoices, internal communications, and customer data all leaked through it before it was caught.
That wasn’t a one-off. A 2026 survey of over 1,800 deployed MCP servers found more than 30% had at least one exploitable vulnerability, and researchers logged 30-plus new CVEs in a single 60-day window. The attack patterns worth knowing:
- Malicious tool descriptors — a trojanized server presents itself as a legitimate tool, and connecting it hands over whatever access you granted.
- Typosquatting — a fake package with a name close to a popular server’s real name.
- Repository pollution — a legitimate server gets a malicious update pushed to it after the fact, so a server that was safe when you installed it isn’t guaranteed to stay that way.
What this means practically: only connect servers from a service’s own official integration (GitHub’s server from GitHub, Stripe’s from Stripe) rather than a random third-party package claiming to wrap the same API. Review what scopes and permissions you’re granting before approving a connection — the same instinct you’d apply to an OAuth prompt from an unfamiliar app. And treat “it worked fine yesterday” as no guarantee for today, given how repository pollution works.
Frequently asked questions
Do I need to understand MCP to use Claude Code or similar tools?
No. Most coding assistants ship with common MCP servers pre-configured or one command away, and you can use them productively without ever thinking about the protocol underneath. Understanding MCP matters once you want to connect something the tool doesn’t already support out of the box.
Are remote MCP servers safer than local ones?
Generally yes, when they come from the service’s own official integration, since you’re not running unfamiliar code on your own machine and the provider is responsible for patching their endpoint. That safety assumption breaks down if the “official” server turns out to be a compromised or spoofed package, which is exactly what happened with postmark-mcp — so “remote” alone isn’t a security guarantee, the source matters more.
Can I build my own MCP server?
Yes — the protocol is open and documented, and building a minimal server that exposes a tool or two to an assistant is a well-trodden path for developers with an internal API or database they want an AI assistant to reach. That’s a separate, more involved project from simply connecting an existing server, and out of scope for this guide.
