MCP in 2026: Which Servers Should You Connect?
MCP has about 10,000 servers and is governed by the Linux Foundation. Learn what MCP is, which servers are worth connecting and the security rules to follow.
The Model Context Protocol (MCP) is the USB port of AI tooling: one open standard that lets any AI agent talk to any external tool, databases, GitHub, browsers, ticketing systems, without a custom integration for every pair. Anthropic introduced it in November 2024. By December 2025 it was big enough that Anthropic donated it to the Agentic AI Foundation under the Linux Foundation, co-founded with Block and OpenAI and backed by AWS, Google, Microsoft, Salesforce, and Snowflake. In under two years it went from one company's spec to neutral, industry-governed infrastructure.
The numbers behind the standard
- The official MCP Registry counted roughly 9,700 registered servers (about 29,000 server/version records) as of May 2026, with nearly 16,000 GitHub repositories tagged
mcp-server. - MCP SDKs see about 97 million downloads a month.
- Anthropic, OpenAI, Google, Microsoft, GitHub, VS Code, Cursor, and ChatGPT all ship first-party MCP support, and so does Cortex, since v2.8.0.
- The protocol keeps moving: the July 28, 2026 specification release candidate adds a stateless protocol core, an Extensions framework, Tasks, MCP Apps, and hardened authorization.
Translation: MCP won. Integrations you configure today will outlive whatever tool you configure them in, which is exactly why an acquisition-proof toolchain should be built on it.
With ~10,000 servers, which ones matter?
For day-to-day development, a shortlist beats the catalog. These categories, with canonical picks, earn their place:
- GitHub: the single highest-value connection. The agent reads issues, inspects PRs, and checks CI status while it works, instead of you copy-pasting context into chat.
- A database server (Postgres, SQLite, MySQL): lets the agent inspect real schemas and query real data when writing migrations or debugging ORM code. Read-only credentials, always.
- Web fetch / search: pulls live documentation and error-message research into the loop.
- Browser automation (Playwright-based servers): the agent drives and verifies the web app it is building, not just claims it works.
- Error tracking (Sentry): "fix the top crash from production" becomes a one-line instruction when the agent can read the stack traces itself.
- Team tools (Slack, Linear, Notion): useful for context, "what did we decide about auth?", safest connected read-only.
Official servers also exist for Stripe, Figma, Cloudflare, Shopify, Salesforce, and hundreds more. Add them when a task actually needs them, not because they exist.
The security rules (read before connecting anything)
An MCP server is code that runs with access to your data, feeding content into an agent that edits your files. Three rules keep that safe:
- Only run servers you trust: official vendor servers, or widely-used open-source ones you can read. A malicious server can inject instructions into your agent's context.
- Least privilege: read-only tokens wherever possible, scoped API keys always, never an admin credential in an
mcpServersconfig. - Keep the agent's own guardrails on: tool results are untrusted input. Cortex's loop treats them that way, dangerous commands stay hard-blocked and diffs still pass the reviewer gate no matter what a connected tool says.
Connecting MCP servers in Cortex
Cortex speaks the same standard mcpServers JSON config used by Claude Desktop and Cursor. Paste any server's config into Settings → MCP Servers and the agent can use its tools directly in chat and in agentic loops. Connections retry automatically on flaky networks, and the panel shows live status per server. MCP connections are part of the Pro subscription ($5/month per seat) alongside hosted web search and embeddings; the BYOK IDE itself stays free. Setup details are in the docs.