How to choose an MCP server for Claude

There are a lot of MCP servers — one directory index put it near twenty thousand in August 2026 — and almost none of the advice about them tells you how to judge one. Connecting a server gives an assistant the ability to read and change things in that service with your permissions, so this is a decision worth two minutes.

This page is about how to choose, not a ranking. Any list of names here would be out of date within weeks, and recommending servers we had not checked ourselves would be the very mistake the rest of this page warns about.

Where servers come from

• Claude’s connector directory. Submissions are scanned for policy compliance and listed as Community. Anthropic may escalate ones that look highly useful to Verified, a slower review where someone functionally tests each tool.
• A URL someone gives you — a custom connector. No review at all. Anthropic is explicit that these let you connect Claude to services it has not verified.
• A local server you run yourself over STDIO, usually from a repository. It runs on your machine with your files and your credentials.

The important nuance: a directory listing is not a security audit. Anthropic reviews against listing criteria and says plainly that it does not security-audit or manage the servers. The label is a quality signal; it does not change how the server behaves once connected.

What to check before connecting

1. Who runs it, and would you give them an account? A server is an intermediary between your assistant and your data. Anthropic’s own guidance is to connect only to servers built and hosted by organisations you trust. If you would not sign up for the service, do not connect its server.
2. Read the permissions at the sign-in screen. Most remote servers use OAuth, so you sign in to the service and grant access without the assistant seeing your password. Narrow the scopes if you can, and refuse if it asks for more than its job needs.
3. Look at the tool list before you use it. Good servers separate reading from writing and describe each tool narrowly and accurately — that is in the review criteria. A server with one vague do-everything tool is a server whose behaviour you cannot predict.
4. Prefer servers that ask before destructive actions. Deciding which tools may run without asking is your client’s job and yours. Keep “always allow” for tools that only add.
5. Know how to get your data out, and how to revoke. Disconnecting in Claude’s settings, or in the service’s own security settings, ends the access.
6. On Team and Enterprise, check whether the credential is shared. Some connectors use one fixed API key for everyone who uses them, so scope that key to what members should reach.

Two risks people underestimate

Prompt injection. A malicious server can hide instructions that try to make the assistant do something you did not ask for. Claude has protections, but they are not a guarantee — watch what tools say they did, and connect only to servers you trust.

Tools changing under you. A server you vetted in March is not necessarily the server you are using in October. Developers update tool behaviour, and nothing re-asks your permission when they do. If a connector starts behaving differently, disconnect first and investigate after.

If you find a genuinely malicious server, Anthropic takes reports through its vulnerability disclosure programme.

Local or remote?

Remote servers are a URL and a sign-in: nothing to install, they work from Claude on the web, desktop and mobile, and the operator handles updates. Local servers run on your machine — better when the data should never leave it, and the only option for things like your own filesystem — but you run and update them, and they only work where they are installed.

A reasonable starting set

Rather than collecting servers, start from what you repeat by hand every week. Most people need very few: something for the place their work lives, something for the records they keep, and nothing else. Each connected server widens what an assistant can reach when something goes wrong, so a short list is a feature.

Disclosure: Sambandh is one of these — a remote MCP server that keeps contacts, deals and follow-ups for one person. If you want to see it judged by the checklist above, the tools reference lists every tool and whether it reads or writes, and the live demo shows real data without a sign-up. We are not claiming it is the server you need; we are claiming you should be able to check.

New to the protocol itself? Start with what MCP is.

Sources: Anthropic’s software directory policy, its connector review criteria and its custom connector guidance, as published in October 2026. Where this page and Anthropic disagree, they are right.