Top community MCP servers and how to vet them

Community MCP servers are servers built by independent developers rather than by the vendor of the system they connect to. In September 2026 the ones worth installing fill gaps official servers leave: code intelligence (Serena, codebase-memory-mcp, Repomix), context cost (context-mode), databases (DBHub, Postgres MCP Pro), Kubernetes and n8n. Vet each one first.

A teammate posts a one-line curl | bash install for an MCP server with 44,900 GitHub stars. By lunch three people have run it. Nobody noticed that the script rewrote their Claude Code, Codex and Cursor configs, or that the repository is seven months old. No official vendor stands behind a community server, so your team is the only review it gets.

This page is for the developer who needs a server beyond the official set and the tech lead who approves changes to the team’s shared .mcp.json. For the full ranking of official and community servers together, see the top 30 MCP servers for software teams. New to MCP? Start with the introduction to Model Context Protocol.

What this community MCP shortlist gives you

• Ten community servers that do something no official server does, each with its package name, narrowest mode or safest setup, and a dated popularity signal.
• A 15-minute vetting routine with exact commands, and a vetting record your team can keep in the pull request.
• One full example (Repomix) installed in Claude Code, Codex and Cursor, and a plan-to-ship workflow for adding any community server to a team.
• The lookalike packages and broken install routes to avoid, and how to recover when a server misbehaves.

Which community MCP servers are worth installing?

Every row below was checked against its own repository and package registry on 2026-09-26. “Narrowest mode or safest setup” names the switch that limits what the server can reach, where one exists. Where none exists, the column says so and gives the setup that keeps the risk smallest: a read-only credential, a narrow scope or a safe install route. The spellings differ per server, and none is interchangeable. Rows are sorted by GitHub stars.

Server (maintainer)	What it adds	Package and route	Narrowest mode or safest setup	Stars	Deep page
Serena (Oraios)	Symbol-level code retrieval and editing through language servers	PyPI serena-agent, installed with uv tool install -p 3.13 serena-agent	No read-only switch. --project-from-cwd only selects the project; its editing tools stay on	★29.8k	Code intelligence MCP
codebase-memory-mcp (DeusData)	Persistent code knowledge graph and call-path tracing, fully local	Native binary via install script, or npm codebase-memory-mcp	No read-only switch. Runs locally with no API key; pass --skip-config to its install script so it edits no agent configs	★44.9k	Code intelligence MCP
Repomix (yamadashy)	Packs a local or remote repository into one file, then greps it	npm repomix, started with --mcp	--sandbox [dir] confines file tools to one root	★28.5k	Code intelligence MCP
context-mode (mksglu)	Runs commands outside the context window and returns summaries	Claude Code plugin with hooks, or npm context-mode	MCP-only install skips the hooks	★24.1k	Reducing MCP token cost
n8n-mcp (czlonkowski)	Designs, validates and deploys n8n workflows	npm n8n-mcp	Documentation tools only until you set N8N_API_URL and N8N_API_KEY	★23.0k	Integration hub MCP
dev-browser (Sawyer Hood)	Drives Chrome with short scripts; pages persist between calls	npm dev-browser; the MCP server exists only in dev-browser@next (1.0.0-rc.3)	No read-only switch (--headless only hides the window). Point it at development or test sites only	★6.6k	Browser automation
basic-memory (Basic Machines)	Persistent memory as local Markdown notes	PyPI basic-memory	No read-only switch. Notes stay in local Markdown files; keep them out of repositories with customer data	★4.0k	Memory plugins
DBHub (Bytebase)	One server for Postgres, MySQL, SQL Server, Oracle, MariaDB and SQLite	npm @bytebase/dbhub	Read-only mode, row limits and query timeout (see its README)	★3.6k	Database MCP
Postgres MCP Pro (Crystal DBA)	Index tuning, explain plans and health checks	PyPI postgres-mcp, run with uvx	--access-mode=restricted	★3.3k	Database MCP
Kubernetes MCP Server (containers org)	Native Go server for Kubernetes and OpenShift, multi-cluster	npm and PyPI kubernetes-mcp-server	read_only = true in its TOML config (pass the file with --config <path>)	★2.1k	Infrastructure MCP

Popularity as of 2026-09-26: GitHub stars, read from the GitHub API and repository pages for this site’s MCP research dossier. Stars measure attention on a repository, not use of the server. codebase-memory-mcp collected ★44.9k in the seven months after its repository was created on 2026-02-24, so treat stars as a filter, not a verdict. No npm or PyPI download counts appear here because those APIs were not read.

When does a community server beat an official one?

Prefer the vendor’s own remote server with OAuth whenever one exists: GitHub, Sentry, Linear, Atlassian, Supabase and most SaaS tools have one, and the MCP starter stack covers them. Reach for a community server only when one of these is true:

Situation	Community pick	Why an official server does not cover it
The agent burns context on grep-and-read in a large codebase	Serena or codebase-memory-mcp	No vendor ships symbol-level navigation as MCP
You must hand a whole unfamiliar repository to the model	Repomix	It packs and greps; nothing official does that
Test logs and command output flood the context	context-mode	It is a cost tool, not a capability
You need query tuning, not only queries	Postgres MCP Pro	It adds index tuning, explain plans and health checks on top of SQL access
One team runs several database engines	DBHub	One config instead of one server per engine
Your cluster is the target, not a cloud console	Kubernetes MCP Server	It works against any cluster in your kubeconfig, OpenShift included

Before you add any MCP server, ask whether a CLI plus a skill does the job with less context. Repomix and codebase-memory-mcp both have CLI modes, dev-browser is skill-first, and Playwright’s own README now says coding agents “might benefit from using the CLI+SKILLS instead” of its MCP server.

Vet a community MCP server in 15 minutes

Run these checks before the server reaches anyone’s config. The commands run in a terminal; Repomix stands in for the server you are vetting.

1. Confirm the package is the one the README names. Lookalike names are the most common trap: npm postgres-mcp is an unrelated package, and Postgres MCP Pro is the PyPI package of the same name.

   npm view repomix version repository.url time.modified
   curl -s https://pypi.org/pypi/postgres-mcp/json | jq '.info.version, .info.project_urls'

   The repository URL must match the repository whose README you read. postgres-mcp publishes no project URL (project_urls is null for 0.3.0, checked 2026-09-26), so confirm the package name from the install line in crystaldba/postgres-mcp’s README instead. A missing project URL is itself worth noting in the vetting record.

2. Check that someone still maintains it. Read the last release and the repository state.

   curl -s https://api.github.com/repos/yamadashy/repomix | jq '.pushed_at, .archived, .stargazers_count'

   A server with no release in a year is not disqualified, but you must pin it and own the risk. Postgres MCP Pro’s last PyPI release is 0.3.0 from 2025-05-16.

3. Read what the installer writes. Open any install script before you pipe it to a shell. codebase-memory-mcp’s script writes to the config of every agent it detects unless you pass --skip-config. Piped to a shell, the flag goes after bash -s --:

   curl -fsSL https://raw.githubusercontent.com/DeusData/codebase-memory-mcp/main/install.sh | bash -s -- --skip-config

   context-mode’s plugin adds hooks that steer the model. claude-mem’s installer asks you to sign in to its hosted memory by default.

4. Pin the version. Write repomix@1.18.1, not repomix@latest, so a new release cannot change your tool list overnight.

5. Turn on the narrowest mode. Use --sandbox for Repomix, --access-mode=restricted for Postgres MCP Pro and read_only = true for the Kubernetes server, which reads it from the TOML file you pass with --config. A server without a read-only switch gets a read-only credential instead.

   npx -y kubernetes-mcp-server@0.0.67 --config ./k8s-mcp.toml

6. Add it at local scope and measure the cost. In Claude Code, run /context in a fresh session, add the server with claude mcp add -s local, start a new session, run /mcp to see its tools, then /context again. The difference is the baseline each session pays.

7. List what the server exposes, locally. Write a scratch config that holds only the candidate server and point Snyk Agent Scan’s inspect at it. inspect prints tool, prompt and resource descriptions “without security verification” (snyk-agent-scan 0.6.8 --help); it is a listing, not a scan.

   cat > /tmp/candidate.json <<'JSON'
   { "mcpServers": { "repomix": { "command": "npx", "args": ["-y", "repomix@1.18.1", "--mcp", "--sandbox", "."] } } }
   JSON
   uvx snyk-agent-scan@latest inspect /tmp/candidate.json

   You can also pass ~/.claude.json, where local scope wrote the entry, but that file holds every server you use, and inspect offers to start all of them. To read the descriptions, inspect starts each stdio server it finds, so it runs the unvetted package. It asks for consent first; decline unless steps 1 to 5 passed, and never add --dangerously-run-mcp-servers, which skips that prompt. The verified scan is covered in securing MCP servers.

8. Record the result in the pull request that adds the server to the shared config, using the vetting record below.

Copy-paste prompt: vet a community MCP server

Vet the MCP server "repomix" before we add it to this repo's .mcp.json.
Do not install it or change any config. Using only read commands:
1. Run `npm view repomix version repository.url time.modified` and confirm the
   repository URL matches github.com/yamadashy/repomix.
2. Fetch https://api.github.com/repos/yamadashy/repomix and report pushed_at,
   archived and stargazers_count.
3. Read the README sections on MCP and security. List every flag that limits
   file or network access, and every file the install route writes.
4. Check whether an unrelated package with the same name exists on the other
   registry (PyPI if this is npm, npm if this is PyPI).
Output a filled-in vetting record in the format from docs/mcp-vetting.md, and end
with ADOPT, ADOPT WITH CONDITIONS or REJECT plus one sentence of reasoning.

Save the record format below as docs/mcp-vetting.md in your repository so the prompt and every reviewer use the same fields.

## MCP server vetting record
- Server and maintainer: repomix (yamadashy, community)
- Package and pinned version: npm repomix@1.18.1
- Repository matches package metadata: yes
- Last release / archived: 2026-09-21 / no
- What the install route writes: nothing outside the agent config entry
- Narrowest mode used: --sandbox . (run from the repo root)
- Credentials it receives: none
- Tools exposed (from /mcp): pack_codebase, read_repomix_output, grep_repomix_output,
  file_system_read_file, file_system_read_directory
- Context cost (fresh session, /context before and after): <tokens>
- Acceptance check and result: <prompt run, deterministic cross-check, pass or fail>
- Decision and owner: ADOPT WITH CONDITIONS, @tech-lead, re-vet on every version bump

Install Repomix in Claude Code, Codex and Cursor

Repomix is a good first community server: npm-only, no credentials, and a sandbox flag. The Claude Code and Codex lines below were run on Claude Code 2.1.283 (the latest channel on 2026-09-26) and codex-cli 0.157.1.

Claude Code

# Project scope writes .mcp.json at the repo root; teammates approve it on first run
claude mcp add -s project repomix -- npx -y repomix@1.18.1 --mcp --sandbox .
claude mcp get repomix

Codex

# Writes [mcp_servers.repomix] to ~/.codex/config.toml
codex mcp add repomix -- npx -y repomix@1.18.1 --mcp --sandbox .
codex mcp get repomix

Cursor

// .cursor/mcp.json (project) or ~/.cursor/mcp.json (global)
{
  "mcpServers": {
    "repomix": { "command": "npx", "args": ["-y", "repomix@1.18.1", "--mcp", "--sandbox", "."] }
  }
}

--sandbox . confines the file tools to the directory the server starts in, which is the repository root when you launch the agent there. Sandboxed, the server exposes five tools: pack_codebase, read_repomix_output, grep_repomix_output, file_system_read_file and file_system_read_directory (listed by a tools/list call to repomix@1.18.1 --mcp --sandbox . on 2026-09-26). Without --sandbox, its README says the server “can read any path the host user can”.

The sandbox also removes pack_remote_repository, generate_skill and attach_packed_output. To study public repositories, as the next prompt does, add an optional second entry at user scope, never in the shared .mcp.json, and use it only in sessions that do not touch private code:

claude mcp add -s user repomix-public -- npx -y repomix@1.18.1 --mcp

Copy-paste prompt: study a third-party repository with Repomix

Use the repomix-public MCP server. Pack github.com/honojs/hono with compress on and
includePatterns "src/**". Then grep the packed output for how middleware
ordering works and explain it in under 200 words, citing the file paths you
found. Do not clone the repository into this project.

You should see the agent call pack_remote_repository with compress: true, then grep_repomix_output, and answer with file paths you can open on GitHub. If it reads files one by one instead, the server is not connected: run claude mcp get repomix-public.

Add a community server to a team: plan, build, verify, review, ship

A community server enters the team’s config the same way code does: as a reviewed change with an acceptance check. Here the job is “answer structural questions about our monorepo without grep-and-read loops”, and the candidate is codebase-memory-mcp.

1. Plan. Write the job and the acceptance check before installing anything: “The agent lists every inbound caller of OrderService.applyDiscount and every HTTP route that reaches it, and the list matches a text search.” A check that a script can confirm is what lets you skip reading the agent’s reasoning.

2. Build. Install the binary globally without letting it touch configs, then add it at local scope from the worktree you test in. The global install is shared by every worktree; only the local-scope entry below is tied to this one.

   npm install -g codebase-memory-mcp@0.11.0

   Claude Code

   claude mcp add -s local codebase-memory -- codebase-memory-mcp

   Codex

   # No scope flag: writes to the user-level ~/.codex/config.toml
   codex mcp add codebase-memory -- codebase-memory-mcp

   Cursor

   // ~/.cursor/mcp.json while testing; the project .cursor/mcp.json is tracked, so it waits for the PR
   {
     "mcpServers": {
       "codebase-memory": { "command": "codebase-memory-mcp", "args": [] }
     }
   }

   The npm package’s postinstall step downloads the native binary from GitHub Releases; it does not run the install command that edits agent configs (checked in 0.11.0). If which codebase-memory-mcp prints a path, the entry works as written.

3. Verify. Run the acceptance prompt below. The agent cross-checks its own graph answer against rg, so you compare two lists instead of reading code. Record the /context difference.

4. Review. Promote the entry to project scope, which writes .mcp.json:

   claude mcp remove codebase-memory -s local && claude mcp add -s project codebase-memory -- codebase-memory-mcp

   In Cursor, move the entry into the committed .cursor/mcp.json. Open a pull request that changes .mcp.json and includes the vetting record. The reviewer checks the record and the acceptance result, not the server’s source.

5. Ship. After merge, each developer approves the project server on first run. Until then, Claude Code shows it as “Pending approval” and does not connect to it (claude mcp --help, Claude Code 2.1.283, latest channel). Re-run the acceptance prompt on every version bump.

Copy-paste prompt: acceptance check for a code-intelligence server

Use the codebase-memory MCP server. Index this repository, then trace every
inbound caller of OrderService.applyDiscount and list the HTTP routes that
reach it. Next, run `rg -n "applyDiscount\(" --type ts` and compare: list any
caller the graph found that rg did not, and any rg hit the graph missed.
Report PASS only if both lists match or every difference is explained
(comments, tests, dynamic dispatch). Change no files.

The next prompt assumes a Postgres MCP Pro server named postgres, pointed at staging in restricted mode. Add it at local scope first; the connection string holds a credential, so it never goes in .mcp.json or a project .cursor/mcp.json. codex mcp add has no scope flag and always writes to the user-level ~/.codex/config.toml:

Claude Code

claude mcp add postgres -e DATABASE_URI=postgresql://user:pass@staging-host:5432/db -- uvx postgres-mcp@0.3.0 --access-mode=restricted

Codex

codex mcp add postgres --env DATABASE_URI=postgresql://user:pass@staging-host:5432/db -- uvx postgres-mcp@0.3.0 --access-mode=restricted

Cursor

// ~/.cursor/mcp.json (global): it holds a credential, so keep it out of the repository
{
  "mcpServers": {
    "postgres": {
      "command": "uvx",
      "args": ["postgres-mcp@0.3.0", "--access-mode=restricted"],
      "env": { "DATABASE_URI": "postgresql://user:pass@staging-host:5432/db" }
    }
  }
}

Index tuning and slow-query analysis need the pg_stat_statements and hypopg extensions on the target database (Postgres MCP Pro README). Managed Postgres services usually ship both, so a user with the right privileges only has to create them:

CREATE EXTENSION IF NOT EXISTS pg_stat_statements;
CREATE EXTENSION IF NOT EXISTS hypopg;

Copy-paste prompt: index advice from Postgres MCP Pro in restricted mode

Use the postgres MCP server, which runs with --access-mode=restricted against
staging. Find the five slowest queries, run EXPLAIN on each, and recommend
indexes with the expected effect. Write the indexes as a new migration file
under db/migrations/ and do not apply it. Then try one CREATE INDEX through the
server and confirm it is rejected, so we know restricted mode is on.

How do you prove a community server is doing its job?

You do not read the server’s source or every tool call. You rely on four checks that a machine or a short comparison can settle:

• An acceptance prompt with a deterministic cross-check. Graph answers are compared with rg, index advice with EXPLAIN, and cluster diagnoses with kubectl get events. The agent reports PASS or FAIL and the differences.
• A failed write in read-only mode. Ask the agent to attempt one write through the server and expect an error. If the write succeeds, the narrowest mode is not on.
• A context budget. Record the /context cost in the vetting record and reject a server whose tools take more than the job is worth; reducing MCP token cost shows the alternatives.
• The normal gates for code it helps write. A server that feeds the agent context does not replace tests, type checks and review; any code change still passes them. The tech lead signs off on the vetting record, and the change author owns the acceptance result.

Which community packages and routes should you avoid?

Traps checked on 2026-09-26

• npx postgres-mcp runs an unrelated npm package. Postgres MCP Pro is PyPI: uvx postgres-mcp --access-mode=restricted.
• serena on npm and on PyPI are both unrelated. The real package is PyPI serena-agent. Serena’s README says: “Do not install Serena via an MCP or plugin marketplace!” The serena plugin in claude-plugins-official still uses the route it warns against.
• PyPI repomix is unrelated; Repomix is npm-only.
• n8n-mcp-server on npm is a different, deprecated package. The real one is n8n-mcp.
• npm install -g dev-browser installs 0.2.9, which has no mcp subcommand. The MCP server needs dev-browser@next.
• @leval/mcp-grafana is a community port. Grafana’s official server is PyPI mcp-grafana.
• docker-mcp on npm is a community package, not Docker’s. Docker’s gateway is the docker mcp CLI plugin.
• Desktop Commander targets Claude Desktop. In Claude Code, Codex and Cursor it duplicates built-in terminal and file tools and widens the permission surface.

What breaks with community MCP servers, and how do you recover?

An installer rewrote every agent config. codebase-memory-mcp’s script edits each agent config it detects and can add hooks and a skill. Run codebase-memory-mcp uninstall, diff ~/.claude.json, ~/.codex/config.toml and ~/.cursor/mcp.json against a backup, then reinstall with bash -s -- --skip-config or from npm and add the server by hand.

A marketplace plugin runs an outdated command. The serena plugin starts Serena with uvx --from git+https://github.com/oraios/serena. Uninstall the plugin, install with uv tool install -p 3.13 serena-agent, and add the server with claude mcp add --scope user serena -- serena start-mcp-server --context claude-code --project-from-cwd.

dev-browser mcp fails with unrecognized subcommand 'mcp'. You have 0.2.9. Install dev-browser@next, or use the skill route (dev-browser install-skill --claude), which needs no MCP server.

The server reads outside the project. Repomix without --sandbox can read any path your user can. Re-add it with --sandbox and the repository root, then ask the agent to read ~/.ssh/config through the server; the call must fail.

A server quietly sends data to a hosted service. claude-mem asks you to sign in to hosted memory unless you pass an explicit --provider or set CLAUDE_MEM_ONLINE_OPTIN=false. context-mode’s ctx_insight tool opens a hosted dashboard at context-mode.com. Decide whether that is acceptable before the server reaches a repository with customer data.

The agent edits a production n8n workflow. n8n-mcp’s README says: “NEVER edit your production workflows directly with AI!” Point N8N_API_URL at a development instance, ask for new workflows to be created inactive, and export backups first.

Releases stall. Pin the last good version, add a calendar reminder to re-check, and name a replacement in the vetting record: for Postgres MCP Pro, DBHub or Google’s MCP Toolbox for Databases.

Context use creeps up as servers accumulate. With tool search on by default (Claude Code, Codex 0.143.0+), full schemas load on demand, but server instructions and tool names still cost tokens every session. Measure with /context and remove servers the current task does not need; see MCP best practices for per-project scoping.

Where to go next with community MCP servers

Top 30 MCP servers for software teams The full ranking of official and community servers, with install lines and read-only switches.

MCP servers that understand your codebase Serena, codebase-memory-mcp, Claude Context and Repomix in depth, with a safe refactor.

Securing and hardening MCP servers Full config scans, prompt-injection containment and a team approval policy.

MCP registries and gateways Allowlist the servers your organization has vetted, per tool.