MCP Servers for AI Builders: Maintainer and Reference Projects
Seven MCP servers for repositories, browsers, databases, local files and infrastructure, sorted by job, with the permission settings to check first.
An MCP server is a small program that lets an AI app use an outside tool: your GitHub repositories, a browser, a database, your files. This page lists seven you can inspect, sorted by the job, and the safest way to start with any of them is read-only on a throwaway project.
A server only hands the AI new abilities. It doesn't decide whether an action is a good idea for your project. Each project here comes from the tool's own maintainer or is a reference server. Being on the list isn't a security certification.
Last verified Sep 17, 2026. Recheck target: monthly. The CSV holds all 7 entries.
Start with five
GitHub for repositories, Playwright for driving a browser, Context7 for up-to-date library docs, Supabase for databases, and the Filesystem server for local files.
GitHub's own server for working with repos, issues and pull requests. Start with read-only access and turn on only the toolsets and repos the task needs.
Lets an agent look at and click through web apps using Playwright. Browser control can submit forms and see anything you're signed into, so give it a separate browser setup just for the task.
Upstash's project for pulling the docs for a specific library and version. Check that the examples it returns match the version you actually have installed.
Good for checking a Supabase project's tables and data. Start with one project, read-only queries and only the database and docs tools. Which account and deployment tools you get depends on the access you grant.
A working example of an MCP server that reads and writes files, worth studying to see how one is built. Limit it to specific folders and give it read-only test files at first. It's a reference example, not a managed storage service.
The directory
GitHub's own server for working with repos, issues and pull requests. Start with read-only access and turn on only the toolsets and repos the task needs.
README inspected at commit 85598ba6e125; the repository was not archived when checked. The activity date is the default branch commit timestamp, not a release date or a reproduced integration test.
Lets an agent look at and click through web apps using Playwright. Browser control can submit forms and see anything you're signed into, so give it a separate browser setup just for the task.
README inspected at commit ea43eee0d951; the repository was not archived when checked. The activity date is the default branch commit timestamp, not a release date or a reproduced integration test.
The Chrome team's server for debugging pages and checking performance. Page content, console output and network details can hold sensitive data, so handle them that way.
README inspected at commit 23b9a480010d; the repository was not archived when checked. The activity date is the default branch commit timestamp, not a release date or a reproduced integration test.
Upstash's project for pulling the docs for a specific library and version. Check that the examples it returns match the version you actually have installed.
README inspected at commit dedb03d589e6; the repository was not archived when checked. The activity date is the default branch commit timestamp, not a release date or a reproduced integration test.
Pick the one Cloudflare server and the account access the task needs. Some tools can read or change your infrastructure, so check exactly what each one is allowed to do.
The pinned README separates domain-specific servers from the broader Code Mode server in cloudflare/mcp. It documents Streamable HTTP; /sse is a compatibility URL, not legacy HTTP+SSE support. Activity is the default-branch commit date.
Good for checking a Supabase project's tables and data. Start with one project, read-only queries and only the database and docs tools. Which account and deployment tools you get depends on the access you grant.
Official docs and the pinned README support project_ref, read_only=true and feature groups. The current maintainer repository is supabase/mcp. No database connection or query was performed.
A working example of an MCP server that reads and writes files, worth studying to see how one is built. Limit it to specific folders and give it read-only test files at first. It's a reference example, not a managed storage service.
The MCP repository identifies this as a reference server. Its filesystem README describes allowed directories, reads and writes; tool hints alone are not filesystem access enforcement. The activity date belongs to the shared server repository.
Choose a server by what you need it to do
For questions about a repository, look at which toolsets GitHub's server offers. For testing a web page, know the difference between Playwright, which clicks and types in a browser, and Chrome DevTools, which diagnoses what the page is doing. For a question about a library's API, pull version-specific docs through Context7. For infrastructure, pick the specific Cloudflare service you need instead of handing over your whole account by default.
For a database, Supabase's current setup guide documents three separate controls. project_ref picks a project, read_only=true limits SQL to read queries, and features limits which groups of tools are available. Picking a project doesn't turn on read-only mode.
For local files, the Filesystem reference server only works inside directories you allow. Start with a small test folder that has no secrets in it. If the test shouldn't write anything, make the folder read-only at the operating-system level. A tool labeled read-only is only describing itself. It isn't a lock.
Cloudflare's README now separates its broader Code Mode server from smaller servers for docs, builds, observability and other services. Pick the one you need. If your app's setup expects the older HTTP+SSE connection type, check the transport even if the URL still ends in /sse.
Before connecting a project
Read the maintainer's install steps, how it signs in, which connection types it supports, and what permissions it asks for. Pin a version where you can, and review the changes before you upgrade. Start with a throwaway project or a read-only scope, and one concrete task.
A good test checks more than whether a tool returns text. A blocked action should fail clearly. The tool should act on the repository or account you meant. And the app should show you a proposed change before it does anything you can't undo.
Treat text that comes back from repositories, websites and documents as data for the task, not as instructions to do more.
The official MCP registry is another place to find servers. A listing there doesn't replace reading the maintainer, package and permission details. The MCP architecture documentation explains how the app, the client and the server fit together.
For an introduction to the protocol itself, read what MCP is. For a framework that uses these tools, see the agent repository directory.
Change log
Expanded to seven projects with database and local-file use cases. Checked pinned maintainer READMEs and clarified Cloudflare transport/server selection and Supabase project/read-only scoping.
Initial selection of 5 primary-source entries, reviewed for identity and scope. Cadence describes how to recheck; no claim that every example was reproduced.
Follow changes to every directory with the directory changes RSS feed.