15 Best MCP Servers for Enterprise Teams in 2026, by Use Case

Last updated October 14, 2026. Endpoints, auth methods, release dates, and limits were checked against each vendor’s docs, changelogs, and repositories on that date.

The best MCP servers for enterprise teams in 2026 are the vendor-hosted ones that sit on systems you already govern: GitHub, Atlassian Rovo, Slack, Salesforce, and the AWS MCP Server lead their categories. Sentry, Playwright, Linear, Notion, HubSpot, Stripe, MCP Toolbox for Databases, Snowflake, Brave Search, and the Filesystem reference server each win a narrower job.

An MCP server is a program that exposes tools, data, or prompts to AI agents through the Model Context Protocol, so one client such as Claude, Cursor, or ChatGPT can call many systems through the same interface. This guide groups 15 MCP servers by use case and sits in the MCP and Agent Protocols hub under the MCP topic. Placement is unpaid, per our editorial standards and disclosure policy.

Choosing is harder than it looks. A third-party crawl counted 38,212 servers in the official MCP Registry on October 1, 2026, and most enterprise risk comes from picking an unofficial wrapper when the vendor already ships a hosted server with OAuth and admin controls.

15 Best MCP Servers at a Glance

Match each MCP server to the system your agent must read or change, then check how it authenticates and whether it can run read-only. The table groups the 15 picks by use case. Hosted servers trade local control for zero infrastructure, while local servers keep traffic on your machine but need tokens or credentials on disk.

MCP server	Use case	Hosting	Auth	Least-privilege control
GitHub MCP Server	Repos, PRs, Actions, security alerts	Hosted or local	OAuth or PAT	Toolsets, /readonly, lockdown mode
Sentry MCP	Errors, traces, issue triage	Hosted or local	OAuth	Org and project scoped URLs
Playwright MCP	Browser automation and testing	Local or Docker	None (local)	Capability flags such as --caps
Linear MCP	Issues, projects, cycles	Hosted	OAuth 2.1 or API key	/mcp/readonly or read scope
Atlassian Rovo MCP	Jira, Confluence, Bitbucket, Loom	Hosted	OAuth 2.1 or API token	Domain allowlists, audit logs
Notion MCP	Docs, wikis, databases	Hosted	OAuth only	Workspace permissions
Slack MCP	Channels, threads, canvases	Hosted	OAuth via approved apps	Granular search:read.* scopes
Salesforce Hosted MCP	CRM data, flows, Apex, Agentforce	Hosted	OAuth	Org permissions, per-server tools
HubSpot MCP	CRM records and activities	Hosted	OAuth 2.1 with PKCE	User permissions, sensitive-data block
Stripe MCP	Payments, billing, refunds	Hosted	OAuth or Agent API key	Human confirmation on refunds
MCP Toolbox for Databases	SQL and NoSQL databases	Local or self-hosted	DB credentials or IAM	Custom tools in tools.yaml
Snowflake-managed MCP	Governed warehouse answers	Hosted in Snowflake	Snowflake or External OAuth	RBAC per tool, read-only SQL default
AWS MCP Server	AWS APIs and docs	Hosted (8 Regions)	IAM SigV4 via proxy	IAM context keys, SCPs
Brave Search MCP	Web, news, local search	Local	Brave API key	Tool selection
Filesystem (reference)	Local file read and write	Local	None (local)	Allowed directories only

How We Picked These 15 MCP Servers

We kept servers that a security team can approve: official or vendor-maintained code, a documented auth model, and a public changelog or release history. Community wrappers around the same APIs were left out when the vendor ships its own server. Every pick had a docs page or repository we could capture on October 14, 2026.

• Ownership: built and maintained by the system’s vendor, or by the MCP project itself for reference servers.
• Authentication: OAuth 2.1, scoped tokens, or cloud IAM, with a clear way to revoke access.
• Least privilege: read-only modes, toolset filters, scoped URLs, or per-tool permissions.
• Auditability: admin approval, audit logs, or cloud-native trails such as CloudTrail.
• Transport: Streamable HTTP for hosted servers, with deprecated SSE endpoints flagged.
• Use-case coverage: one strong pick per job, so the list maps to real enterprise workflows.

We did not run paid load tests, so there are no star ratings. Discovery started in the official MCP Registry, which is still in preview, verifies publisher namespaces through GitHub or DNS, and delegates code scanning to npm, PyPI, and downstream aggregators.

Code and Delivery MCP Servers

Engineering teams get the fastest return from MCP servers that sit on the code, error, and issue systems their agents already touch every day. These four servers cover repositories, production errors, browser automation, and planning. GitHub, Sentry, and Linear all run hosted endpoints, so a coding agent can connect with OAuth instead of a long-lived token in a config file.

1. GitHub MCP Server: Repos, Pull Requests, and CI

The GitHub MCP Server is the official server for repositories, issues, pull requests, Actions, and security alerts, and the first MCP server most engineering teams should approve. It is MIT-licensed, written in Go, and runs either locally or as a hosted endpoint at https://api.githubcopilot.com/mcp/ with OAuth, per the GitHub MCP Server repository.

Control comes from toolsets. The default set is context, issues, pull_requests, repos, and users, and the remote server docs let you pick others with the X-MCP-Toolsets header or a /x/{toolset} path. Adding /readonly strips write tools, and the configuration guide documents a lockdown mode through X-MCP-Lockdown.

• Best for: platform and developer-experience teams that want agents to triage issues, review pull requests, and read CI logs.
• Setup and auth: OAuth on the hosted server; GitHub Enterprise Cloud with data residency uses a copilot-api.SUBDOMAIN.ghe.com/mcp URL.
• Watch out for: GitHub Enterprise Server does not support the hosted endpoint, so GHES shops must run the local server with GITHUB_HOST set.

2. Sentry MCP: Production Errors in the Agent Loop

Sentry MCP lets a coding agent search errors, inspect traces, and triage issues in the same session where it writes the fix. The hosted endpoint is https://mcp.sentry.dev/mcp, every connection uses OAuth, and you can scope the URL to one organization or one project, per the Sentry MCP docs.

Scoping is the least-privilege lever. A project-scoped URL defaults every tool to that project and hides discovery tools the agent does not need. The open-source repository also ships a stdio mode for self-hosted Sentry, though Seer analysis is left out there because Seer is not part of self-hosted Sentry.

• Best for: teams that already route errors to Sentry and want agents to move from stack trace to patch faster.
• Setup and auth: OAuth on the hosted server; stdio mode with a User Auth Token for self-hosted installs.
• Watch out for: the AI-powered search tools need an LLM provider key such as OpenAI, Azure OpenAI, Anthropic, or OpenRouter, and the npm package ships under the FSL-1.1-ALv2 license.

3. Playwright MCP: Browser Automation Without Vision Models

Playwright MCP gives agents a real browser through structured accessibility snapshots, so they click and type by element reference instead of guessing from screenshots. Microsoft maintains it under Apache 2.0, it needs Node.js 18 or newer, and version 0.0.83 shipped on September 28, 2026, per the Playwright MCP repository and releases.

Optional capabilities such as vision, pdf, and devtools are off until you pass them with --caps, which keeps the default tool list short. The README is candid about token cost: it recommends the Playwright CLI with Skills for high-throughput coding agents, and keeps MCP for long-running, exploratory, or self-healing test loops.

• Best for: QA and automation teams that need agents to test web apps, fill forms, or reproduce UI bugs.
• Setup and auth: local npx @playwright/mcp@latest or a Docker image, which supports headless Chromium only.
• Watch out for: browser sessions can reach anything the host can reach, so run it in an isolated container for untrusted sites.

4. Linear MCP: Planning and Issue Tracking

Linear MCP is a hosted server that lets agents find, create, and update issues, projects, and comments, with a dedicated read-only endpoint for safer rollouts. It runs on Streamable HTTP at https://mcp.linear.app/mcp and uses OAuth 2.1 with dynamic client registration, or a bearer token or API key, per the Linear MCP docs.

Read-only access has two paths: connect to /mcp/readonly, or request only the read OAuth scope so the token cannot reach write APIs. A February 2026 update added initiatives, project milestones, and project updates, and Okta customers can turn on enterprise-managed authorization so clients sign users in under existing access policies.

• Best for: product and engineering teams that want agents to turn specs or standup notes into tracked work.
• Setup and auth: OAuth 2.1 for interactive clients; API keys with only the Read permission for read-only automation.
• Watch out for: each Linear workspace needs its own auth context, and the SSE endpoint is deprecated.

Knowledge and Collaboration MCP Servers

Knowledge servers decide whether an agent answers from your real specs and conversations or from stale training data. Atlassian, Notion, and Slack all run hosted MCP servers that respect existing permissions, so an agent sees only what the signed-in user can already see. The trade-off is admin work: each one has its own approval model and scope list.

5. Atlassian Rovo MCP Server: Jira, Confluence, and More

The Atlassian Rovo MCP Server is the broadest knowledge server on this list, exposing Jira, Confluence, Jira Service Management, Bitbucket, Compass, Loom, and Teamwork Graph data to outside AI clients. Atlassian took it to general availability on February 4, 2026, per its GA announcement, and new setups should use https://mcp.atlassian.com/v2/mcp.

Authentication uses OAuth 2.1 or API tokens, and every action follows the user’s existing access, per the Atlassian MCP Server repository. GA added audit logs for tool calls, admin choices to allow or block AI client domains, and respect for IP allowlists. The changelog notes a ?tools=all flag that returns a flat tool list in pages of 50 for teams that front servers with an MCP gateway.

• Best for: enterprises standardized on Jira and Confluence that want agents to draft pages and create linked epics.
• Setup and auth: OAuth 2.1 sign-in with scope consent, or API tokens for service use.
• Watch out for: the legacy /v1/sse endpoint lost support after June 30, 2026, and v1 connections move to v2 tools on March 1, 2027.

6. Notion MCP: Docs, Wikis, and Databases

Notion MCP is the hosted, actively maintained server for reading and updating pages, databases, and comments in a Notion workspace. It runs at https://mcp.notion.com/mcp on Streamable HTTP with an SSE fallback, and it works with Claude Code, Cursor, Codex, VS Code, and Devin, per the Notion MCP setup guide.

Notion says its older open-source notion-mcp-server package is no longer actively maintained, so new rollouts should use the hosted server. A notion-create-file-upload tool handles images and files up to 20 MiB, and Devin can share one organization-level connection backed by a Notion service account.

• Best for: teams whose specs, runbooks, and meeting notes live in Notion.
• Setup and auth: OAuth only; each user authorizes the workspace they want to expose.
• Watch out for: Notion MCP does not yet support non-interactive authorization, so fully headless pipelines still need the API.

7. Slack MCP Server: Conversations as Agent Context

The Slack MCP server lets approved AI clients search channels, read threads, send messages, and create canvases with the signed-in user permissions. Slack made it generally available on February 17, 2026, alongside the Real-time Search API, per the Slack developer changelog.

Governance is stricter than most servers. Only apps published in the Slack Marketplace and internal apps can use MCP, unlisted apps are prohibited, and workspace admins approve every MCP client integration, per the Slack MCP server overview. Search access splits into search:read.public, plus private channel, DM, and group DM scopes that each need user consent.

• Best for: companies where decisions and incident history live in Slack threads.
• Setup and auth: JSON-RPC 2.0 over Streamable HTTP through an approved app or a partner client such as Claude, Cursor, or Perplexity.
• Watch out for: the archived reference Slack server is now community-maintained by Zencoder, so do not confuse it with Slack’s own server.

Revenue and Payments MCP Servers

Revenue systems carry the highest blast radius, so the best MCP servers here are the vendor-hosted ones with permission enforcement and human checkpoints built in. Salesforce, HubSpot, and Stripe all host their servers and require OAuth or scoped keys. Each also limits what agents can write, which matters more here than in any other category.

8. Salesforce Hosted MCP Servers: CRM Logic for Any Client

Salesforce Hosted MCP Servers expose org data, flows, Apex actions, and queries to any MCP client while Salesforce handles hosting, authentication, and permission checks. They became generally available on April 29, 2026 for Enterprise Edition orgs and above, per the Salesforce Developers blog.

Prebuilt standard servers cover the Agentforce 360 Platform, Tableau Next, and Data 360 SQL. Custom servers publish your own flows, Apex actions, and Named Query APIs, and a May 2026 guide shows production URLs following https://api.salesforce.com/platform/mcp/v1/custom/NAME. Agentforce agents can also be exposed as tools, though only agents built with the new Agent Script Builder qualify, per the Agentforce docs.

• Best for: Salesforce-centric enterprises that want Claude, ChatGPT, or Slackbot to act on CRM records without custom APIs.
• Setup and auth: OAuth with a client ID and the server URL, turned on in Setup.
• Watch out for: Enterprise Edition or higher is required, and legacy Agentforce agents must be upgraded before they can be MCP tools.

9. HubSpot MCP Server: CRM Reads and Writes

The remote HubSpot MCP server gives AI clients read and write access to CRM records and activities through a HubSpot-hosted connection. It left beta and became available to all HubSpot accounts on April 13, 2026, at https://mcp.hubspot.com, per the HubSpot developer changelog.

Reads cover contacts, companies, deals, tickets, quotes, invoices, campaigns, landing pages, blog posts, and activity history. Writes cover contacts, companies, deals, tickets, line items, products, and activities such as calls, notes, tasks, and meetings. Setup starts with an MCP Auth App under Development, and every action follows the user’s existing HubSpot permissions.

• Best for: sales and RevOps teams that want agents to log activities and update deals from a conversation.
• Setup and auth: OAuth 2.1 with PKCE is mandatory for every connection.
• Watch out for: accounts with sensitive data turned on lose access to activity objects through MCP, even though the standard CRM APIs still reach them.

10. Stripe MCP Server: Payments With Human Checkpoints

Stripe MCP lets agents query and change Stripe data through a hosted server at mcp.stripe.com, with human confirmation required before sensitive writes such as refunds. It keeps the tool list small by routing most of the API through stripe_api_read and stripe_api_write, per the Stripe MCP docs.

Interactive clients should use OAuth, which lets you grant access per live account or sandbox and revoke sessions from the Dashboard. Autonomous clients need an Agent API key, and the deadline is close: from October 31, 2026, Stripe MCP rejects full-access secret keys and restricted keys without the Agent tag with a 401 response.

• Best for: finance, support, and billing teams that want agents to look up customers, invoices, and disputes.
• Setup and auth: OAuth for people; Agent API keys for headless agents; a Stripe-Account header for Connect platforms.
• Watch out for: refund and outbound payment approvals expire after 24 hours, and connected-account calls cannot use OAuth.

Data and Analytics MCP Servers

Data servers split into two jobs: direct database access for builders, and governed answers for business users. MCP Toolbox for Databases covers the first job across 20+ engines. Snowflake’s managed server covers the second by putting Cortex Agents, semantic views, and RBAC between the agent and raw tables, which is the safer default for analytics.

11. MCP Toolbox for Databases: One Server for 20+ Engines

MCP Toolbox for Databases is Google’s open-source MCP server and tools framework for connecting agents to PostgreSQL, BigQuery, MySQL, MongoDB, Snowflake, and more than a dozen other databases. It reached its first stable release, v1.0.0, on April 10, 2026, per the release notes, and the docs reference v1.14.0 in October 2026.

Run it with a flag such as --prebuilt=postgres for generic tools like list_tables and execute_sql, or define narrow, parameterized tools in tools.yaml for production agents. The Toolbox docs list connection pooling, IAM auth, OpenTelemetry metrics and traces, and support for MCP spec versions from 2024-11-05 to 2026-07-28.

• Best for: data and platform teams that need one governed path from agents to many databases.
• Setup and auth: local binary, container, or Homebrew; credentials or IAM per data source.
• Watch out for: the prebuilt execute_sql tool is broad, so production agents should get custom tools instead. The old reference PostgreSQL server is archived.

12. Snowflake-Managed MCP Server: Governed Warehouse Answers

The Snowflake-managed MCP server exposes Cortex Agents, Cortex Analyst, Cortex Search, SQL, and custom functions as MCP tools without any extra infrastructure. It has been generally available since November 4, 2025, per the release note, and it is created with a CREATE MCP SERVER statement.

Snowflake’s own docs recommend exposing one Cortex Agent as the client-facing tool, so semantic views and verified queries cannot be bypassed. The SQL execution tool defaults to read_only: true, each tool needs its own grant, and External OAuth can bind servers to Okta or Microsoft Entra ID.

• Best for: analytics teams that want business users in Claude or ChatGPT to query governed data.
• Setup and auth: Snowflake OAuth by default, or External OAuth; no dynamic client registration.
• Watch out for: each server holds at most 50 tools, generic and SQL responses truncate at 250 KB, and only tool capabilities are supported.

Cloud, Web, and Local MCP Servers

The last three picks give agents reach beyond business apps: cloud APIs, the live web, and the local file system. The AWS MCP Server is hosted and IAM-governed. Brave Search and the Filesystem reference server run locally, which keeps them simple but moves credential and sandbox duty to your team.

13. AWS MCP Server: Every AWS API Behind IAM

The AWS MCP Server is a managed remote server that gives agents authenticated access to more than 15,000 AWS API operations through a small, fixed tool set. AWS announced general availability on May 6, 2026, with no extra charge for the server itself, per the AWS News Blog.

The core tools are call_aws, search_documentation, read_documentation, and run_script, which runs short Python in a sandbox with your IAM permissions and no network access. IAM context keys and Service Control Policies can keep the agent read-only while humans keep write access, and CloudWatch metrics under the AWS-MCP namespace separate agent calls from human ones.

• Best for: cloud platform teams that want coding agents to inspect, provision, and debug AWS resources under existing IAM.
• Setup and auth: SigV4 through the open-source MCP Proxy for AWS; endpoints run in 8 Regions after an October 2, 2026 expansion.
• Watch out for: the agent inherits whatever the IAM role allows, so scope the role first and log every call in CloudTrail.

14. Brave Search MCP Server: Fresh Web Results

The Brave Search MCP server is the official way to give agents current web, news, image, video, and local results from an independent index. Brave maintains it under the MIT license, the npm release was v2.1.4 in October 2026, and it replaced the archived reference Brave server, per the Brave Search MCP repository.

Version 2 defaults to the stdio transport, with HTTP available through BRAVE_MCP_TRANSPORT, and it dropped base64 image data from image search to save context. The Brave Search API prices Search at $5 per 1,000 requests with up to 50 queries per second, and free plans require a credit card for identity checks.

• Best for: research, support, and sales agents that need cited, current web context.
• Setup and auth: local server with a Brave API key in the environment.
• Watch out for: full local business search needs a Pro plan, and the server falls back to web search without it.

15. Filesystem Reference Server: Sandboxed Local Files

The Filesystem server from the MCP project is the baseline for letting an agent read, write, move, and search files inside directories you explicitly allow. It ships as @modelcontextprotocol/server-filesystem and refuses to touch paths outside its allowed list, per the Filesystem server README.

Treat it as a reference implementation. The MCP servers repository warns that its servers are educational examples, not production-ready solutions. Pass allowed directories as startup arguments: Roots, the dynamic alternative, was deprecated by SEP-2577 and keeps working only through a migration window.

• Best for: developer laptops and CI sandboxes where an agent edits local project files.
• Setup and auth: npx -y @modelcontextprotocol/server-filesystem /path/to/project with no network auth.
• Watch out for: write and delete tools are included, so mount only a project directory and run it in a container for shared machines.

Governance Controls Compared

The safest MCP rollout starts read-only, scoped to one project or workspace, and logged centrally. The table shows which control each server gives you before an agent can write. Where the docs do not describe an MCP call log, put a gateway or proxy in front if compliance requires a full tool-call record.

MCP server	Read-only path	Admin control	Audit trail
GitHub	/readonly or header	Toolsets, lockdown mode	Not documented for MCP calls
Sentry	Skill filters such as ?skills=	Org and project URLs	Not documented for MCP calls
Linear	/mcp/readonly	Okta-managed auth	Not documented for MCP calls
Atlassian Rovo	Scope consent	AI domain allowlists, IP allowlists	Tool-call audit logs
Slack	Granular search scopes	Admin approves every client	Not documented for MCP calls
Salesforce	Per-server tool choice	Setup enablement, org permissions	Not documented for MCP calls
Stripe	Restricted Agent keys	Team MCP toggle per environment	Workbench MCP call logs
Snowflake	read_only: true SQL	RBAC per tool	Snowflake query history
AWS	IAM context keys, SCPs	IAM roles	CloudTrail, CloudWatch AWS-MCP

A read-only starter config

Most clients accept a JSON block like the one below. It connects three hosted servers in their narrowest modes, so a pilot team can test value before anyone grants write access.

{
  "mcpServers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp/readonly",
      "headers": { "X-MCP-Toolsets": "repos,issues,pull_requests" }
    },
    "linear": {
      "type": "http",
      "url": "https://mcp.linear.app/mcp/readonly"
    },
    "sentry": {
      "type": "http",
      "url": "https://mcp.sentry.dev/mcp/my-org/my-project"
    }
  }
}

Security Risks to Check Before You Connect

Every MCP server widens what an agent can do, so the main risks are over-broad permissions, poisoned tool descriptions, and prompt injection from content the agent reads. Snowflake’s docs warn that mixing unverified servers can lead to tool poisoning or tool shadowing, and Stripe tells users to keep tool approval on when combining servers.

Research backs the caution. Our coverage of the ToFu MCP fuzzing study found 253 verified bugs across 118 MCP servers, plus a repeat-after-me bypass that worked across 6 agent frameworks. Broader agent risks sit in our Agent Security topic.

• Prefer hosted vendor servers: OAuth tokens can be revoked centrally, unlike a personal token pasted into a config file.
• Start read-only: use /readonly endpoints, read scopes, or read-only SQL until the pilot proves value.
• Scope tightly: one repo, project, workspace, or IAM role per agent, never an org-wide admin token.
• Keep a human on writes: mirror Stripe’s model and require approval for refunds, deletions, and outbound messages.
• Pin local servers: pin package versions for stdio servers and run them in containers with minimal mounts.

When to Build or Proxy Instead

Build your own MCP server only when no vendor server exists for an internal system, or when you need a narrow, audited tool that the vendor server cannot offer. Salesforce custom servers, Snowflake generic tools, and MCP Toolbox custom tools all let you publish narrow tools without writing protocol code.

Put an MCP gateway or proxy in front when you run more than a handful of servers, need one audit log, or must filter tools by team. Model traffic is a separate layer, covered in our LLM gateways guide, and teams wiring MCP into agents should compare runtimes in AI agent frameworks.

What We Left Out and Why

• Archived reference servers: the old PostgreSQL, GitHub, Slack, Sentry, Brave, and Google Drive reference servers now live in a separate archive, and vendor servers replace most of them.
• Unofficial wrappers: community servers for GitHub, Jira, or Salesforce were skipped when the vendor ships its own hosted server.
• Marketplaces and catalogs: the MCP Registry, Smithery, PulseMCP, and Glama are discovery layers. One September 2026 count found 21,869 servers on PulseMCP and 89,255 on Glama.
• MCP gateways: gateways route and govern traffic to servers, so they belong in a separate comparison.

Our Recommendation for Enterprise MCP Rollouts

Start with three hosted servers on systems you already govern, in read-only mode, for one pilot team: GitHub, Atlassian Rovo or Notion, and Slack cover most engineering workflows. Add Salesforce, HubSpot, or Stripe only after a human-approval step exists for writes.

Data teams should start with Snowflake’s managed server or custom MCP Toolbox tools, never raw execute_sql. Cloud teams can trial the AWS MCP Server behind a read-only IAM role this week. For tracing what agents do with these tools, see AI agent observability tools and the AgentOps tools map.

Spotted a server we missed or a detail that changed? Send it through our contact page.

Related Guides

• MCP and Agent Protocols hub
• MCP topic
• Agent Security topic
• ToFu finds 253 bugs in 118 MCP servers
• Claude Managed Agents dynamic workflows
• AI agent frameworks compared
• Best LLM gateways for enterprise AI teams
• AgentOps hub
• AgentOps tools map
• Best AI agent observability tools
• Open source LLM observability
• AI agent evaluation tools
• Editorial standards · Disclosure · Contact

Frequently Asked Questions