MCP servers for Cursor, Claude Code and Codex: a team guide

All three tools read MCP servers from a per-project config that can be committed and a per-user config that cannot. Cursor uses .cursor/mcp.json and ~/.cursor/mcp.json, asks before a tool runs by default, and lets enterprise admins enforce an allowlist by command or URL. Claude Code uses claude mcp add with local, project and user scopes, writes project servers to .mcp.json, requires a person to approve those servers from a trusted folder, and expresses tool permissions as mcp__server__tool rules in settings that organisations can override with allowedMcpServers and deniedMcpServers. Codex CLI reads .codex/config.toml and ~/.codex/config.toml, allowlists tools with enabled_tools, and sets an approval mode per tool, including a writes mode that runs reads and prompts on writes. The shape is the same everywhere: a committed server list, a person in the loop for writes, and an admin layer above both.

As of September 2026, these are the servers we see engineering teams use across all three tools. Each exists as an official vendor server with a documented way to limit what it can do.

1. 1. GitHub MCP server

   Lets the agent read repositories, issues, pull requests, Actions runs and code scanning results without leaving the editor. Official server from GitHub, available hosted or self-run. Team rule: start with the --read-only flag and the repos, issues and pull_requests toolsets; enable write tools only for a named workflow.

2. 2. Playwright MCP

   Drives a real browser through accessibility snapshots so the agent can reproduce a bug or check a page after a change. Official server from Microsoft. Team rule: run it in isolated mode against local or staging origins, and treat any step that logs in or submits a form as an approval point.

3. 3. Context7

   Pulls current, version-specific library documentation into the run so the agent stops guessing at APIs. Published by Upstash, hosted at mcp.context7.com. Team rule: it only returns documentation, so it can sit on the default allowlist; keep the API key out of the shared config file.

4. 4. Sentry MCP

   Searches errors and performance data and reads issue context for the code the agent is fixing. Official server from Sentry, hosted at mcp.sentry.dev with OAuth. Team rule: scope the connection to one project, and keep the write scopes off until the team decides which triage actions the agent may take.

5. 5. Linear MCP

   Reads issues, projects and comments so the agent can work from the ticket instead of a pasted summary. Official server from Linear. Team rule: connect the readonly endpoint or the read OAuth scope first; issue creation and status changes stay with a person until reviewers ask for more.

6. 6. Atlassian Rovo MCP

   Searches Jira and Confluence and can create or update work items. Official remote server from Atlassian; it acts with the connected user's own permissions. Team rule: connect it under an account with read access only, since the docs say it can act across every connected product with your permissions.

7. 7. Notion MCP

   Searches and reads pages and databases, and can create or update them after OAuth. Official remote server from Notion; workspace owners control which clients may connect. Team rule: use a workspace connection limited to the engineering spaces the team actually reads, and keep page writes out of unattended runs.

8. 8. Supabase MCP

   Gives the agent schema and data access to a Supabase project, including Postgres queries. Official server from Supabase. Team rule: set read_only and project_scoped in the config and point it at a staging project, never at production.

These are not bad servers. They are the ones teams add in week one and regret in week three, because they carry secrets, write to shared systems, or nobody can say who maintains them.

1. 1. Slack MCP

   The official Slack server can search and send messages as the connected user, and Slack requires workspace admins to approve every MCP client. That is a decision for the team and an admin, not a line in a repo config.

2. 2. Figma MCP with canvas writes

   The Figma server is useful for reading design context, but its write-to-canvas tools change design files other people own. Keep it on read tasks until designers agree on what the agent may touch.

3. 3. Filesystem with broad roots

   The reference filesystem server from the Model Context Protocol project restricts operations to allowed directories, but only if someone sets them narrowly. A home directory root turns every run into a full-disk agent.

4. 4. Unmaintained database servers

   The reference Postgres, SQLite and Redis servers were moved to an archived repository, and many community forks carry a connection string in plain text. Prefer a vendor server with a read-only flag, or none at all.

The point of these rules is that a reviewer can tell what the agent did, which server did it, and whether that was inside what the team agreed. None of them slow a run down once they are written.

1. 1. One allowlist per repository

   Write the approved servers into the shared config the team already version controls, and treat a new server like a new dependency: a pull request, a named owner, and a reason.

2. 2. Read-only by default

   Where the server offers a read-only flag, endpoint or scope, that is the starting point. Write access is a separate decision with a named workflow attached.

3. 3. Approval for writes

   Anything that creates a ticket, posts a message, changes a design file or writes to a database goes through a prompt or an explicit allow rule that a reviewer can see in the config.

4. 4. Record which server produced which change

   Ask the agent to name the tools it called in the pull request description, and keep the transcript or log attached, so a reviewer can trace a change back to a server call.

5. 5. Review the diff, not the chat

   The transcript shows what the agent thought it did. The diff, the test output and the tool log show what happened. Reviewers sign off on the second set.

A list like this only holds if the whole team applies it the same way. In the two-day workshop we set the allowlist up in the team's own repository with whichever of Cursor, Claude Code or Codex the team runs, run real tasks against it, and write the rules above into the config and the review checklist. Delegate, Review, Own is the model we use to decide which MCP calls an agent may make on its own, which need a prompt, and which stay with an engineer, so the standard survives after the trainers leave.