Claude Code MCP Security Risks and Best Practices
The real security risks of MCP servers in Claude Code — over-broad access, secrets in config, prompt injection, untrusted servers — and how to lock each one down.
17 guides
The real security risks of MCP servers in Claude Code — over-broad access, secrets in config, prompt injection, untrusted servers — and how to lock each one down.
MCP servers cost context tokens before you type. Why each connected server's tools eat your context window, how to measure it, and how to fix it in Claude Code.
Fix Claude Code MCP servers that won't connect — the Windows cmd /c npx wrapper, PATH issues, bad commands, auth failures, and stdout corruption. Step-by-step.
Connect the GitHub MCP server to Claude Code on Windows and WSL. Token auth, what it unlocks — issues, PRs, code search — example workflows, and scope cautions.
Add the Playwright MCP server so Claude Code can drive a real browser — navigate, click, screenshot, assert. The verify-my-change loop, headless vs headed, WSL notes.
Connect Postgres to Claude Code with an MCP server the safe way — read-only roles, non-prod targets, schema inspection, and query workflows on Windows and WSL.
Use Claude Code with an MCP server to inspect containers, read logs, and debug Docker on Windows and WSL — what to connect, safe scope, and example workflows.
MCP servers and plugins solve overlapping problems in Claude Code. When to add a raw MCP server, when a plugin makes sense, and how to keep your context lean.
Plugins, skills, and MCP servers sit at different layers in Claude Code. What each is, how they nest, and a clear guide to which one you actually need.
The MCP servers worth adding to Claude Code for ops work: filesystem, GitHub, Postgres, SQLite, Docker, fetch, Sentry, and Playwright — with honest caveats.
The Claude Code plugins actually worth checking in 2026, with install commands, source links, and why GitHub, Playwright, LSP, security, review, docs, and workflow plugins make the cut.
Skills, MCP servers, and subagents solve different Claude Code problems. What each does, what it costs, and a clear decision guide for picking the right one.
The MCP servers actually worth installing in Claude Code in 2026 — GitHub, filesystem, Postgres, Playwright, fetch, Sentry, Slack, and memory. With add commands.
Add MCP servers to Claude Code on Windows and WSL: claude mcp add, scopes, .mcp.json, verifying with /mcp, and the Windows cmd /c npx wrapper gotcha explained.
Build a minimal MCP server from scratch with the official TypeScript SDK, expose one tool over stdio, connect it to Claude Code, and test it end to end.
A plain-English guide to the Model Context Protocol (MCP): the client/server model, tools vs resources vs prompts, transports, and why it matters for Claude Code.
A map of Claude Code's advanced features — MCP servers, Skills, subagents, hooks, plugins, slash commands, status line, and CLAUDE.md — and when to use each.