The best MCP servers for apps you already pay for

The best MCP server for a given job is the one published by the vendor of an app you already pay for, and this page names the twenty of those it has checked one at a time. Every page currently ranking for this question sorts servers by GitHub stars, by personal preference, or by where the publisher put its own product, and all twenty-two organic results checked assume you are choosing which server to add to an AI coding tool such as Claude Code, Cursor, or Codex (measured 2026-08-22, United States, English). The list below is the other job: business applications, checked against the protocol’s own registry, with the namespace and the date on every row.

What is an MCP server, and do I need one?

An MCP server is a small piece of software that describes one application’s capabilities in a format an AI assistant can read and call, so the assistant can work inside that application instead of only talking about it. The Model Context Protocol is an open standard with a public registry, so the vendor of an app does not have to build AI features into their own product for your assistant to be able to use it. That is the whole reason the question is worth asking: reach into your existing tools is a property of the standard rather than a line on somebody’s roadmap. The longer version is on what an MCP server is and what is MCP.

Whether you need one depends on what you want done, not on how technical you are. If the answer you want is information that already sits inside an app, a server for that app is the difference between describing your data to your assistant and having it read the data itself.

Which MCP servers are the best ones?

Start with the applications you already log into every day, and prefer a server the app’s own vendor publishes over any other server for the same app. A vendor-published server is the only kind where the party who can break the app is also the party responsible for keeping the server working, which matters more over a year than any feature comparison does at the moment you install it. That is an argument about who is accountable, not about how popular a server is.

For the servers named most often right now, two different phrasings of this same question to ChatGPT produced overlapping but non-identical pick lists on 2026-08-22: the bare keyword returned GitHub, Playwright, Filesystem, a PostgreSQL or database server, Supabase, Sentry, Tavily, Cloudflare, Memory, and Fetch; the spoken form returned GitHub, Playwright, Context7, Filesystem, Git, Fetch, PostgreSQL, Slack, Google Drive, Sentry, Notion, and Linear (DataForSEO ChatGPT scraper, measured 2026-08-22). Nine of those twelve are pieces of a software development workflow. That is a fair description of who has adopted MCP so far and a poor description of what most people’s work consists of.

Which of the apps I already pay for have a server from their own vendor?

Twenty of the forty-one checked. Each row below was queried individually against the protocol’s public registry on 2026-08-22 and judged on two things: the namespace, and the repository.url the registry holds for the entry. The applications were chosen because they are widely used, so twenty of forty-one is not a rate that generalizes to the whole catalog.

Twenty-one applications were checked and had no server from their own vendor in the registry on 2026-08-22: Slack, HubSpot, Asana, Zendesk, Shopify, Salesforce, Canva, ClickUp, Intercom, Dropbox, Box, QuickBooks, Xero, Mailchimp, DocuSign, Smartsheet, Twilio, Discord, Calendly, Pipedrive, Freshdesk. Every one of them has third-party servers listed, and every one of them is reachable through a managed connector, which is the last verdict in the next section. Absence today is not absence next quarter, and these rows carry a date for that reason.

Seven of the twenty first-party servers are for applications this site’s older catalog rule had set aside as developer infrastructure: Linear, GitLab, Cloudflare, Supabase, Sentry, GitHub, and Firecrawl. The applications with the richest action surfaces were the ones excluded on an older axis, which is why the classification is being redone rather than patched.

Where can I find trusted MCP servers?

The official public registry at registry.modelcontextprotocol.io/v0/servers is the place to start, because it is the only list where the identity of the publisher is machine-checkable rather than asserted. It is a paginated open API whose limit parameter caps at 100 results, and walking all 243 pages with version=latest on 2026-08-22 returned 24,221 distinct server names.

Registry presence is not the same thing as trust, and the distinction is the part every directory currently skips. The largest directory ranking for this question, mcpservers.org, claims more than 9,800 official and community servers and applies an “official” tag to some of them with no verification method stated anywhere on the page, and no publication or last-checked date anywhere on the page either (retrieved 2026-08-22). Another ranking result, github.com/tolkonepiu/best-of-mcp-servers, ranks about 400 servers by 1.3 million combined GitHub stars (retrieved 2026-08-22), which measures developer attention and not whether the server does what its description says.

So the useful practice is two steps rather than one. Find the server in the registry, then check who published it, which is the subject of the next question.

How do I know if an MCP server is official?

Two checks, either of which settles it, and one field that corroborates both.

The namespace is reverse-DNS on the vendor’s own domain. app.linear/linear is on linear.app. com.notion/mcp is on notion.com. com.atlassian/atlassian-mcp-server is on atlassian.com. This is the clean case.

Or the namespace is io.github.<org> where that GitHub organization owns the product’s canonical repository. io.github.github/github-mcp-server has repository github.com/github/github-mcp-server, which is GitHub’s own server. io.github.firecrawl/firecrawl-mcp-server is Firecrawl’s own. The organization is not always the product name: Sentry publishes under io.github.getsentry and Miro under io.github.miroapp, so the domain comparison alone gets both of them wrong.

The field that decides both cases is repository.url, which the registry holds for most entries. A domain-only test is not sufficient on its own, and an earlier version of this page said it was. Two counterexamples killed it: GitHub’s own server and Firecrawl’s own server both publish under io.github.*, which resolves to github.com rather than to the vendor’s domain, so a domain-only rule classes both as community. SAP’s own servers, under io.github.SAP, fail the same way.

Two cautions on the check itself. A vendor-owned namespace establishes who published the server, not that the server is maintained, complete, or safe for a particular task. And an app can have no registry entry at all and still be reachable, which is what the last verdict below is for.

What do the four verdicts mean?

They are four descriptions of how your assistant can reach an application, and each is right for something different.

What each is right for and wrong for, which is the part that decides anything:

• A vendor server is right when you want the party who can break the app to be the party responsible for the connection. It is wrong as a guarantee of quality; nothing in the registry measures whether a server works well.
• A community server is right for an app whose vendor has shipped nothing and where you can accept a third party in the path. It is wrong for a system of record other people depend on, because the publisher can neither fix the app nor be held to its behavior.
• A vendor plugin or connector is right when it is what your assistant already offers and the job is inside that assistant. It is wrong to plan a year around, and the reason is in the sources at the foot of this page rather than in this sentence.
• A managed connector is right for the long tail, which is most applications, and for anything where you want the credential held somewhere you can revoke it in one place. It is wrong when you need the vendor on the hook for the behavior of the connection.

These verdicts describe products, not people. There is no reader score, grade, readiness level, or maturity stage anywhere on this site, and there will not be one. A verdict is a fact about a vendor’s shipping decisions, in the same category as whether the app has a public API, and none of the four ranks above another for a reader. Two of the pages ranking for this question mix the two ideas: one carries an “official status” column inside a list that also ranks the products against each other, so a vendor attribute and an editorial preference end up in the same table. Those are different kinds of claim and they are kept apart here.

How much of the catalog has been through this check?

Forty-one applications of a thousand. The rest is the census, and it is not finished. What has been established at catalog scale, on a full registry pagination and name join dated 2026-08-22: the registry’s 24,221 server names match between 294 and 318 of the 1,000 applications in the connector catalog depending on how strictly names are compared, and between 165 and 180 of the 589 applications this site publishes. Those are name matches rather than verified vendor servers, and the gap between a name match and a verified row is exactly the work above.

The catalog those verdicts will be applied to holds 1,000 applications and 41,557 distinct actions retrieved, of which 589 applications are published, with a median of 19 actions each and a maximum of 574 (Canvas), queried 2026-08-22 from an inventory built 2026-08-14. The 1,000 is the ceiling of the tool that produced the snapshot, which records the truncation in its own metadata, so it is a floor rather than a count. The median is the number that matters when you are deciding what to attempt. Most applications expose enough actions for one bounded job and not enough for an open-ended one.

Per-application detail that already exists is in the tools index, which carries the action surface, the in-product AI verdict and the date each was checked, including Notion, Slack, HubSpot, Asana and GitHub.

Per-app verdict pages will carry the app name, the verdict, the namespace checked, and the date it was checked. Until a given app has been through that check it is listed as unchecked rather than assigned a provisional verdict, which is the opposite of the convention in this field: the most complete editorial page ranking for this question publishes a numbered rank order for twelve servers under an “Updated August 2, 2026” line (retrieved 2026-08-22), and a rank order over twelve hand-picked servers is re-verifiable in a way that a rank order over a thousand applications is not.

What can I actually do once an app is reachable?

Four different things, and choosing between them is a question about the task rather than about how far along you are. The full version of this table, with what each shape is wrong for, is on the manifesto. The row that matters most here is the first one.

None of these is a step toward the next one. Reading only is the permanent right answer for a great deal of work, and a written-down procedure is the wrong answer for anything where the definition of a good result is still moving. A server that can only read is not a lesser server; for some jobs it is the correct one.

One number to set expectations before you connect anything. Of the 589 published applications in the catalog, 34 can act without being asked, meaning the application itself can start something rather than only respond (queried 2026-08-22, inventory built 2026-08-14). For the rest, the assistant does something because you asked it to in that moment.

How does my AI get permission to touch the app?

Through a credential, and the two ways of holding that credential differ in what happens when it expires rather than in what they can do. The direct route is an API key or token pasted into a configuration file on your machine. It works immediately, it is as broad as whatever the key was issued for, and it sits in a file that ends up copied, committed, or backed up somewhere you did not intend.

A managed connector holds the authorization outside your configuration instead. Composio, which supplies the connector catalog and the action counts cited on this page, stores the auth config and the connected account separately, refreshes OAuth tokens before they expire, and marks a connection expired only after refresh attempts have failed (Composio authentication documentation, retrieved 2026-08-22). The practical difference is the failure mode. A pasted key that expires looks like the assistant quietly getting worse at a job it used to do; a managed connection that expires looks like a connection marked expired.

The rule is the same either way, and it is the one worth writing down: no key, token, or session cookie belongs in a file you commit to a repository.

How many MCP servers should I set up?

Fewer than you are able to, and add them one at a time as a specific job requires one. Both ChatGPT answers measured on 2026-08-22 volunteered this warning without being asked: the bare-keyword answer recommended a starter set of four and cautioned that installing too many servers consumes the assistant’s available context, and the spoken-question answer warned explicitly against installing thirty servers because you can (DataForSEO ChatGPT scraper, measured 2026-08-22).

There is a second reason to go slowly that has nothing to do with context. Each server you add is a set of actions your assistant may take against a real account, and the useful moment to decide what it may and may not do is when you add it, not after something has happened.

Are MCP servers still useful, or is this already over?

The evidence that matters is in the table near the top of this page. Twenty well-known business applications had a server published by their own vendor on 2026-08-22, seven of them for products this site had previously set aside, and Zoom alone publishes seven separate servers. Vendors do not staff and publish seven servers for a format they are abandoning.

Search interest is also up on both instruments, and it belongs in the sources at the foot of this page rather than here, because search volume measures curiosity rather than whether something works in the work.

The honest caveat is that nobody has settled the answer to this question yet, including the assistants. Two phrasings of the identical question to ChatGPT on the same day returned almost completely different sets of third-party citations: the bare keyword cited pondero.ai (dated 2026-04-27), kaigritun.com, and mcpverdict.com (dated 2026-06-16), none of which appeared in the spoken-question answer, which instead cited mcp.directory and GitHub’s own Copilot documentation. The only sources common to both were the protocol’s own site, registry, and reference repository. When the same question asked two ways produces two different sets of authorities, no third-party page has become the canonical answer yet.

Do I need to be a developer for any of this?

No, and the belief that you do is the single most common reason people stop here. The assumption is that AI capability sits on top of tool expertise, so you would need to be an expert in an app before you could get an assistant to do anything inside it. What the assistant needs from you is four answers about your own work, which are the same four used on every guide on this site.

1. What is this task’s one job?
2. What does a good result look like, specifically enough that someone else could tell?
3. What must never happen without my approval?
4. What supervision does this task need?

The reason the assumption is so easy to pick up is that everything written about this question was written for developers. Across the twenty-two organic results checked for this phrase on 2026-08-22, zero addressed a reader who does not already run an AI coding agent. One vendor editorial names its audience in its opening sentence as developers and engineers (developers.redhat.com, published 2025-11-04, retrieved 2026-08-22). The most complete listicle frames the whole subject as turning a general-purpose AI client like Claude Code, Cursor, or Codex into a specialist (retrieved 2026-08-22). Even Google’s own related searches for this phrase assume it, offering “Best MCP servers for vscode,” “Best MCP servers for Cursor,” and “Best MCP servers for Claude.”

The setup work that genuinely requires a developer is the part where you write a new server for an app that has none. Using a server that already exists, for an app you already have an account with, is account authorization and a description of the job.

What could a careful check not establish here?

• Whether any of these servers work well. A verdict is about who published a thing and how your assistant reaches it. Nothing on this page measures reliability, latency, error handling, or quality of the action descriptions, and no such measurement has been run.
• Whether this saves time, and how much. No measurement was run. Any hours-saved figure attached to this subject anywhere, including any this site produces later, is an estimate until it is measured against a specific task.
• How many of the 589 a person can turn on unaided. The 589 published applications were not checked for how many are reachable without an administrator enabling something first. That count does not exist yet.
• What the verdict distribution across the catalog looks like. Forty-one applications have been checked one at a time. The name join matches 294 to 318 of 1,000, which is a match count and not a verdict breakdown.
• How many reachable applications there are. The catalog snapshot stops at exactly 1,000 because that is the ceiling of the tool that produced it, and the snapshot records the truncation in its own metadata. So 1,000 is a floor.
• Which action count is canonical. Two columns in the catalog disagree for 111 of the 1,000 applications, 565 actions in total. This page uses the retrieved count, which is what the site’s own catalog file publishes.
• Real demand for this question. “best mcp servers” returns no measurable volume on Google Ads and 49 in the AI channel against 24 a year prior, measured 2026-08-22. The AI-channel number is modeled from People Also Ask data rather than observed assistant traffic, and it is not summable, so it cannot be added to the figures for related phrasings.
• Whether the plugin decline continues. One twelve-month comparison on one modeled instrument is the entire basis for the note about plugins. It is a direction, not a forecast, and it is not evidence that any plugin has stopped working.
• What Google itself thinks the answer is. No AI Overview renders as a standalone feature for this phrase, confirmed on two separate SERP pulls on 2026-08-22, the second with asynchronous overview loading requested explicitly. Four People Also Ask questions carry unresolved overview stubs, including “Where can I find trusted MCP servers?”, which went unexpanded on both pulls.

Worth saying outright, because it is not the convention in this field: this page ranks nothing it sells, and where a vendor supplies data used here it is named in the sources table below. Of the pages ranking for this question, one places its own product at pick 12 of its own twelve-item ranking, another opens its own ranked list with its own product in slot 1, and a third ranks by usage data collected from a company in the same market (all retrieved 2026-08-22).

Sources

One caveat travels with every AI-channel figure above. DataForSEO derives ai_search_volume from People Also Ask data in the search results page. It is a modeled rate rather than a count of assistant queries, and it is not summable. Read it as a second directional instrument beside Google volume, never as a measurement of what assistants were actually asked, and never as evidence about whether a route works.