Connecting and using MCP servers

Remote servers

A remote server runs on the internet and Claude connects to it over HTTP. The official GitHub and Slack servers are remote: they live at a URL, handle their own authentication (usually OAuth), and work from any Claude surface, including the web and mobile apps.

In the Claude apps, remote MCP servers show up under a friendlier name: Connectors. The connector directory lists vetted ones you can add with a couple of clicks. Building a custom connector still means standing up a remote MCP server; the marketplace is just the curated front door.

A simple rule: if it touches local files, go local. If it is a SaaS product with an account, prefer the remote connector.

Where to find servers

Three reliable sources:

1. The connector directory in the Claude apps. Settings, then Connectors. This is the fastest path for GitHub, Google Drive, Slack, and other popular tools. They are remote and managed.

2. [github.com/modelcontextprotocol/servers](https://github.com/modelcontextprotocol/servers), the official reference collection. Filesystem, fetch, memory, and others, mostly meant to run locally.

3. Vendor repos. Many companies ship their own. GitHub's is at github.com/github/github-mcp-server and is offered both as a remote server and a local Docker image.

Avoid random servers from unknown authors. An MCP server runs with whatever permissions you grant it, so treat installing one like installing any other software with access to your accounts.

The concrete example: adding GitHub

Let's give Claude the ability to read issues and open pull requests. There are two ways, depending on where you work.

Option A: the GitHub connector (easiest, remote)

In the Claude desktop or web app, open Settings, Connectors, find GitHub, and click connect. You will be bounced to GitHub's OAuth screen to authorize access and choose which repositories Claude can see. Done. No config files, no tokenstokensA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition → to paste, and it works across your devices.

This is the right choice for most people. Now you can prompt:

> "Read issue #214 in my acme/web-app repo, summarize the bug, then open a PR with a fix on a new branch."

Claude calls the GitHub server's tools (get_issue, create_branch, create_pull_request, and so on), and because you are reviewing each step, nothing merges without your say-so.

Option B: local config (for Claude Code and custom setups)

If you are working in Claude Code (Anthropic's terminal-based coding agent) or wiring up your own client, you configure servers explicitly. Claude Code reads MCP servers from a JSON config. Here is the GitHub server running locally via Docker, authenticated with a personal access tokentokenA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition →:

A few things worth noticing:

• command and args tell Claude how to launch the server. Here it pulls and runs GitHub's official Docker image.
• The tokentokenA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition → comes from an environment variable (${GITHUB_PAT}), not hardcoded. Never commit a tokentokenA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition → into a config file that lives in a repo.
• The -i flag keeps stdin open, which is how stdio servers stay in conversation with the client.

To add the same server without editing JSON by hand, Claude Code gives you a command:

Run claude mcp list afterward to confirm it connected, and claude mcp get github to inspect it.

Scoping the tokentokenA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition →

When you create the personal access tokentokenA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition → on GitHub, grant only what the task needs. For reading issues and opening PRs, that is repository contents, issues, and pull requests, ideally as a fine-grained tokentokenA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition → limited to the specific repos. Broad tokenstokensA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition → are the most common security mistake here. The server can only do what the tokentokenA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition → allows, so the tokentokenA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition → is your real permission boundary.

Adding the other common servers

The pattern repeats. Each server is just a different command and a different secret.

Filesystem (local). Lets Claude read and write files in folders you name. You pass the allowed directories as arguments, which acts as a hard sandbox:

Claude can touch those two folders and nothing else.

Postgres (local). Point it at a connection string and Claude can inspect schemas and run read queries against your database. Keep it read-only at the database role level unless you genuinely want writes.

Slack (remote connector). Add it through the connector directory and authorize with OAuth. Claude can then read channels and post messages on your behalf.

Google Drive (remote connector). Same flow. Once connected, Claude can search and pull in documents as context, which pairs well with Projects.

Verifying it works and staying safe

After connecting, do a tiny smoke test before trusting Claude with anything real. Ask it directly: "What GitHub tools do you have access to right now?" A correctly connected server makes Claude list its available tools. If it says it has none, the server failed to start (check Docker is running, the tokentokenA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition → is set, the config is valid JSON).

Then run one low-stakes read: "List the three most recent open issues in acme/web-app." Reads before writes. Once you trust the read path, let it write.

Two safety habits to lock in:

• Approve actions, don't automate them blindly. Claude asks before each tool call by default. Keep that on for anything that writes (opening PRs, posting to Slack, modifying files). Auto-approval is fine for read-only servers you trust.
• One token, one job. Use separate, narrowly scoped credentials per server. If a tokentokenA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition → leaks, the blast radius stays small.

Local versus remote: choosing in practice

Now that you have seen both, here is how the decision actually plays out on a real project.

Say you are building a feature and want Claude Code to fix a bug end to end. You would likely run two servers at once: the GitHub server (remote or local) to read the issue and open the PR, and the filesystem server (local) so Claude can read and edit the actual code on your machine. MCP servers compose. Claude sees the combined toolset and orchestrates across them in a single conversation.

Contrast that with a teammate on the mobile app who just wants Claude to summarize this week's GitHub issues during a commute. They want the remote connector and nothing else, because a local Docker container is not running in their pocket.

Same protocol, different deployment, driven entirely by where the work happens and what it needs to touch.

Servers in the APIAPIApplication Programming Interface: a standardised interface that lets applications communicate and exchange data without knowing each other's internal workings.View full definition → and agent SDK

This is not limited to the chat apps. The Anthropic Messages API supports remote MCP servers through its MCP connector feature, so a backend service you build can give Claude the same GitHub or Slack access programmatically. The Claude Agent SDK goes further: it is the toolkit for building agents that manage their own MCP connections, run tool loops, and handle the orchestration you would otherwise do by hand.

The mental model stays identical everywhere. You connect a server, Claude discovers its tools, and it calls them as needed. The reference docs for wiring servers across surfaces live at docs.claude.com, and they are the source of truth when a flag or flow changes.

A note on Skills versus Connectors

It is easy to confuse these, so draw the line clearly. A Connector (MCP server) gives Claude access to a live external system: it can call GitHub right now. A Skill packages instructions and resources that shape *how* Claude does a task, like a reusable playbook for writing PR descriptions in your team's format. Skills tell Claude how to behave; connectors give it something to act on. The most capable setups use both: a Skill that defines your PR conventions, running over a GitHub connector that does the actual opening.

Key Takeaways

• Pick local or remote by what the work touches. Local stdio servers for filesystems and local databases; remote connectors for SaaS tools and anything you need on mobile.
• For GitHub, start with the connector in Settings, Connectors. Only drop to a JSON config (Docker image plus an env-var tokentokenA token is the basic unit of text that language models process, often a word fragment, whole word, or punctuation mark rather than a single character.View full definition →) when you are in Claude Code or building your own client.
• The token is the permission boundary. Create fine-grained, repo-scoped, single-purpose credentials and never hardcode them in committed config.
• Test reads before writes, and keep tool approvals on for anything that changes state.
• Compose servers, and pair them with Skills. Running GitHub plus filesystem together lets Claude fix a bug end to end; a Skill on top makes it do it your team's way.