Cursor MCP servers: which to add first and how teams keep them safe

Cursor loads MCP servers from two files: .cursor/mcp.json in the project for servers tied to that codebase, and ~/.cursor/mcp.json in the home directory for servers a person wants everywhere. Both support stdio servers Cursor starts itself and remote servers over SSE or Streamable HTTP. The Cursor CLI uses the same configuration and adds agent mcp list, list-tools and login commands. By default Cursor asks for approval before an MCP tool runs and shows the arguments when you expand the call; the run mode decides which allowlisted tools may run without a prompt. Team admins can distribute shared servers through team settings, and enterprise admins can enforce an MCP allowlist by command pattern or URL, restrict which tools run automatically, and control network access.

As of September 2026, these are the servers we see engineering teams use with Cursor most, and each one exists as an official vendor server with a documented way to limit what it can do.

1. 1. GitHub MCP server

   Lets the agent read repositories, issues, pull requests, Actions runs and code scanning results without leaving the editor. Official server from GitHub, available hosted or self-run. Team rule: start with the --read-only flag and the repos, issues and pull_requests toolsets; enable write tools only for a named workflow.

2. 2. Playwright MCP

   Drives a real browser through accessibility snapshots so the agent can reproduce a bug or check a page after a change. Official server from Microsoft. Team rule: run it in isolated mode against local or staging origins, and treat any step that logs in or submits a form as an approval point.

3. 3. Context7

   Pulls current, version-specific library documentation into the run so the agent stops guessing at APIs. Published by Upstash, hosted at mcp.context7.com. Team rule: it only returns documentation, so it can sit on the default allowlist; keep the API key out of the shared config file.

4. 4. Sentry MCP

   Searches errors and performance data and reads issue context for the code the agent is fixing. Official server from Sentry, hosted at mcp.sentry.dev with OAuth. Team rule: scope the connection to one project, and keep the write scopes off until the team decides which triage actions the agent may take.

5. 5. Linear MCP

   Reads issues, projects and comments so the agent can work from the ticket instead of a pasted summary. Official server from Linear. Team rule: connect the readonly endpoint or the read OAuth scope first; issue creation and status changes stay with a person until reviewers ask for more.

6. 6. Atlassian Rovo MCP

   Searches Jira and Confluence and can create or update work items. Official remote server from Atlassian; it acts with the connected user's own permissions. Team rule: connect it under an account with read access only, since the docs say it can act across every connected product with your permissions.

7. 7. Supabase MCP

   Gives the agent schema and data access to a Supabase project, including Postgres queries. Official server from Supabase. Team rule: set read_only and project_scoped in the config and point it at a staging project, never at production.

These are not bad servers. They are the ones teams add in week one and regret in week three, because they carry secrets, write to shared systems, or nobody can say who maintains them.

1. 1. Slack MCP

   The official Slack server can search and send messages as the connected user, and Slack requires workspace admins to approve every MCP client. That is a decision for the team and an admin, not a line in a repo config.

2. 2. Figma MCP with canvas writes

   The Figma server is useful for reading design context, but its write-to-canvas tools change design files other people own. Keep it on read tasks until designers agree on what the agent may touch.

3. 3. Filesystem with broad roots

   The reference filesystem server from the Model Context Protocol project restricts operations to allowed directories, but only if someone sets them narrowly. A home directory root turns every run into a full-disk agent.

4. 4. Unmaintained database servers

   The reference Postgres, SQLite and Redis servers were moved to an archived repository, and many community forks carry a connection string in plain text. Prefer a vendor server with a read-only flag, or none at all.

The point of these rules is that a reviewer can tell what Cursor did, which server did it, and whether that was inside what the team agreed. None of them slow a run down once they are written.

1. 1. One allowlist per repository

   Write the approved servers into the shared config the team already version controls, and treat a new server like a new dependency: a pull request, a named owner, and a reason.

2. 2. Read-only by default

   Where the server offers a read-only flag, endpoint or scope, that is the starting point. Write access is a separate decision with a named workflow attached.

3. 3. Approval for writes

   Anything that creates a ticket, posts a message, changes a design file or writes to a database goes through a prompt or an explicit allow rule that a reviewer can see in the config.

4. 4. Record which server produced which change

   Ask the agent to name the tools it called in the pull request description, and keep the transcript or log attached, so a reviewer can trace a change back to a server call.

5. 5. Review the diff, not the chat

   The transcript shows what the agent thought it did. The diff, the test output and the tool log show what happened. Reviewers sign off on the second set.

A list like this only holds if the whole team applies it the same way. In the two-day workshop we set the allowlist up in the team's own repository with Cursor, run real tasks against it, and write the rules above into the config and the review checklist. Delegate, Review, Own is the model we use to decide which MCP calls an agent may make on its own, which need a prompt, and which stay with an engineer, so the standard survives after the trainers leave.