Step 09 of 22
Tools & MCP
Give models safe access to search, browsers, code and business apps. Tools are what turn a chatbot into something that does work. Every tool is also a permission you are granting.
How to choose
- Prefer official vendor servers for business apps; they track API changes.
- Scope tokens to read-only where you can.
- Fewer, well-described tools beat dozens the model has to choose between.
What to look for
The questions that separate the options, in order of how much they matter.
01
Who maintains it
Prefer servers maintained by the company whose product they connect to (GitHub, Microsoft, Brave, Exa, Tavily) or by the MCP project itself. They track API changes, document scopes and fix security issues. Community servers can be excellent, as Serena is, but check stars, recent releases and open security issues, and pin a version. An MCP server runs with your credentials, so treat installing one like adding a dependency with production access.
02
Write access and blast radius
Read-only servers (search, documentation) can at worst leak or mislead; servers that write (GitHub issues and pull requests, a browser filling forms, code edits) can do real damage if the agent is tricked by text in a web page or issue. Look for a read-only mode (GitHub's --read-only flag), per-tool switches, and approval prompts in your client. Start read-only and widen access only when a task needs it.
03
Authentication and scopes
The MCP specification uses OAuth 2.1 for HTTP servers: the server should ask only for the scopes the current operation needs, tokens must be issued for that specific server, and tokens must never go in the URL. Local stdio servers read credentials from the environment instead. Prefer OAuth or fine-grained tokens over broad personal access tokens, and avoid putting API keys in hosted URLs, where they end up in logs and shared configs.
04
Transport: local stdio or remote HTTP
A stdio server runs as a local process next to your client; it is simple and keeps traffic on your machine, but each developer installs and updates it. A remote HTTP server is hosted by the vendor, needs no install and usually supports OAuth sign-in, but your requests go to their servers. A local server exposed over HTTP needs its own protection: Brave's README warns its HTTP endpoint has no authentication, so bind it to localhost.
05
Tool count and context cost
Every tool's name, description and schema is loaded into the model's context, and dozens of tools make tool choice worse as well as costing tokens. Good servers group tools into toolsets and enable a small default set (GitHub), or let you choose tools by flag or parameter (Exa, Brave, Playwright's --caps). Some vendors now suggest a CLI plus a skill file instead of MCP for coding agents, which can be cheaper in tokens.
06
Price and rate limits of the service behind it
The server is usually free and open source; the API behind it is not. Search servers bill per request or credit, documentation services cap monthly calls, and anonymous tiers are rate-limited with limits that are not always published. An agent can make many calls per task, so estimate volume before turning a paid tool on for a team.
07
Building your own: use an official SDK and the current spec
If you build a server, use an official SDK (Python, TypeScript, Go, C#) and target the current specification revision, 2026-07-28. The Python SDK 2.0 renamed FastMCP to MCPServer and dropped WebSocket transport, so older tutorials will not match. Keep tools few and well described, and validate every input as if it came from an untrusted user, because it may have.
How the options differ
MCP servers fall into a few groups. Developer servers (GitHub, Serena, Context7) read and change code, repositories and documentation; browser servers (Playwright) drive a real browser; search and research servers (Exa, Tavily, Brave) fetch web results sized for a model's context. Within each, the main split is vendor-hosted remote servers with OAuth, which need no install, against local stdio servers that run on your machine with an API key or token.
The SDKs are a different kind of entry: they are what you use to build your own server or client, and the choice comes down to language and spec support rather than features.
8 tools, compared
Ranked by our rating. Open any review for sources, prices and the full verdict.
| Tool | Rating | Our verdict | Best for | Price |
|---|---|---|---|---|
| GitHub MCP ServerMCP server | 4.7/5 | GitHub access for agents should come from GitHub itself, and this server earns that with toolsets, read-only mode and a frank account of what lockdown cannot do. | Developers and platform teams who want agents working on GitHub issues, pull requests and CI with scoped credentials. | Free and MIT-licensed, hosted or self-run, on any GitHub plan. Tools for paid features (Copilot coding agent, some security alerts) need those licences. |
| Playwright MCPMCP server | 4.7/5 | Playwright MCP is the browser server to start with, provided you budget for long snapshots and remember Microsoft calls it no security boundary. | Developers and QA engineers who want an agent to explore, test or automate web apps across browser engines. | Free and Apache-2.0 licensed; you pay only for the model tokens the snapshots consume. |
| Context7MCP server | 4.5/5 | Cheap insurance against invented APIs, provided you remember that every answer comes from a closed, community-fed index your agent will trust without question. | Developers using AI coding agents with fast-moving libraries such as Next.js, Supabase or Tailwind. | Free: 1,000 calls a month, then 20 bonus calls a day. Pro: $10/seat/month with 2,000 calls per seat, then $5 per 1,000. Enterprise custom (small teams $30/user/month). |
| Exa MCP ServerMCP server | 4.5/5 | A search server you can try in a minute and keep in production, as long as someone watches which agent mode is spending the credit. | Anyone who wants a search tool for research and coding agents with no setup. | Keyless use is free and rate-limited. API: $10 free credit a month; search $4-7 per 1,000; contents $1 per 1,000 pages; agent runs $0.012 to $1 at fixed effort. |
| MCP Python SDKrepo | 4.4/5 | The spec-first way to build MCP in Python; version 2 is cleaner, and it breaks every v1 import on the way. | Python developers building MCP servers or clients who want the official, spec-tracking implementation. | Free and open source under the MIT licence. |
| Tavily MCP ServerMCP server | 4.3/5 | Search, extract, map and crawl behind one key, priced so that an agent's research habits, not the subscription, decide the bill. | Developers building research or RAG agents that need both search and page content. | Free Researcher plan with 1,000 API credits a month; pay as you go at $0.008 per credit; monthly plans from $30 for 4,000 credits to $500 for 100,000. |
| Brave Search MCP ServerMCP server | 4.3/5 | A sound default search tool for agents, chiefly because brave_llm_context returns readable page text on the first call instead of ten links to fetch. | Developers who want a general-purpose search tool for agents from an independent index. | Server is free (MIT). Brave Search API is prepaid: Search $5 per 1,000 requests (50 a second); Answers $4 per 1,000 plus $5 per million input and output tokens (2 a second). Each plan includes $5 of credit a month; card required. |
| SerenaMCP server | 4.2/5 | Serena’s symbol-level tools are a real upgrade for agents in big codebases, but its trust-the-repository security model means untrusted code belongs in a container. | Developers running coding agents on large, typed or multi-language codebases they trust, who want reliable cross-file navigation and renames. | Free and open source (GPL-3.0-or-later; the SolidLSP part is MIT). The optional JetBrains plugin is paid, with a 7-day free trial; price is set on the JetBrains Marketplace. |
Side by side
The specifications that matter for this step. Checked 2026-10-19; confirm on the vendor’s site before you commit.
| Tool | Maintainer | Transport | Auth | Write access | Tool selection |
|---|---|---|---|---|---|
| GitHub MCP Server | Vendor (GitHub) | Remote HTTP or local stdio | OAuth (hosted) or PAT | Yes; --read-only flag | Toolsets; small default set |
| Playwright MCP | Vendor (Microsoft) | stdio; HTTP with --port | None | Acts in browser (click, type) | Extra capabilities via --caps |
| Context7 | Vendor (Upstash) | Remote HTTP or stdio | API key; OAuth via setup | No (read-only docs) | 2 tools |
| Exa MCP Server | Vendor (Exa) | Remote HTTP | None (rate-limited), OAuth or key | No (search and fetch) | 2 default; more via ?tools= |
| MCP Python SDK | Official (MCP project) | stdio, Streamable HTTP, SSE | n/a (SDK) | n/a (SDK) | n/a (build your own) |
| Tavily MCP Server | Vendor (Tavily) | Remote HTTP or stdio | API key or OAuth | No (search, extract, crawl) | Search, extract, map, crawl |
| Brave Search MCP Server | Vendor (Brave) | stdio; HTTP (no auth, localhost) | Brave Search API key | No (search) | Per-tool on/off via env vars |
| Serena | Community (Oraios AI) | stdio, HTTP | None | Yes, edits code by symbol | File/shell tools off in harnesses |
Where this stage fits
- Coding agent: we would start with GitHub MCP Server, Context7, Serena.
- Workflow automation: we would start with Zapier MCP.