Originally published on DevToolHub. The best MCP servers in 2026 aren't just the ones with the most GitHub stars. With the 2026-07-28 spec update — final and current since late July — making OAuth 2.1 mandatory for every remote MCP server, "best" now also means "still working under the final spec." Here's one solid pick per category, what it actually does, and where it stands on auth.
This is for anyone deploying MCP servers for a team, not just testing one locally. If you're only running servers on your own machine for personal use, the OAuth requirement mostly doesn't touch you — skip to the core utilities section below.
Three things separate a server worth deploying from one that'll cause you problems in six months:
| Category | Server | Maintainer | Transport | OAuth Status |
|---|---|---|---|---|
| Core utilities | Filesystem, Git, Fetch, Memory | MCP steering group | Local (stdio) | Not applicable |
| Dev/code | GitHub MCP Server | GitHub (official) | Remote (also local) | OAuth 2.1 + PKCE, GA since Sept 2025 |
| Payments | Stripe MCP Server | Stripe (official) | Remote hosted (local stdio also available) | OAuth by default; docs still cite the pre-2026 MCP auth spec |
| Observability | Sentry MCP Server | Sentry (official) | Remote (hosted on Cloudflare; local stdio available) | OAuth via your Sentry org login |
| Docs/productivity | Notion MCP Server | Notion (official) | Remote hosted (official local server exists) | OAuth on hosted; token-based on local |
| Databases | Postgres (community forks) | Community (official version archived) | Local (stdio) | Not applicable, but read the warning below |
The official reference servers — Filesystem, Fetch, Git, Memory, Sequential Thinking, and Time — are maintained directly by the MCP steering group. They run locally over stdio. That means they never talk to the network in the first place. The 2026-07-28 auth overhaul doesn't touch them, because the OAuth requirement applies to remote transports only.
If your agent just needs to read local files, search git history, or fetch a URL, these cover it. No auth setup required. That's also their limit — nothing here is shareable across a team the way a hosted server is. Three vendors got ahead of the auth shift instead of scrambling after the spec finalized — with one caveat worth knowing on compliance claims.
GitHub shipped its remote MCP server to general availability in September 2025. It's the only one of the three that explicitly documents OAuth 2.1 with PKCE, across VS Code, Visual Studio, JetBrains, Eclipse, Xcode, and Cursor. Short-lived, auto-refreshing credentials replace long-lived personal access tokens — exactly the direction the final spec pushes every server toward.
Stripe runs its primary MCP server as a hosted endpoint at mcp.stripe.com, with OAuth as the default and restricted API keys available for autonomous agents that need a narrower blast radius than a full secret key. A local stdio option also exists (@stripe/mcp on npm, still actively updated) for anyone who'd rather keep keys off a hosted flow. One honest caveat: Stripe's docs still reference the pre-2026 MCP authorization spec, so verify its 2026-07-28 alignment yourself before treating it as fully compliant with the new requirements.
Sentry took the hosted-first path, running its server on Cloudflare's Workers platform with OAuth tied to your existing Sentry organization login. Sentry's own writeup is blunt about why hosted comes first: the local install workflow — cloning repos, managing config paths — has "a lot of sharp edges." A local stdio mode still exists for those who want it.
Notion's hosted MCP server is OAuth-based and the path Notion recommends. An official local stdio server (notion-mcp-server) authenticated with an internal integration token still exists too, though Notion has flagged it may be sunset — build new integrations against the hosted endpoint.
[IMAGE: articles/images/2026-07-25-best-mcp-servers-by-category-diagram.png | alt: "local vs remote MCP servers and which ones need OAuth 2.1"]
Here's the one every other "best MCP servers" list skips. Anthropic's own reference Postgres server shipped a read-only mode meant to block writes. It didn't. Datadog Security Labs' case study documents the SQL injection in detail: the server happily accepted a semicolon-delimited COMMIT; DROP SCHEMA public CASCADE; — breaking straight out of its own read-only transaction. Worth being precise about the timeline: the server was archived in May 2025 as part of a bulk sweep of unmaintained reference servers, and the security disclosure landed after — on a server that was already abandoned. Nobody was watching it either way.
The lesson isn't "avoid database MCP servers." It's that a vendor's name on a server doesn't guarantee its safety claims hold up. If you're running a Postgres MCP server today, use a community fork with real query parsing and permission attenuation. Confirm it's still maintained before you trust it with production credentials — the same instinct you'd bring to any runtime security tooling that promises to enforce a boundary it hasn't actually tested.
Match the deployment model to who's using it, not just what the server does:
If you're building any of this out as part of a Claude-based workflow, Anthropic's developer training track covers MCP server setup directly, alongside Agent Skills. Q: Do I need OAuth for a local MCP server I only run on my own machine?
A: No. The OAuth 2.1 requirement in the 2026-07-28 spec applies to remote/HTTP transports. A local stdio server never exposed itself to the network, so it isn't in scope.
Q: Is the official Anthropic Postgres MCP server still usable?
A: It's archived and unmaintained — it went into Anthropic's archive sweep in May 2025, and a real read-only bypass was disclosed after that. Use one of the actively maintained community forks instead, and verify its query-parsing approach before connecting production credentials.
Q: Which MCP server should a small team deploy first?
A: Start with whichever remote server you already pay for and trust. GitHub, Stripe, and Sentry are all officially maintained and OAuth-first. Each one solves a real, specific problem instead of acting as a general-purpose demo.
Q: Are community MCP servers safe to use in production?
A: Some are. Check who maintains it, when they last updated it, and whether anyone has reviewed it for the same class of bug that took down the official Postgres server. An unaudited read-only claim is not the same as an enforced one.
Quick Summary:
@stripe/mcp) exists too DROP SCHEMA statement, per Datadog Security Labs
Audit which of the best MCP servers your team already runs against this list — the 2026-07-28 spec is final, so any remote server not yet aligned with its OAuth requirements is the one to fix before older clients start failing against it.