Best MCP Servers for Enterprise Teams in 2026: A Vetted List and an Approval Checklist

What an MCP server is

An MCP server is a program that exposes tools, resources and prompts to AI applications over the Model Context Protocol, so an agent can discover a capability such as searching tickets or running a query and call it through one standard interface. The current specification, version 2026-07-28, defines two standard transports: stdio, where the client launches the server as a local subprocess, and Streamable HTTP, where each message is an HTTP POST to a remote endpoint. HTTP servers follow an authorization model based on OAuth 2.1, while stdio servers are expected to read credentials from their environment. Our MCP concept guide explains clients, servers and the message flow in more depth.

How these servers were chosen

Public MCP directories list thousands of servers, most of them community wrappers around another company’s API. For an enterprise the first filter is simpler: does the company that owns the underlying system maintain the server? A vendor-maintained server tracks the vendor’s API, inherits its permission model and has an owner who ships security fixes.

Each server below was checked against its maintainer’s documentation or repository in September 2026. That check turned up two warnings worth acting on. The reference servers in the modelcontextprotocol/servers repository are described by the project as reference implementations for demonstrating MCP features, not production-ready solutions. And several servers that once lived there, including PostgreSQL, GitHub, Slack and Google Drive, have moved to an archive whose README says they are no longer maintained and come with no security guarantees. If a team installed one of those in 2025, find it and replace it.

Enterprise MCP servers compared

Developer and cloud platform servers

GitHub MCP Server

GitHub’s official server connects agents to repositories, issues, pull requests, Actions, code security findings and more. The hosted endpoint at https://api.githubcopilot.com/mcp/ accepts OAuth, which GitHub recommends, or a personal access token, and the same server runs locally as a container image or a Go binary. Two settings matter most in an enterprise rollout: toolsets, which expose only the groups of tools a use case needs, and read-only mode, which removes write tools entirely. The server is MIT licensed and supports GitHub Enterprise Cloud with data residency.

Microsoft’s MCP servers

Microsoft keeps a catalogue of its official servers in the microsoft/mcp repository, which is the place to check before trusting a Microsoft-branded server found anywhere else. The three most enterprises meet first:

• Azure MCP Server lets agents work with Azure resources through natural-language requests. It authenticates with Entra ID through the Azure Identity library, and tool availability follows the caller’s Azure RBAC permissions. Microsoft’s documentation states that the local server is intended strictly for developer use within your organisation, a line worth copying straight into internal policy.
• Microsoft Learn MCP Server is a remote endpoint at https://learn.microsoft.com/api/mcp that searches and fetches Microsoft’s official documentation. It needs no authentication and exposes only public content, which makes it a low-risk first approval.
• Work IQ MCP exposes Microsoft 365 data such as mail, calendar events and Teams chats through ten generic tools that act on resource paths. It authenticates with Entra ID, and Microsoft says fine-grained access is enforced per path, method and tenant policy rather than through a long list of narrow OAuth scopes.

The catalogue also lists servers for Azure DevOps, Microsoft SQL, Playwright, Microsoft Fabric and Microsoft Sentinel data exploration.

AWS MCP servers

AWS Labs maintains an Apache 2.0 repository of MCP servers covering AWS documentation, infrastructure as code, Lambda, DynamoDB and RDS, EKS and ECS, and Bedrock and SageMaker. Most are servers you run yourself. The AWS MCP Server is the exception: AWS hosts it and describes IAM-based permissions and CloudTrail audit logging for the calls made through it.

Google’s managed MCP servers

In December 2025 Google announced fully managed remote MCP servers for BigQuery, Google Maps, Compute Engine and Kubernetes Engine. Access is controlled through Google Cloud IAM, tool use is audit-logged, and Model Armor is offered as a defence against threats such as indirect prompt injection. The same announcement named Apigee as the way to publish an organisation’s own APIs as governed MCP tools, and listed further Google Cloud services as coming later.

Collaboration and business application servers

Atlassian Rovo MCP Server

Atlassian’s remote server connects AI clients to Jira, Confluence and related Atlassian Cloud products. Atlassian describes it as a secure proxy that works within the signed-in user’s permissions and the organisation’s admin controls, secured with OAuth, and admins can add or block client domains to keep a trusted list. Two details belong in any approval record: rate limits run from 500 to 10,000 calls per hour depending on plan, and Atlassian states that the server does not currently support FedRAMP or HIPAA requirements.

Slack MCP server

Slack’s server lives at https://mcp.slack.com/mcp and speaks JSON-RPC over Streamable HTTP. It can search messages, files and users, read channels and threads, send and schedule messages and manage canvases. Its access model is stricter than most. Every MCP client must be backed by a registered Slack app with a fixed app ID using confidential OAuth and user tokens, only directory-published or internal apps may connect, workspace admins approve each integration, and MCP activity appears in audit logs.

Salesforce DX MCP Server

Salesforce maintains an Apache 2.0 server in its salesforcecli GitHub organisation that runs locally over stdio. It only works with orgs you have already authorised through the Salesforce CLI, and it offers more than 15 toolsets covering metadata, data operations, code analysis, Lightning Web Components, DevOps Center, mobile and testing. It is built for people developing on an org rather than for business users querying CRM records.

Databases, files and the official registry

Databases are where teams most often reach for an unvetted server, because the old reference PostgreSQL server was the standard example in early MCP tutorials. That server is now archived.

MCP Toolbox for Databases, maintained by Google under Apache 2.0, is an actively developed alternative. It supports PostgreSQL, MySQL, MariaDB, SQL Server, Oracle, MongoDB, Redis and Elasticsearch, along with AlloyDB, BigQuery, Cloud SQL and Spanner. Tools are declared in a tools.yaml file as parameterised queries with defined inputs. That is the property a reviewer should insist on: an agent limited to named, parameterised queries is far easier to reason about than one handed a raw SQL tool. Microsoft’s catalogue also lists a Microsoft SQL MCP server.

The reference servers still in the MCP project (Everything, Fetch, Filesystem, Git, Memory, Sequential Thinking and Time) are good for learning and testing. Treat Filesystem and Fetch as components to sandbox: one reads and writes local files, the other pulls arbitrary web content into the model’s context.

For discovery, the official MCP Registry was in preview at the time of writing. It stores metadata, not server code, and verifies namespace ownership through GitHub sign-in for io.github names and DNS or HTTP challenges for domain names. A verified namespace proves who published a listing, not that the server behind it is safe.

Remote or local: what the transport changes

The transport decides who operates the server and where your data travels.

Local servers over stdio run on a user’s machine or your own host with that process’s privileges. The MCP security best-practices page warns that a local server from an untrusted source can execute arbitrary commands, and asks clients to show the exact startup command, require explicit consent and run the server in a sandbox with minimal default privileges. Local or self-hosted servers are also the only option inside an air-gapped estate.

Remote servers over Streamable HTTP are operated by the vendor, which patches them and usually maps permissions onto the user’s existing account. In exchange, tool inputs and outputs pass through the vendor’s infrastructure, and the OAuth consent your users grant becomes part of your attack surface.

Neither is safer by default. Local servers move the risk to your supply chain and endpoints; remote servers move it to identity and data-flow review. Most enterprises will run both: vendor-hosted servers for SaaS systems that already hold the data, and self-hosted servers for internal systems that must stay inside the perimeter.

A checklist for approving an MCP server

The specification is plain that MCP cannot enforce security at the protocol level; implementors are expected to build consent, access control and logging around it. Its security best-practices page and its section on tools supply most of this list.

1. Verify the publisher. Confirm the server comes from the system’s vendor or a maintainer you have assessed, match the package name or endpoint to the vendor’s own documentation, and reject archived or unmaintained code.
2. Grant the smallest scopes. The spec recommends a minimal initial scope set with step-up authorization for privileged operations, and lists wildcard or omnibus scopes as a common mistake. Use read-only modes where they exist.
3. Allowlist tools, not just servers. Approving a server should not approve every tool it exposes. Enable only the toolsets a use case needs, and require human confirmation for tools that write, delete or send.
4. Treat tool output as untrusted input. The spec tells clients to validate tool results before passing them to the model, and to treat tool annotations as untrusted unless they come from a trusted server. Text pulled from an issue, an email or a web page can carry instructions aimed at the agent, so one tool’s output should never silently authorise a call to another.
5. Reject token passthrough. MCP servers must accept only tokens issued for them and must not forward a client’s token to downstream APIs. Ask each vendor how its server validates the token audience.
6. Log every call. The spec recommends that clients log tool usage for audit. Record the agent, the user or role it acted for, the tool, the arguments and the result, next to the model decision that produced the call.
7. Control network egress. For self-hosted servers and clients, block requests to private address ranges and cloud metadata endpoints during OAuth discovery, and send outbound traffic through an egress proxy, as the spec’s SSRF guidance advises. Our note on egress control covers the network side.
8. Pin versions and review changes. Pin the package version or container digest you approved and review again when the tool list changes. A server that gains a write tool in a minor release has changed its risk class.

The wider control set for agents that act on real systems is in the agent security handbook.

How VDF AI fits

VDF AI’s MCP gateway applies this discipline to the tools its own agents use. Internal systems such as Jira, GitHub, GitBook, Slack and your own APIs are exposed through an MCP server layer that runs inside your perimeter, on-premises, in a private cloud or air-gapped. An administrator grants tools per role in the registry, and an agent can use only what its role holds. Every tool call is written to the audit trail with the agent, the role, the tool and its parameters, next to the model decision that led to it, and actions that write can require approval.

That registry governs what VDF AI Agents may call. Connections your teams make directly from other MCP clients to vendor-hosted servers, such as GitHub’s or Atlassian’s, sit outside it, so the checklist above still applies to them. To try the mechanics hands-on, the MCP lesson in VDF Academy walks through connecting an agent to tools.

Sources

• MCP specification 2026-07-28
• MCP transports
• MCP authorization
• MCP security best practices
• MCP tools and their security considerations
• MCP reference servers
• Archived MCP servers
• Official MCP Registry
• GitHub MCP Server
• Microsoft MCP catalogue
• Azure MCP Server overview
• Microsoft Learn MCP Server
• Work IQ MCP overview
• AWS MCP servers
• Google managed MCP servers announcement
• MCP Toolbox for Databases
• Atlassian Rovo MCP Server
• Slack MCP server
• Salesforce DX MCP Server