Magic Tools
Claude GuidesBy CooconApril 13, 2026550 views2 min read

Claude Code MCP: Connect External Tools and Data Sources

What Is MCP

Model Context Protocol (MCP) is an open protocol by Anthropic that defines a standard communication layer between AI models and external tools. Through MCP, Claude Code can connect to databases, call APIs, and interact with third-party services, extending its capabilities far beyond code editing.

MCP uses a client-server architecture: Claude Code acts as the MCP client, communicating with MCP servers via the standard protocol. Each MCP server exposes a set of tools that Claude can invoke on demand.

Configuring MCP Servers

Add MCP server configurations to .claude/settings.json:

{
  "mcpServers": {
    "github": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-github"],
      "env": {
        "GITHUB_TOKEN": "ghp_your_token_here"
      }
    },
    "filesystem": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-filesystem", "/path/to/allowed/dir"]
    },
    "sqlite": {
      "command": "npx",
      "args": ["-y", "@modelcontextprotocol/server-sqlite", "--db-path", "./data.db"]
    }
  }
}

Restart Claude Code after adding configurations, and the external tools become available in your conversations.

Server Capabilities Package
GitHub Manage issues, PRs, repos @modelcontextprotocol/server-github
Filesystem Secure file system access @modelcontextprotocol/server-filesystem
SQLite Query SQLite databases @modelcontextprotocol/server-sqlite
PostgreSQL Query PostgreSQL databases @modelcontextprotocol/server-postgres
Slack Send messages, manage channels @modelcontextprotocol/server-slack
Memory Persistent cross-session memory @modelcontextprotocol/server-memory

Find more community-built MCP servers in the MCP Servers repository.

Writing a Simple MCP Server

Build a custom MCP server in TypeScript:

import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
import { z } from "zod";

const server = new McpServer({ name: "my-server", version: "1.0.0" });

server.tool(
  "get_weather",
  "Get weather information for a city",
  { city: z.string().describe("City name") },
  async ({ city }) => {
    const data = await fetch(`https://api.weather.com/${city}`);
    return { content: [{ type: "text", text: JSON.stringify(await data.json()) }] };
  }
);

const transport = new StdioServerTransport();
await server.connect(transport);

Security Considerations

  • Principle of least privilege: Only grant MCP servers the permissions they actually need
  • Protect secrets: Pass API keys via the env field; never hardcode them in configuration
  • Network isolation: For MCP servers accessing internal services, ensure proper network access controls
  • Audit third-party servers: Review source code of community MCP servers before using them

FAQ

Do MCP servers need to run continuously?

No. Claude Code automatically starts configured MCP server processes on launch and shuts them down when the session ends. You don't need to manage server lifecycles manually.

Can I use multiple MCP servers in one project?

Yes. Configure as many servers as needed in mcpServers. Claude automatically selects the appropriate tool for each task. Tools from all servers are merged into Claude's available tool list.

What programming languages can I use to write MCP servers?

The official MCP SDK is available in TypeScript and Python. Community implementations exist for Rust, Go, Java, and more. Any language can be used as long as it follows the MCP protocol specification.

Related Articles

Reproducing an Injection Chain That Cracks Claude Code Auto Mode: the Model Refuses the Malicious Binary, Then Writes Code That Pwns Itself

In late August embracethered published an attack chain where a plain 'summarize this page' request drags auto-mode Claude Code to a 60–80% code-execution rate — while Anthropic's commissioned third-party test reported 0.00%. I took the chain apart and tested it stage by stage in an isolated environment: the endpoint that nudges the model from WebFetch to curl, and the crux — the model's own 'safe' decision to refuse the unknown binary and write its own Python decoder instead lands straight on a same-name struct.py planted in the extracted directory. The deterministic parts (branching + module-shadow poison + mitigation controls) reproduce fully on my machine with real evidence; the live end couldn't complete a full RCE here because the classifier rate-limited and failed closed — flagged honestly. Ends with mitigations that actually help.

claude-codeauto-mode+5
hands-onAug 31, 20269 min
109

Cracking Open Claude Code's Auto-Mode Classifier: A 116K-Char System Prompt, Dissected Line by Line

My earlier retest confirmed auto mode calls the session model as a classifier before each risky Bash — but what it receives stayed a black box. This time I captured the full request: a 116,879-char system prompt opening 'You are a security monitor for autonomous AI coding agents.' I quote it verbatim to dissect the threat model, two-tier rules (1 HARD BLOCK / 68 SOFT BLOCK / 17 ALLOW), and two-stage evaluation — stage 1 grades harm only, stage 2 layers intent on top. Every number read out this session.

claude-codepermissions+5
hands-onAug 30, 202612 min
158
Turn a Home Mac mini Into an Always-On Claude Code Workstation: claudecodeui + SSH Reverse Tunnel, Take Over Sessions From Any Browser

Turn a Home Mac mini Into an Always-On Claude Code Workstation: claudecodeui + SSH Reverse Tunnel, Take Over Sessions From Any Browser

A Mac mini at home runs Claude Code around the clock — but how do you take over a session from a browser when you're away? This is a real setup that has been live for a week and in daily use: claudecodeui as the web UI (chosen over the official web version, ttyd, and code-server), an SSH reverse tunnel pushing it to a VPS, and nginx adding TLS plus login rate limiting to turn it into an ordinary URL. Includes full configs, real operating numbers (five days of tunnel uptime with zero drops, 170MB RSS), a <synthetic> placeholder bug hit and fixed within the first week, and an honest for-and-against on why not Tailscale.

claude-codeclaude-code-lab+7
claudeAug 29, 202612 min
157

You Set ANTHROPIC_BASE_URL. Claude Code Ignored It.

I exported ANTHROPIC_BASE_URL in .zshrc to point at a self-hosted API gateway, and Claude Code kept talking to Google Vertex anyway. On the same machine, a launchd-managed web UI insisted it wasn't authenticated at all. Neither bug was in the gateway — both were in the gap between 'I set the env var' and 'the process actually has it.'

claude-codebug-postmortem+2
pitfallsAug 24, 20264 min
233

Published by Magic Tools