MCP integrations
Connect AI agents to your internal tools
The Model Context Protocol (MCP) lets Claude Code, Cursor, and other agents work against your real systems — safely, with auth and audit. Pick a tool to see how to wire it up, and what a production setup needs.
Observability
Observability systems are the highest-value, lowest-risk first MCP connection: an agent that can read your metrics, traces, and logs debugs alongside you instead of asking you to paste graphs. Keep it strictly read-only and the blast radius is near zero.
Project management
Connecting the tracker closes the loop between a code change and the work item behind it: the agent reads the spec it is implementing and updates status without a human relaying it. OAuth per user and team scoping keep it honest.
Code & VCS
Source-control access lets an agent open PRs, read issue context, and inspect failing CI — the difference between an agent that suggests code and one that ships a reviewable change. Scope tokens to specific repos and gate the write actions.
Databases
Databases are where read-only scoping and a dedicated replica matter most. An agent that can inspect schema and draft queries is transformative for debugging and data questions — but it must never hold write credentials to a primary, and expensive unbounded scans need a statement timeout.
Data & warehouse
Warehouse access turns an agent into an analyst that writes and explains its own queries. The governance that matters here is cost (bytes scanned / warehouse time) and row-level access to sensitive tables — both are solvable, neither is optional.
Infra & cloud
Cloud and orchestration access is the highest-stakes MCP connection and the one to lock down hardest: read-mostly IAM/RBAC, a firm boundary on anything destructive, and a human gate on state changes. Done right, agents become excellent at diagnosis without being able to cause an outage.
Comms & docs
Docs and comms access give an agent the context that lives outside the repo — the spec, the decision, the channel where it was made — and a way to report back. Scope to the right spaces and prevent noisy or unauthorized posting.
Payments & business
Business-system access is where a wrong write moves money or touches a customer record, so the rule is absolute: read-only by default, restricted keys, and a hard human gate on anything that mutates. The value is answering real questions against live data, safely.
AI coding clients
These are the MCP clients themselves — the tools your engineers already drive. The work here is configuration and team standardization: shared server config, credentials handled correctly, and a golden path so everyone gets the same tools.
Claude Code
→Anthropic’s terminal-native coding agent. Discovers MCP servers from your project or user config, calls their tools in the middle of a task, and (for headless use) can be driven from CI.
Cursor
→AI-native code editor (VS Code fork). Adds MCP support in its settings so any MCP server’s tools show up alongside Cursor’s own agent and inline-edit flows.
How to connect any MCP server
The wiring is the same for every tool on this page — only the server and its credentials change. Each tool page covers those specifics; here’s the shared flow.
Claude Code
- Pick or build the MCP server for your tool (see the tool’s page for whether an official or community server exists).
- Register it with
claude mcp add <name> <command> [--env KEY=VALUE]. Project config lives in.mcp.json(commit it to standardize the team); user config in~/.claude/mcp.json. - Provide credentials out of band — from the environment or a secret store, never hardcoded in the repo.
- Restart Claude Code (or run
/mcp) so it discovers the server’s tools, then confirm the expected tools appear. - Run a read-only task first to validate scope before granting any write access.
Cursor
- Open Cursor → Settings → MCP and add the server (command or URL + transport).
- Commit
.cursor/mcp.jsonso every engineer gets the same tools. - Supply credentials via env or Cursor’s secret storage — not the committed file.
- Reload Cursor and verify the tools appear; pair with a
.cursorrulesfile so agents use them inside your golden path.
If tools don’t appear, it’s almost always auth or transport — see MCP server not connecting, and note hosted servers often need OAuth rather than a plain API key.
The MCP security checklist
A working connection is the easy part. This is what separates a safe, team-wide integration from a liability — it applies to every tool on this page.
- Scope every credential to the minimum access the task needs — never a full-access token.
- Default to read-only; add write actions one at a time, deliberately.
- Log every tool call with who, what, and when, queryable from your observability stack.
- Keep credentials out of the repo and the agent’s sandbox — inject them at the boundary from a secret store.
- Gate high-impact or irreversible actions (writes, deploys, money movement) behind explicit human approval.
- Run a read-only smoke test to validate scope before granting any write access.