MCP servers for DevOps engineers: what to install in 2026

DevOps, platform and cloud engineers want Claude Code or Codex reading pull requests, cloud accounts, clusters and dashboards, without handing an agent the keys to production. You will get the servers I think are worth installing, the commands for both tools, the least-privilege setting for each, and how to contain prompt injection that arrives through tool output.

Context7 and Playwright are part of my own Claude Code setup. Every command below was checked against the vendor’s own documentation or repository on 11 November 2026.

What an MCP server can actually do

An MCP server gives the agent tools, and those tools act with whatever credential you handed the server. There are two shapes:

• Local (stdio): a process Claude Code or Codex starts on your machine. It runs with your user privileges, and when a plugin starts it, Claude Code runs it outside the sandbox.
• Remote (HTTP): the vendor runs the server and you sign in with OAuth or send a token.

Anthropic is explicit that it “does not security-audit or manage any MCP server”. The trust decision is yours, which is why the credential matters more than the server.

Plugins can bring servers with them. Claude Code’s official marketplace has plugins that wire up GitHub, Terraform, Playwright, Context7, Sentry, Datadog and Grafana for you. They save typing, but you still need to read the plugin’s .mcp.json to see what it starts and which credential it expects. My list of Claude Code and Codex plugins covers how to vet one.

Adding servers to Claude Code

Remote servers use --transport http. Run /mcp inside a session to finish an OAuth sign-in.

claude mcp add --transport http sentry https://mcp.sentry.dev/mcp
claude mcp add --transport http context7 https://mcp.context7.com/mcp

Local servers take the command after --:

claude mcp add --transport stdio playwright -- npx @playwright/mcp@latest

--scope decides where the entry lives. local (the default) and user are stored in ~/.claude.json; project writes .mcp.json in the repository for the team. In .mcp.json you can reference environment variables, so the token never lands in the file:

{
  "mcpServers": {
    "github": {
      "type": "http",
      "url": "https://api.githubcopilot.com/mcp/readonly",
      "headers": { "Authorization": "Bearer ${GITHUB_PAT}" }
    }
  }
}

A token passed with --header becomes part of the server entry in ~/.claude.json, and your shell history. Prefer OAuth or the variable form.

Adding servers to Codex

Codex keeps servers in ~/.codex/config.toml, or .codex/config.toml for trusted projects.

codex mcp add context7 -- npx -y @upstash/context7-mcp
codex mcp add github --url https://api.githubcopilot.com/mcp/readonly --bearer-token-env-var GITHUB_PAT
codex mcp add sentry --url https://mcp.sentry.dev/mcp
codex mcp login sentry

The TOML form gives you controls the CLI does not. enabled_tools is an allow list, and default_tools_approval_mode = "writes" prompts for any tool the server does not mark read-only:

[mcp_servers.github]
url = "https://api.githubcopilot.com/mcp/readonly"
bearer_token_env_var = "GITHUB_PAT"
default_tools_approval_mode = "writes"

The servers worth installing

GitHub

GitHub’s official server runs remotely at https://api.githubcopilot.com/mcp/. The default toolsets are context, issues, pull_requests, repos and users. Append /readonly to any URL to keep only read tools, or pick one toolset with a URL such as /mcp/x/actions/readonly.

Least privilege: a fine-grained personal access token limited to the repositories you need, with read-only permissions, plus the /readonly URL.

Caution: issue bodies and pull request comments are written by strangers on public repositories. GitHub’s lockdown mode (the X-MCP-Lockdown: true header) only surfaces public-repository content from users with push access. GitHub calls it “a best-effort content filter”, not an authorisation boundary.

AWS

The managed AWS MCP Server, part of the Agent Toolkit for AWS, replaces the older AWS API and AWS Knowledge MCP servers; AWS recommends removing those to avoid tool conflicts. It covers the AWS APIs, sandboxed script execution and documentation search, and logs requests to CloudTrail.

OAuth is the simple path:

claude mcp add aws-mcp https://aws-mcp.us-east-1.api.aws/mcp --transport http
codex mcp add aws-mcp --url "https://aws-mcp.us-east-1.api.aws/mcp?oauth=initialize"

AWS recommends SigV4 through the MCP Proxy for AWS for terminal agents such as Claude Code and Codex, and only that path offers a read-only mode that hides write-capable tools:

codex mcp add aws-mcp -- uvx mcp-proxy-for-aws-cli@latest \
  https://aws-mcp.us-east-1.api.aws/mcp --profile readonly --read-only

Least privilege: a dedicated read-only role or profile. AWS also offers IAM condition keys that tell agent actions apart from human ones, so a policy can allow only read actions through the MCP server even when your own role can write.

Caution: --read-only filters by the tools’ read-only annotation. The IAM role is the real control.

Cloudflare

Cloudflare’s API server at https://mcp.cloudflare.com/mcp covers the whole Cloudflare API with three tools using what Cloudflare calls code mode: the agent searches the API and runs code against it. Cloudflare puts the cost at about 1,100 tokens of context, against more than 244,000 for one tool per endpoint, and caps each result at about 6,000 tokens.

claude mcp add --transport http cloudflare-api https://mcp.cloudflare.com/mcp
codex mcp add cloudflare-api --url https://mcp.cloudflare.com/mcp

Least privilege: on the OAuth consent screen you choose permissions; pick only what the task needs. For automation, use an API token with the same narrow scope.

Caution: if the grant includes DNS write, an agent running code against your account can change DNS. Several of Cloudflare’s older product-specific servers now carry a notice asking users to migrate to this one. The documentation server at https://docs.mcp.cloudflare.com/mcp needs no account access.

Terraform

HashiCorp’s Terraform MCP Server reads the public registry (providers, modules, policies) and, with a token, HCP Terraform and Terraform Enterprise workspaces.

claude mcp add terraform -s user -t stdio -- docker run -i --rm hashicorp/terraform-mcp-server
codex mcp add terraform -- docker run -i --rm hashicorp/terraform-mcp-server

Least privilege: no token at all for registry lookups. Add TFE_TOKEN only if you need workspace data, and use a token whose user or team can only read. Leave ENABLE_TF_OPERATIONS at its default of false; it gates the tools that need explicit approval. --toolsets accepts registry, registry-private, terraform, all and default.

Caution: the official Claude marketplace’s terraform plugin pins the Docker image at 0.4.0, while the latest release on GitHub is v1.4.1. A plugin-installed server is only as current as the plugin’s pin, so check it.

Kubernetes

The containers/kubernetes-mcp-server project is a Go implementation that talks to the Kubernetes API directly instead of wrapping kubectl. Its guide has you create a dedicated mcp-viewer ServiceAccount bound to the built-in view ClusterRole, write a kubeconfig for it, and set read_only = true in a TOML file:

claude mcp add-json kubernetes-mcp-server \
  '{"command":"npx","args":["-y","kubernetes-mcp-server@latest","--config","'"${HOME}"'/.config/kubernetes-mcp-server.toml"],"env":{"KUBECONFIG":"'${HOME}'/.kube/mcp-viewer.kubeconfig"}}' \
  -s user

Least privilege: the view role. Kubernetes documents that it “does not allow viewing Secrets”, because reading them would expose ServiceAccount credentials.

Caution: runtime flags such as --read-only are no longer accepted, so older tutorials fail. The project calls read_only “a best-effort guardrail” that does not change what the identity can do in the cluster.

Grafana, Datadog and Sentry

Install the one you already run.

Grafana: mcp-grafana runs with uvx and reads GRAFANA_URL and a service account token. GRAFANA_SERVICE_ACCOUNT_TOKEN_FILE keeps the token out of your MCP config. --disable-write removes create and update tools, and also the raw SQL tools, because query_sql will run a DROP TABLE if the datasource credentials allow it.

claude mcp add --env GRAFANA_URL=https://example.grafana.net \
  --env GRAFANA_SERVICE_ACCOUNT_TOKEN_FILE=/path/to/token \
  --transport stdio grafana -- uvx mcp-grafana --disable-write

Datadog: a hosted server. For the US1 site, claude mcp add --transport http datadog-mcp https://mcp.datadoghq.com/v1/mcp. Limit tools with a toolsets query parameter in Claude Code, or the X-Datadog-MCP-Toolsets header in Codex, then codex mcp login datadog. It uses the signed-in user’s own Datadog permissions, so a read-only user cannot call write tools.

Sentry: https://mcp.sentry.dev/mcp with OAuth. The README documents ?skills= and ?disable-skills= parameters to narrow the tools. For self-hosted Sentry, the Sentry CLI runs a stdio server with sentry mcp.

Playwright and Context7

Playwright lets the agent drive a real browser, which is useful for checking a deploy or reproducing a front-end bug. The README states plainly that “Playwright MCP is not a security boundary”. By default it keeps a persistent profile, so logins survive between sessions; --isolated keeps the profile in memory. Microsoft also notes that coding agents may do better with its Playwright CLI and skills, which cost fewer tokens than MCP.

Context7 serves current library documentation. It works anonymously; an API key, sent as a bearer token, raises rate limits. npx ctx7 setup configures it for you. It is the lowest-risk server here, but the documentation it returns is still third-party text entering your context.

Scope credentials like a production service account

The rule: an MCP server gets its own identity, never your personal admin session.

Server	Credential	Least-privilege setting
GitHub	Fine-grained PAT or OAuth	Selected repositories, read-only permissions, /readonly URL
AWS	OAuth or SigV4 profile	Read-only role, --read-only, agent-specific IAM conditions
Cloudflare	OAuth or API token	Only the permissions the task needs
Terraform	None, or TFE_TOKEN	Registry toolsets only, operations off
Kubernetes	Kubeconfig	view ServiceAccount, read_only = true
Grafana	Service account token file	Viewer-level role, --disable-write
Datadog	OAuth as your user	Read-only Datadog role, narrow toolsets
Sentry	OAuth or user token	Narrow skills

Three habits make this hold up:

1. Read-only flags are not permissions. GitHub, AWS, Kubernetes and Grafana all describe their read-only modes as filters on tools. The credential decides what can happen.
2. Separate read and write servers. If you need writes, add a second entry with a different name and credential, and approve its calls by hand.
3. Keep tokens out of shared files. Use OAuth, ${VAR} expansion in .mcp.json, bearer_token_env_var in Codex, or a token file. Codex’s docs note that config.toml can hold an OAuth client secret, so keep it private and out of version control.

The MCP specification’s own security guidance says the same about scopes: start with a minimal set and ask for more only when a privileged operation needs it.

Prompt injection comes back through tool output

Every tool result goes into the model’s context. An issue body, a pull request comment, a log line, a Sentry error message, a Kubernetes annotation, a web page or a README can all carry text written to steer the agent. Simon Willison calls the dangerous combination the lethal trifecta: “access to your private data”, “exposure to untrusted content” and “the ability to externally communicate”. A DevOps agent with GitHub, a browser and a cloud account has all three.

What helps:

• Split sessions by risk. Read a public issue tracker in one session; touch production accounts in another.
• Deny or ask by server in Claude Code. Permission rules match MCP tools as mcp__<server>__<tool>, and allow globs only work after a literal server prefix:

{
  "permissions": {
    "allow": ["mcp__github__get_*"],
    "ask": ["mcp__aws-mcp__*"],
    "deny": ["mcp__playwright__*"]
  }
}

• Use approval modes in Codex. default_tools_approval_mode = "writes", with enabled_tools for servers you only half trust.
• Keep output caps. Claude Code warns when a tool returns more than 10,000 tokens and caps output at 25,000 by default (MAX_MCP_OUTPUT_TOKENS). Raising the cap gives injected text more room.
• Review project servers. Claude Code asks before it starts servers from a cloned repository’s .mcp.json, but a -p session shows no prompt. Plugins can add servers too, so claude mcp list is the full picture, not the file.
• Turn on lockdown for the GitHub server when you work on public repositories.
• Review code the agent writes with a separate pass. An injected instruction that survives into a commit is a supply-chain problem. The skills in security review skills for AI coding agents are one way to add that pass.

None of this makes injection impossible. Anthropic’s own advice includes running tool calls in a virtual machine when the agent touches external web services.

A small recommended set

For a new DevOps workstation, this is the set I recommend:

1. Context7 for documentation.
2. GitHub on the /readonly URL with a fine-grained token, lockdown on for public repositories.
3. One cloud server that matches your estate: the AWS MCP Server through the proxy with --read-only and a read-only profile, or Cloudflare’s API server with minimal OAuth permissions.
4. Terraform for registry lookups, with no token and operations off.
5. Kubernetes with the mcp-viewer ServiceAccount, if you debug clusters from the terminal.
6. One observability server you already pay for, in read-only form.
7. Playwright only when a task needs a browser, started with --isolated.

The same rules apply to servers you write. I built a multi-model routing MCP server that sends work across Claude, Codex, Gemini, Cloudflare Workers AI and local LM Studio models, and the rules above apply to it as much as to any vendor’s server: it should hold only the credentials it needs, and nothing it returns should be read as instructions.

Least-privilege checklist

• Add remote servers with claude mcp add --transport http or codex mcp add --url, and sign in with OAuth where offered.
• Give every server its own least-privilege identity; read-only flags are a second layer, not the first.
• Use GitHub’s /readonly URL, AWS --read-only, Grafana --disable-write, Kubernetes read_only = true and Terraform with operations off.
• Keep tokens out of .mcp.json and config.toml with variables, token files or OAuth.
• Treat every tool result as untrusted input, keep output caps, and never combine private data, untrusted content and outbound access in one unattended session.
• Check what version a plugin pins before you trust the server it starts.