MCP Server Configuration Starter

When to use this

Setting up MCP servers for a project. Start smaller than you think you need. Every server's tool definitions occupy your context window on every request, whether you use them or not.

Save at .mcp.json in the project root to share with your team, or configure globally for personal use.

The template

{
  "mcpServers": {
    "context7": {
      "command": "npx",
      "args": ["-y", "@upstash/context7-mcp@latest"]
    },
    "playwright": {
      "command": "npx",
      "args": ["@playwright/mcp@latest"]
    },
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/absolute/path/you/choose"
      ]
    }
  }
}

What each one is for

Context7 pulls current library documentation into context. This fixes the most common failure in agent written code: using an API that changed after the model's training cutoff. Cheap, safe, useful in almost every project.

Playwright gives the agent a real browser. Add it if you want the agent to check its own frontend changes. Skip it for backend work.

Filesystem is only needed for paths outside your current project, since most harnesses already have project file access. Set the path deliberately and narrowly.

Adding a server with credentials

Never put a token directly in this file, especially if it is committed. Use environment variable expansion:

{
  "mcpServers": {
    "github": {
      "command": "docker",
      "args": ["run", "-i", "--rm", "-e", "GITHUB_PERSONAL_ACCESS_TOKEN", "ghcr.io/github/github-mcp-server"],
      "env": { "GITHUB_PERSONAL_ACCESS_TOKEN": "${GITHUB_TOKEN}" }
    }
  }
}

Then set GITHUB_TOKEN in your shell, not in the repository.

Rules worth following

Add a server when you notice a repeated manual step, not in advance.

Scope every token to the minimum permission that works. A token with full access makes the agent as powerful as you are.

Remember that anything a server returns reaches your model provider. Think before connecting production data.

Content from external servers is untrusted input. Be careful about combining a server that reads public content with a server that can write to something that matters.

If your tool list is getting long, remove servers rather than accepting the context cost. Fewer, well chosen tools produce better decisions than many.