MCP Server Reference

Server Inventory

Server	Transport	Source	Auth Method
github	http	setup.sh (user scope)	OAuth via /mcp command
playwright	stdio	compound-engineering plugin	None
context7	http	compound-engineering plugin	None
Granola	managed	claude.ai connector	Anthropic-managed
Asana	managed	claude.ai connector	Anthropic-managed
Atlassian	managed	claude.ai connector	Anthropic-managed
Gmail	managed	claude.ai connector	Anthropic-managed
Google Calendar	managed	claude.ai connector	Anthropic-managed
HubSpot	managed	claude.ai connector	Anthropic-managed

Removed servers

azure-devops was removed in SPEC-218: no skill, agent, command or hook used its tools. It follows the same rules as taskmaster-ai below, with its own toolkit-written entries: exactly the stdio entry npx @azure-devops/mcp@2.5.0 visitrans or npx @azure-devops/mcp visitrans, with no environment variables. Any other entry, for example one carrying a PAT in its settings, is yours and stays. The install messages and the read-only check under taskmaster-ai apply unchanged with azure-devops as the name. The server keeps running in sessions that were already open until you restart them.

To keep using Azure DevOps in one project, add it in local scope from that project's directory: claude mcp add -s local azure-devops -- npx @azure-devops/mcp@2.5.0 visitrans. Installs never remove a local-scope entry. Version 2.5.0 signs in through your browser by default and does not read AZURE_DEVOPS_PAT; it reads a token only when started with --authentication envvar, and then from ADO_MCP_AUTH_TOKEN. Prefer the browser sign-in: a token exported in your shell profile is visible to every process you start (see below). Never pass a token with -e or put it in an env block: that stores it in plain text in .claude.json. Do not add the server in user scope as claude mcp add -s user azure-devops -- npx @azure-devops/mcp@2.5.0 visitrans or the same without @2.5.0: both write exactly an entry the toolkit wrote, so the next install removes it again. A kept entry is your own exception to the governed list; the hardening guide (Step 5) says what that costs, including that npx fetches and runs the package when it is not cached and no toolkit hook vets it.

Revoke AZURE_DEVOPS_PAT in Azure DevOps (User settings › Personal access tokens) and delete the export AZURE_DEVOPS_PAT=… line from your shell profile, whether or not you keep the server, unless something outside the toolkit uses it. The old setup asked for write scopes, the server it was exported for never read it, and an exported variable is visible to every process you start, including every command an agent runs. If any azure-devops entry, in user or local scope, holds a token in its env, that token also sits in plain text in .claude.json and possibly in older backups of it: revoke it; removing the entry alone is not enough.

taskmaster-ai was removed in SPEC-213: nothing in the toolkit used it. An install removes only the user-scope entry the toolkit registered itself: exactly the stdio entry npx task-master-ai@0.43.0 or npx task-master-ai that setup.sh wrote, with no environment variables or other settings. It leaves every other taskmaster-ai entry in place, and it never removes local-scope entries.

What the install printed tells you where you stand:

• Removed toolkit-registered taskmaster-ai: the user-scope entry is gone.
• taskmaster-ai — not configured, nothing to retire or taskmaster-ai — … not found, nothing to retire: there was no user-scope entry. A local-scope entry may still exist (see below).
• Anything else means the user-scope entry, if you have one, is still there: taskmaster-ai — left in place, any taskmaster-ai warning (for example python3 missing, the config file unreadable, not a regular file, its directory missing or not searchable, CLAUDE_CONFIG_DIR set but empty, CLAUDE_CODE_CUSTOM_OAUTH_URL set, a legacy .config.json present, or the remove failed or timed out), Claude CLI not found — skipping MCP server setup, or a run that stopped before MCP setup. Test and sandbox runs skip MCP setup entirely and print MCP server registration — $HOME is not the real home (sandbox/test run).

setup.sh --verify no longer checks taskmaster-ai, and claude mcp get or claude mcp list start the server. To see whether a user-scope entry is still there without starting it, read the config (this prints only whether it exists, never its settings, which can hold keys):

python3 -c 'import json,os; p=os.path.join(os.environ.get("CLAUDE_CONFIG_DIR") or os.path.expanduser("~"), ".claude.json"); d=json.load(open(p)) if os.path.isfile(p) else {}; s=d.get("mcpServers") if isinstance(d, dict) else None; print("user-scope entry present" if isinstance(s, dict) and "taskmaster-ai" in s else "no user-scope entry")'

This check reads .claude.json only. Do not rely on it after the install warned about CLAUDE_CONFIG_DIR set but empty, CLAUDE_CODE_CUSTOM_OAUTH_URL or a legacy .config.json: in those cases Claude may be using a different file, which is why the install removed nothing.

If the install removed an entry you had added yourself, do not add it back with the same command: claude mcp add -s user taskmaster-ai -- npx task-master-ai writes exactly the entry the toolkit wrote, so the next install removes it again. Add it in a form the toolkit never wrote, for example claude mcp add -s user taskmaster-ai -- npx -y task-master-ai.

To remove an entry yourself:

• User scope: claude mcp remove taskmaster-ai -s user.
• Local scope, from a pre-SPEC-058 install: run claude mcp remove taskmaster-ai -s local in the project directory where the entry was registered. Anywhere else, the command reports "not found" even though the entry exists. To find that directory without starting the server, read the config instead of calling claude mcp get:

  python3 -c 'import json,os; p=os.path.join(os.environ.get("CLAUDE_CONFIG_DIR") or os.path.expanduser("~"), ".claude.json"); d=json.load(open(p)) if os.path.isfile(p) else {}; pr=d.get("projects") if isinstance(d, dict) else None; [print(k) for k,v in (pr.items() if isinstance(pr, dict) else []) if isinstance(v, dict) and isinstance(v.get("mcpServers"), dict) and "taskmaster-ai" in v["mcpServers"]]'
  

An entry you keep is outside the governed list, and the hardening guide says to remove servers that are not on the list.

Environment Variables

No governed server requires environment variables. GitHub uses OAuth (see below).

Authentication

OAuth Servers (GitHub)

The GitHub MCP server uses OAuth authentication managed by Claude Code:

1. Run setup.sh --safe to register the server
2. Open Claude Code in any project
3. Run /mcp to see the authentication status
4. Follow the OAuth flow to authorize GitHub access
5. Verify with claude mcp list — github should show "Connected"

Scope Precedence

Claude Code resolves MCP servers using this precedence (highest first):

1. Local scope (~/.claude.json local entries) — project-specific overrides
2. Project scope (.mcp.json in project root) — per-repo server definitions
3. User scope (~/.claude.json user entries) — cross-project defaults

The toolkit uses user scope for team-wide servers so they are available in every project. If a local-scope entry exists for the same server name, it shadows the user-scope entry. The migrate_mcp_servers() function in setup.sh removes known local-scope entries to prevent this shadowing.

Adding Custom Servers

For project-specific MCP servers, create a .mcp.json file in the project root:

{
  "mcpServers": {
    "my-project-server": {
      "command": "npx",
      "args": ["my-mcp-server"],
      "type": "stdio"
    }
  }
}

This is project-scoped and does not affect other projects. See SPEC-025 for details.

Rollback

To reverse all MCP server installations from setup.sh:

claude mcp remove github -s user

This removes only the user-scope entries added by the toolkit. Plugin-provided servers (playwright, context7) and Anthropic-managed servers (Granola, Asana, etc.) are unaffected.