What is an MCP server?
An MCP server is a small program that gives an AI model a set of tools for one app or service, such as reading your calendar, creating a Linear issue or searching a Drive folder, through the Model Context Protocol, an open standard Anthropic introduced in November 2024. AI apps such as Claude, ChatGPT, Kiro and many code editors act as MCP clients: they connect to servers and let the model call their tools.
MCP in one minute
Before MCP, every AI app needed its own custom connection to every service. MCP replaces that with one protocol:
- An MCP server wraps one app or service and describes what it can do.
- An MCP client is the AI app you use. It connects to servers and shows their tools to the model.
- The model decides when to call a tool, and with what, while it works on your request.
A server can offer three kinds of things: tools, which are actions the model can call, such as “list unread emails”; resources, which are data it can read, such as a file; and prompts, which are ready-made instructions. Tools are the part that turns a chat model into an agent.
Read tools and write tools
Not all tools are equal. Listing your channels is harmless. Posting to one isn’t, and deleting a message is worse.
MCP lets a server label each tool with hints: readOnlyHint says the tool doesn’t change anything, and destructiveHint says it may delete or overwrite. These hints come from the server’s author, so a careful client treats a tool without them as one that writes.
Ditto AI does exactly that. If a server doesn’t say, Ditto goes by the tool’s name, and if it still can’t tell, it counts the tool as a write. It never calls a write tool to check that a server works.
Local and hosted servers
| Local server | Hosted server | |
|---|---|---|
| Where it runs | On your computer, started by the client | On the vendor’s servers |
| How it’s installed | Usually one command, with npx (Node) or uvx (Python) | Nothing to install; you connect to a URL |
| How you sign in | A key or a credentials file, set in its environment | Usually OAuth: you sign in with the vendor in your browser |
| Good for | Apps on your Mac, and services without a hosted server | Big web services that publish their own |
Hosted servers are increasingly common for large services, while local servers cover everything else, including apps that only exist on your Mac.
Where MCP servers come from
- The official MCP Registry, run by the MCP project, lists public servers with their packages and how to run them. When Ditto AI mirrored it in September 2026, it held about 36,700 servers.
- npm and PyPI, where many servers are published as packages, sometimes under the vendor’s own scope, such as
@calcom/cal-mcpfor Cal.com. - Vendors’ own sites, for hosted servers.
- Community directories, which help with discovery but vary in how carefully they check what they list.
With tens of thousands of servers, most popular apps have several, from the vendor’s official one to weekend projects. Picking the right one matters.
How to choose a good MCP server
Check these, roughly in this order:
- Who publishes it? A server from the vendor itself, under its namespace or GitHub organisation, is the safest bet.
- Does it do what you need? Look for the specific actions your task requires, such as read, search, create, send, edit or delete. A server that runs but can’t do the job is worse than none.
- Is it maintained? Recent releases and an active repository matter more than star counts.
- Are its tools labelled? Read-only and destructive hints make it much easier to limit what an agent can do.
- How does it sign in? Prefer OAuth or a key you can scope and revoke. Be wary of servers that ask for your password, or route your credentials through a third party.
- Local or hosted? Hosted is simpler if the vendor runs it. Local means the code runs on your machine, so trust the publisher.
How Ditto AI picks servers for you
When you record a task, Ditto AI needs a tool for every step that used your account. It chooses one with fixed rules, so the same recording always gets the same choice:
- A server already set up on your Mac comes first.
- A server that can’t do what the steps need, is deprecated, or scrapes an account’s website is ruled out.
- Servers Ditto’s own catalog trusts for that app come next.
- The rest are scored: the vendor’s own servers score highest, then the vendor’s GitHub organisation, Docker’s catalogue and verified listings, with community servers last. Vendor-hosted servers score above local ones, and servers that proxy your credentials through a third party lose points. Servers that cover the step, and name the app, score higher.
- Ties break on the name, so the result never depends on luck.
The model helps rank candidates, but it can’t add one. Every candidate comes from the registry or npm, and anything else is thrown out. Then Ditto proves the choice works: it starts the server, completes the MCP handshake and makes one real, read-only call. If a key or a sign-in is needed, Ditto reads the server’s own README to find out exactly what, and asks you for it. You see the choice, and the reason for it, before anything runs.
Is MCP safe?
MCP is a protocol, so its safety depends on the servers you connect and the client that uses them. The main risks:
- Too much access. A server with broad permissions lets a model do more than you intended.
- Untrusted code. A local server runs on your machine with your permissions.
- Instructions hidden in content. A web page or email can contain text written to steer the model. Keep writes behind review, especially when the agent reads outside content.
- Stored credentials. Keys should be stored where only you can read them, never in a prompt or a shared note.
The fix is the same as for any automation: give the agent only the tools its task needs, keep writes visible, and be able to stop it. Is it safe to let an AI agent use your accounts? has a checklist.