Guides7 min read

Best MCP Servers for API Development in 2026

Essential MCP servers for REST and GraphQL API developers. From OpenAPI spec management to database access and testing — build better APIs with AI assistance.

By MyMCPTools Team·

Building APIs — whether REST, GraphQL, or gRPC — involves constant context-switching between your database schema, code, tests, and documentation. MCP servers let your AI assistant hold all of that context simultaneously, making API development faster and more accurate.

Why API Developers Need MCP

API development is fundamentally about contracts: the shape of your data, your endpoints, your authentication, your error codes. When your AI assistant has direct access to your actual database schema and existing codebase, it generates code that respects those contracts instead of guessing at them.

1. Filesystem MCP Server — Codebase Navigation

Before writing API code, your AI needs to understand your project structure: where are your route handlers? What middleware exists? How are errors handled? The filesystem server provides that project-wide context.

API development win: Ask your AI to find all route handlers that lack authentication middleware. It can scan your entire routes directory and flag every unprotected endpoint.

2. GitHub MCP Server — API Design Reviews

APIs evolve through pull requests, and design reviews benefit enormously from AI assistance that understands your full API surface. The GitHub MCP server lets your AI review PRs with access to your endpoint history, breaking change detection, and documentation drift.

Best use case: When a PR adds a new endpoint, your AI can check GitHub for similar existing endpoints, review the PR for consistency with your API conventions, and flag any breaking changes to existing consumers.

3. PostgreSQL / Supabase MCP Server — Schema-Aware Query Generation

API endpoints are almost always wrappers around database queries. When your AI can directly inspect your schema — table names, column types, foreign keys, indexes — it generates SQL and ORM code that's actually correct on the first attempt.

Key capabilities:

  • Schema introspection for accurate query generation
  • Index awareness for performance optimization
  • Foreign key traversal for join query writing
  • Migration history awareness

Best for: REST API developers using PostgreSQL as their primary data store. Eliminates the most common source of "it almost worked" in API development.

4. Redis MCP Server — Caching Strategy Design

Most production APIs use Redis for caching, rate limiting, and session storage. The Redis MCP server gives your AI visibility into your cache architecture — what keys exist, what TTLs are set, and what data is cached where.

API-specific use: Ask your AI to review your caching strategy for a specific endpoint. It can inspect your actual Redis keyspace and suggest TTL optimizations or identify cache invalidation gaps.

5. Sentry MCP Server — Production Error Analysis

When your API fails in production, Sentry tells you where and why. The Sentry MCP server puts that error data in front of your AI assistant, so it can help you debug with actual stack traces, affected endpoints, and error frequency data.

Key capabilities:

  • Error grouping and frequency analysis
  • Stack trace inspection
  • Release regression tracking
  • User impact assessment

Best for: Any API team with production traffic. Turns "we're getting errors" into "here's the root cause and proposed fix" in minutes.

6. Playwright MCP Server — API Contract Testing

Playwright isn't just for UI testing — it can test your API endpoints directly with HTTP request interception and response validation. Your AI can write comprehensive API contract tests that verify your endpoint behavior across edge cases.

API testing patterns:

  • Request/response contract validation
  • Authentication flow testing
  • Rate limit behavior verification
  • Error response format consistency checks

Best for: API teams committed to contract testing. Your AI can generate test suites from your OpenAPI spec.

7. Brave Search MCP Server — Spec and Standards Lookup

API development requires constant reference to standards — OAuth 2.0 flows, JWT format specs, OpenAPI 3.1 schema syntax, HTTP status code semantics. The Brave Search server brings current specifications into your AI's context without tab-switching.

Practical example: When implementing PKCE OAuth flow, your AI can fetch the current RFC and generate a correct implementation rather than working from its training data alone.

The API Developer's MCP Setup

A well-configured API development environment needs:

  1. Filesystem — Project structure and code navigation
  2. PostgreSQL or Supabase — Schema-aware database access
  3. Redis — Caching layer visibility
  4. Sentry — Production error monitoring
  5. GitHub — Version control and code review

Add Playwright for testing automation and Brave Search for documentation lookups as your needs grow.

Explore all API and web MCP servers or browse database MCP servers for more backend development tools.

Recommended Tools

Better Stack

Free Plan

Get alerted when your APIs, browser tests, payment pipelines, or MCP server dependencies go down. Used by 100K+ developers.

Start monitoring free →

1Password

14-day Free Trial

Store and inject API keys, payment credentials, tokens, and file access secrets into your MCP server configs. Trusted by 150K+ developers.

Try 1Password free →

🔧 MCP Servers Mentioned in This Article

📁

Filesystem MCP Server

sandboxed read, write, edit, move and search access to an explicit whitelist of local directories, and it is the reference implementation most other filesystem MCP servers are modelled on. Shipped by Anthropic in the official modelcontextprotocol/servers monorepo (89,000+ stars, actively maintained), it is a Node.js server published to npm as @modelcontextprotocol/server-filesystem. The part worth understanding before you install is the access-control model, because there are now two ways to grant directories and they do not compose. Method one is command-line arguments: `npx -y @modelcontextprotocol/server-filesystem /path/one /path/two`. Method two, and the one the maintainers recommend, is MCP Roots — a client that supports the roots protocol sends its roots at initialization, and those roots COMPLETELY REPLACE any directories passed on the command line, then get replaced again on every `notifications/roots/list_changed`. That means allowed directories can change at runtime without restarting the server, but it also means a roots-capable client silently overrides your CLI arguments. If the server starts with no arguments and the client either does not support roots or sends an empty list, initialization throws an error. The tool surface is broad: `read_text_file` (with mutually exclusive `head`/`tail` line windows), `read_media_file` returning base64 image/audio content blocks, `read_multiple_files` which keeps going when individual reads fail, `write_file`, `edit_file`, `create_directory`, `list_directory`, `list_directory_with_sizes`, `move_file`, `search_files`, `directory_tree`, `get_file_info` and `list_allowed_directories`. `edit_file` is the one to learn — it does line-based and multi-line pattern matching with indentation detection and preservation, returns a git-style diff with context, and supports `dryRun: true` so you can preview a change before applying it; the maintainers recommend always running a dry run first. Every operation is refused outside the allowed set, and `list_allowed_directories` is the fastest way to confirm what the server actually believes it can touch.

Local
💻

GitHub MCP Server

authenticated access to the whole GitHub platform — repositories, files, branches, issues, pull requests, Actions runs, security alerts, discussions and notifications — from Claude, Cursor, VS Code, Copilot CLI and any other MCP host. There is no npm package for this server, and that trips up most people who try to install it: `@github/mcp-server` is not published to the npm registry, so any `npx` line you find for it will fail. GitHub ships it three other ways. The easiest is the hosted remote server at https://api.githubcopilot.com/mcp/, which needs no install at all — point an HTTP-transport MCP client at that URL and log in with OAuth (VS Code 1.101+, Claude Desktop, Claude Code, Cursor and Windsurf all support this). The second is the official Docker image ghcr.io/github/github-mcp-server, which is what the copy-paste command on this page runs; on github.com it now performs a browser-based OAuth login on first use and keeps the token in memory only, which is why the published Docker configs map a fixed loopback callback port (-p 127.0.0.1:8085:8085 with GITHUB_OAUTH_CALLBACK_PORT=8085) so the container can receive the callback. Prefer a token? Set GITHUB_PERSONAL_ACCESS_TOKEN instead — it takes precedence over OAuth, and the minimum useful scopes are repo, read:org and read:packages. The third is the native Go binary from the repository's releases, which needs no fixed port for the OAuth flow. GitHub Enterprise Server has no hosted option: use the local server with --gh-host or GITHUB_HOST set to your instance (include the https:// scheme — it defaults to http://, which GHES rejects). Toolsets can be narrowed with GITHUB_TOOLSETS, and an insiders channel is available at /mcp/insiders or via the X-MCP-Insiders header.

Auth required📘
🗄️

PostgreSQL MCP Server

The PostgreSQL MCP server was the Model Context Protocol reference server for Postgres, and it is retired: the source now sits in modelcontextprotocol/servers-archived — a repository GitHub reports as archived, described as "Reference MCP servers that are no longer maintained" — and the npm package @modelcontextprotocol/server-postgres carries a deprecation notice reading "Package no longer supported." It still installs and still runs, which is why most third-party setup articles have not caught up. What it provides is deliberately small: a single tool, query, which executes read-only SQL inside a READ ONLY transaction, plus per-table schema information exposed as MCP resources at postgres://<host>/<table>/schema, with column names and data types discovered from database metadata. There is no index advice, no health check, no separate schema-listing tool, and no write mode. Install is npx @modelcontextprotocol/server-postgres with a postgres:// connection string as the argument. For active work against Postgres, the maintained alternative is Postgres MCP Pro (crystaldba/postgres-mcp), which exposes nine tools including index tuning against hypothetical indexes and a database health check, and has an explicit restricted access mode; if your database is hosted on Supabase or Neon, their platform servers add branching and logs that a raw Postgres connection cannot see. Reach for this archived server only when you want the smallest possible surface — one process, one read-only query tool, nothing else.

Local📘
🗄️

Redis MCP Server

The Redis MCP Server (redis/mcp-redis) is Redis's own natural-language interface for agentic applications, letting an AI client read and write Redis data over the Model Context Protocol. Note which one you install: the server most tutorials still point at is Anthropic's reference implementation, which now lives in modelcontextprotocol/servers-archived, and its npm package @modelcontextprotocol/server-redis is explicitly marked "Package no longer supported" with a last publish of 2025-04-25. The maintained server is a Python package instead, run with uvx --from redis-mcp-server@latest, and it covers far more of Redis than the reference one did: string, hash, list, set and sorted-set tools; JSON document tools; pub/sub with stateful channel and pattern subscriptions; Streams tools including consumer-group create, read, acknowledge and destroy; vector index management and vector search through the query engine; a docs search tool; and a server-management tool for database info. Connection is a redis:// or rediss:// URL passed as --url, or the REDIS_HOST/REDIS_PORT/REDIS_PWD/REDIS_SSL environment variables, with Redis Cluster mode behind REDIS_CLUSTER_MODE and EntraID service-principal, managed-identity and default-credential auth flows for Azure Managed Redis. There is no --read-only flag: the documented way to stop an agent writing is a Redis ACL user (ACL SETUSER readonlyuser on >pw ~* +@read -@write). Ships as a PyPI package, a GitHub install via uvx, and an official mcp/redis Docker image; stdio transport only.

Local📘
🔧

Sentry MCP Server

The Sentry MCP Server is Sentry's official Model Context Protocol integration, purpose-built for human-in-the-loop coding agents like Claude Code, Cursor, and Windsurf. Rather than exposing every Sentry API endpoint, it focuses tightly on developer debugging workflows: searching and triaging issues, pulling stack traces and event details, inspecting performance traces, and querying project/team/org metadata in natural language. The primary deployment is a hosted remote MCP server at mcp.sentry.dev, built on Cloudflare's remote-MCP infrastructure, so most users connect with zero local setup — just add the remote URL to their client. For self-hosted Sentry instances or local development, a stdio transport is also available via npx @sentry/mcp-server, authenticated with a Sentry User Auth Token scoped to org:read, project:read, project:write, team:read, team:write, and event:write. AI-powered search tools (search_events, search_issues) translate natural-language queries into Sentry's query syntax, but require a configured LLM provider (OpenAI, Azure OpenAI, Anthropic, or OpenRouter) — all other tools work without one. Claude Code users can also install it as a plugin (claude plugin install sentry-mcp@sentry-mcp) for automatic subagent delegation whenever a conversation touches Sentry errors, issues, or traces. This turns "why did this deploy break in production" into a direct conversational debugging session instead of tab-switching into the Sentry dashboard.

Auth required📘
🔍

Brave Search MCP Server

The Brave Search MCP Server is the official server from Brave that gives AI assistants privacy-first web search through the independent Brave Search API — no tracking, no profiling, and results drawn from Brave's own web index rather than Google or Bing. It exposes five distinct tools that map directly to the Brave Search API endpoints: brave_web_search for general queries with pagination, freshness filters, and safe-search controls; brave_local_search for businesses, restaurants, and points of interest with automatic location filtering; brave_news_search for recent articles and current events; brave_image_search for image discovery; and brave_video_search for finding videos across the web. Authentication uses a single BRAVE_API_KEY (free tier available at brave.com/search/api) or a mounted BRAVE_API_KEY_FILE for Docker-secret setups. Install in Claude Desktop, Cursor, Windsurf, or VS Code with one npx command and choose stdio or streamable-HTTP transport. Because Brave operates its own crawler and index, the Brave Search MCP server is a strong choice for developers who want an alternative to Google-dependent search tools, need reproducible non-personalized results, or care about data privacy in agent workflows — Claude can pull fresh web context, verify facts, and research topics without leaking queries to ad-tech pipelines.

Local
🌍

Playwright MCP Server (ExecuteAutomation)

ExecuteAutomation's Playwright MCP Server is a community-maintained browser automation server (5,500+ GitHub stars) distinct from Microsoft's official microsoft/playwright-mcp — it leans further into test generation and visual workflows rather than pure accessibility-tree navigation. Beyond standard navigate/click/fill/screenshot tools, it can generate Playwright test code from a live browsing session, scrape full page content and structured data, execute arbitrary JavaScript in the page context, and drive API testing (GET/POST/PUT/PATCH/DELETE requests) alongside the browser tools. A standout feature is 143 real device presets for responsive testing — a single call like playwright_resize({ device: "iPhone 13" }) swaps in the correct viewport, user-agent, touch support, and device pixel ratio, and natural-language prompts like "test on iPad landscape" work directly through Claude. Install via `npm install -g @executeautomation/playwright-mcp-server`, Smithery, mcp-get, or the one-line `claude mcp add --transport stdio playwright npx @executeautomation/playwright-mcp-server` for Claude Code; VS Code one-click installers are also published. No API keys are required — it launches and drives a local Chromium/Firefox/WebKit browser directly. Choose this over Microsoft's official server when you specifically need auto-generated Playwright test scripts, JS execution, or device-emulation testing; choose Microsoft's for pure lightweight accessibility-tree page navigation. One maintenance fact the listings omit, checked against GitHub and npm on 2026-08-15: this repository has not been pushed since 2025-12-13 and npm 1.0.12 was published 2025-12-12, with 32 issues open. It is neither archived nor deprecated, so nothing warns you at install time — it installs, connects and works while its Playwright dependency drifts, whereas Microsoft's server ships continuously. Weigh the codegen, 143-preset device emulation and HTTP request tools against running an eight-month-old build. Note also that headless defaults to false on playwright_navigate, so it opens a visible browser window unless told otherwise, and that stdio-mode logging goes only to ~/playwright-mcp-server.log to keep the JSON-RPC stream clean.

Local📘
🗄️

Supabase MCP Server

Supabase MCP Server connects Cursor, Claude Code, Claude Desktop, Windsurf and other MCP clients to a Supabase project, and the first thing to know is that the personal access token setup most guides still describe is gone. Supabase now runs a hosted server at https://mcp.supabase.com/mcp using OAuth 2.1 with dynamic client registration — you add the URL, your client opens a browser, you pick the organization, and there is no PAT to mint or rotate. For Claude Code that is `claude mcp add --scope project --transport http supabase "https://mcp.supabase.com/mcp"` followed by `/mcp` in a plain terminal (not the IDE extension) to run the auth flow. Three URL query parameters do the real configuration work: `read_only=true` runs every statement as a read-only Postgres role, `project_ref=<id>` scopes the server to one project and drops the account-management tools entirely, and `features=` selects the tool groups. Those groups are database (list_tables, list_extensions, list_migrations, apply_migration, execute_sql), debugging (get_logs across API/Postgres/Edge Functions/Auth/Storage/Realtime, plus get_advisors for security and performance findings), development (get_project_url, get_publishable_keys, generate_typescript_types), Edge Functions (list, get, deploy), account management, docs search, experimental branching on paid plans, and storage — storage is the one group disabled by default. Running Supabase locally with the CLI exposes a reduced server at http://localhost:54321/mcp with no OAuth; self-hosted installs are similar. The npm package `@supabase/mcp-server-supabase` still exists for stdio clients and also exports `createToolSchemas()` so Vercel AI SDK users get typed tool inputs and outputs. Read Supabase's security best-practices page before pointing this at anything with production data — the mutating tools are real.

Auth required📘

📚 More from the Blog