Best MCP servers for business teams in 2026, with the risk of each

Why a list of servers needs a risk column

Five sources we read agree on the frame, and none of them says which server is best.

• Microsoft’s Zero Trust guidance says a server that reads calendar metadata is a different thing from one that can send email for users or write to a production database. It asks for a risk class, a named reviewer, and evidence of data scope, sign-in method and audit trail before any server is activated.
• AWS’s governance strategy gives a worked case. A user with full admin rights asks an agent to clone a production database. The task needs READ and CREATE. If the server reuses the user’s own credentials, a hallucinated clean-up step could delete the old database. A token scoped to READ and CREATE would make that attempt fail.
• Anthropic’s Claude Code docs say that by default anyone running Claude Code can connect any MCP server they choose, and that Anthropic reviews directory connectors but does not security-audit or manage any server. Admins can pin a fixed set, or use allowlists and denylists.
• Cloudflare’s reference architecture (April 14, 2026) describes its own internal servers as default-deny on writes, with audit logging. It says a portal can expose only the read-only tools of a server to one group, such as finance. Cloudflare sells that portal, so read it as a vendor’s design, not a neutral standard.
• The OWASP MCP Top 10 names privilege escalation through scope creep (MCP02) and shadow MCP servers, meaning unapproved ones outside governance (MCP09). It is a beta draft, and its page says the next release is due in October 2026.

So the test for any server is two questions. What is the worst thing it can do with the access you give it? And what is the cheapest control that stops it? The ten entries answer both from the docs.

What each server can do, and what holds it back

Read the first grid by row. Every server reads and every server writes, so those rows decide nothing. The delete row separates the field: Salesforce, GitHub, Microsoft 365 and Stripe document deletes with wide reach, and Linear, Slack and Google Drive list none. Then read the second grid by column. Salesforce is the only column that is full in all four rows. Zapier and Stripe have the most half balls, three each. That tells you which vendor has done the control work for you and which has left it to you.

The 10 servers, in order

1. 01

   Salesforce Hosted MCP Servers

   Call: approve SObject Reads, gate Mutations, skip Deletes until a named owner asks

   Maintained by Salesforce. Its standard servers split by what they may do: SObject Reads (read and query only), SObject Mutations (create and update, no delete), SObject Deletes (delete only) and SObject All (everything). Product servers cover Data 360, Tableau Next, CMS content, Backup and Recover and more. Every call runs as the signed-in user, inside their object permissions, field-level security and sharing rules.

   Strengths

   • The only vendor here that splits read, change and delete into separate servers. Standard servers are off by default and an admin turns each one on.
   • Authorization-code flow with PKCE only. Salesforce says there are no service accounts, no machine-to-machine flows and no dynamic client registration. An admin creates the External Client App and can tie it to profiles and permission sets.
   • Calls show in standard API logs under the user’s name. Filter on API_CLIENT_CATEGORY = SALESFORCE_HOSTED_MCP.
   • Named Queries let an admin expose one slice of the data model as a reusable API instead of the full query surface.

   Limits

   • The safety net is the user’s own Salesforce permissions. An agent run by a user with broad rights has broad reach, so check the user, not only the server.
   • The all-in SObject server is described as full access with maximum productivity. It is the wrong first approval.

   Pricing Salesforce says Hosted MCP Servers are intended for customers with Flex Credits and that usage may be billed. We found no rate on the pages we read.Vendor page

2. 02

   Atlassian Rovo MCP Server (Jira, Confluence, Bitbucket and more)

   Call: approve Read and Search, gate Write per app, leave Delete and Manage off

   Maintained by Atlassian, hosted at mcp.atlassian.com. It reads Jira work items, Confluence content, Bitbucket, Jira Service Management, Loom recordings, goals and projects. It writes work items, transitions, comments, pages and attachments. Tools sit in permission groups (read, write, search, delete, manage) that organization admins grant or revoke.

   Strengths

   • The Permissions tab in Atlassian Administration turns Read, Write and Search on or off for the whole organization or per app. Changes apply at once, with no reconnect, and a blocked user sees a plain “not authorized” message.
   • The delete group (three Jira tools that permanently delete an issue, comment or attachment, “cannot be undone”) and the manage group (create and update Jira spaces) are disabled by default.
   • OAuth 2.1 by default. Admins can switch off API-token sign-in, restrict which AI tool domains may connect, and IP allowlists still apply.
   • Execution is split into read, write and destructive paths, so a client can ask for confirmation on each kind.

   Limits

   • The Confluence write group includes adding, removing and replacing content-level permission grants. An agent you let write can change who sees a page.
   • The Permissions tab has an “apply to future additions” setting. With it on, new tools in an allowed group reach users with no admin review. Check it.
   • Version 1 gives way to version 2 on March 1, 2027, when existing v1 use starts to expose v2 tools. Plan the re-review.

   Pricing Calls draw on a shared pool of Rovo credits. Thresholds are on Atlassian’s Rovo usage page, which we did not read.Vendor page

3. 03

   Linear MCP server

   Call: approve the /readonly endpoint, gate the default one

   Maintained and hosted by Linear at mcp.linear.app. It finds, creates and updates Linear objects such as issues, projects and comments. We found no tool list on the page we read and no mention of delete, so the delete cell is empty.

   Strengths

   • Read-only three ways: the /mcp/readonly URL that only ever exposes read tools, the standard endpoint with only the read OAuth scope requested, or an API key created with only the Read permission.
   • OAuth 2.1 for interactive setup. Enterprise-managed authorization through Okta lets Claude and other clients sign users in under your Okta access policies once SAML is set up.

   Limits

   • The default endpoint is read-write.
   • It also accepts a bearer token or API key, which is a standing credential outside the sign-in flow.
   • The page we read describes no admin allowlist and no audit trail.

   Pricing Not stated on the page we read.Vendor page

4. 04

   GitHub MCP Server

   Call: approve read-only mode, gate everything else with excluded tools

   Maintained by GitHub, whose README calls it “GitHub’s official MCP Server”. It runs remote or local. It reads repositories, issues, pull requests, Actions runs and security alerts. It writes files, pushes, opens and merges pull requests, triggers workflows and creates rulesets. Delete tools include delete_file and delete_repository, both listed under Repositories, a toolset in the default set.

   Strengths

   • Read-only mode by header (X-MCP-Readonly), by URL (/readonly) or by flag. It outranks every other setting and removes write tools even if you ask for them by name.
   • Toolsets and an exclude list (for example create_pull_request and merge_pull_request) let you cut a server down tool by tool.
   • Lockdown mode limits public-repository content to users with push access, to cut prompt-injection risk from untrusted text.

   Limits

   • Out of the box the default toolsets include repos and pull requests, so write and delete tools are present until you remove them. delete_repository asks for the delete_repo OAuth scope.
   • GitHub calls lockdown a best-effort filter, not an authorization boundary.
   • Sign-in is OAuth or a personal access token, and on the local server a token wins if both are set. The controls sit in client config. We read no org-wide admin console for it.

   Pricing Not stated on the pages we read.Vendor page

5. 05

   Microsoft 365 (Work IQ MCP server)

   Call: gate. Approve reads only, and leave the change policy at its default

   Maintained by Microsoft. One endpoint offers generic tools over Microsoft Graph paths: fetch, create_entity, update_entity, delete_entity and do_action, plus tools that ask Microsoft 365 Copilot and retrieve grounding content. Microsoft’s own examples read email, read Teams chat messages, create calendar events and send mail.

   Strengths

   • A policy layer judges each request by path, operation and content. By default it blocks every change: create, update, delete and actions such as sending email. An admin can enable supported ones in the Microsoft 365 admin center, under Agents, then Tools.
   • Reads are capped. Collection reads default to 25 items and top out at 100, chat messages stop at 10 per request, and raw files default to 4 MB.
   • Microsoft Entra sign-in, with the person’s own Microsoft 365 permissions still applied on top.

   Limits

   • The widest read surface in this list: mail, Teams chats, files and calendars, from one connection.
   • In the first release policy is one switch for the whole tenant. Per-user, per-app and per-agent policy are not part of it, and changes can take up to 24 hours.
   • The Ask permission is described as read and write access to resources Work IQ agents can reach, and it needs admin consent. The retrieve tool is in public preview.

   Pricing Not stated on the pages we read.Vendor page

6. 06

   Slack MCP server

   Call: gate. Approve the client, then keep scopes to what the task needs

   Maintained by Slack, at mcp.slack.com. It searches messages, files, channels and users, and reads channel history, threads and canvases. It sends messages, creates channels, adds reactions, writes canvases, uploads files and edits lists. The tool list has no delete tool. Direct-message search and history sit behind their own scopes.

   Strengths

   • Workspace admins approve and manage every MCP client. Only apps published in the Slack Marketplace and internal apps may use MCP. Unlisted apps are barred.
   • Confidential OAuth with a scope per tool, such as chat:write for sending and channels:history for reading. Dynamic client registration is not supported.
   • Slack points to audit logs for MCP activity, and IP allowlists apply.

   Limits

   • No read-only mode. A client that requests only read scopes cannot send, but that is the client app’s choice and the admin approves the app as a whole.
   • It sends messages as the person. A wrong post from an agent carries the person’s name.
   • Slack itself warns against mixing servers, since each has its own security and stability traits.

   Pricing Not stated on the page we read.Vendor page

7. 07

   Notion MCP

   Call: gate. Pick the tools per connection, and mind what its search reaches

   Maintained by Notion, at mcp.notion.com. It searches and reads pages, databases and meeting notes, creates and updates pages, databases, views and comments, and moves pages. Delete tools move pages or whole databases to Trash.

   Strengths

   • Workspace owners manage client access in Settings, and organization owners can list and revoke members’ connections through the Admin API. Workspace-owned connections list only the tools an admin selected.
   • Deletes are soft. The tools move items to Trash, can be restored, are marked destructive for clients that honor it, and refuse to run without an explicit confirmation flag.
   • OAuth sign-in as the person.

   Limits

   • With AI search, one search call runs across Notion plus the Slack, Mail, Calendar, Google Drive and Jira sources the person has connected. A Notion approval widens your read surface.
   • Limiting which clients members can connect needs the Enterprise plan.
   • No read-only mode is described. The audit trail is not covered on the pages we read.

   Pricing AI search needs a Business or Enterprise plan with Notion AI. Otherwise search is keyword only.Vendor page

8. 08

   Google Drive MCP server

   Call: gate until it leaves Developer Preview

   Maintained by Google, at drivemcp.googleapis.com. It has eight tools: search_files, read_file_content, download_file_content, get_file_metadata, get_file_permissions, list_recent_files, copy_file and create_file. The page is marked Developer Preview and last updated October 12, 2026. Gmail, Calendar, Docs, Sheets, Chat and Classroom each have their own server.

   Strengths

   • The smallest tool list here. We see no update, delete or share tool.
   • OAuth 2.0 only, with two scopes (drive.readonly and drive.file) added in your own Google Cloud project, and the agent inherits the person’s permissions.
   • Google tells you to screen prompts and responses for injection, and offers Model Armor for that.

   Limits

   • Developer Preview: you must join the Workspace Developer Preview Program, and anything can change.
   • Google’s own warning says a host can read, modify and delete data in a Google Account, while the Drive tool list has no delete tool. Read the tool list, and re-check when it changes.
   • The other Workspace servers are separate approvals. Gmail asks for compose rights and Chat for message creation.

   Pricing Not stated on the pages we read.Vendor page

9. 09

   Stripe MCP server

   Call: skip the write tools for general teams, gate reads for finance only

   Maintained by Stripe, at mcp.stripe.com. Its read tool runs any Stripe API GET method. Its write tool runs any POST, PATCH, PUT and DELETE method. Other tools open Atlas company formation and, in public preview, move money in Treasury: send_money, transfer_money and convert_currency.

   Strengths

   • Stripe requires a human to click an approval link before certain writes, such as refunds and outbound payments. The approval expires after 24 hours.
   • OAuth consent can grant different permissions for each live account or sandbox. Admins can switch MCP on or off for the team, separately for live mode and sandbox, and revoke any person’s sessions.
   • Agent API keys for autonomous clients carry only the permissions you choose, and the Dashboard marks them with an Agent badge.

   Limits

   • One write tool reaches most of the API. Stripe’s own advice is to turn on your client’s tool-approval setting and to take care when other servers are connected.
   • By November 30, 2026, move off full-access secret keys and restricted keys without the Agent tag. From December Stripe MCP stops accepting them.
   • The page names a log of MCP tool calls in Workbench but we did not read it, so the audit cell is half.

   Pricing Not stated on the page we read.Vendor page

10. 10

    Zapier MCP

    Call: skip agentic mode. Gate managed mode with a short list

    Maintained by Zapier. It connects an AI client to 9,000+ apps and 40,000+ actions, such as sending messages, creating tasks and updating records, through the same connections your Zaps use. Its tools can also delete workflows and skills. Whether a given app action deletes data depends on the app, and we did not check all of them.

    Strengths

    • Managed mode: you pick the tools in advance and the agent uses only those.
    • SOC 2 Type II, SAML SSO, and a History tab of tool calls that superadmins can read for any user. MCP events also reach the account audit log.
    • Users cannot bring in tools from third-party sources. Zapier says that prevents tool poisoning.

    Limits

    • The default is agentic mode. The agent searches for, enables and runs actions itself during the conversation. That is the reverse of an allowlist.
    • MCP is on by default for every account, Enterprise included. Switching it off for a workspace means asking your Zapier account manager.
    • App and action restrictions cannot be set for MCP alone. They apply to all of Zapier.

    Pricing Each successful call uses two tasks from your plan. Plan prices were not on the pages we read.Vendor page

Approve, gate, skip

• Approve

  Salesforce SObject Reads, Atlassian with Write blocked, Linear’s /readonly endpoint and GitHub in read-only mode. Each documents a way to hold the server to reading, and each lets you open writes later one tool at a time.

• Gate Microsoft 365

  for named groups, with the change policy left at its default. The read surface is mail, chats and files, so decide who gets that before anything else.

• Gate Slack

  by approving the client and checking which scopes it asks for. Posts go out under a person’s name, and direct messages are readable if the scope is granted.

• Gate Notion

  with a short tool list per connection, and decide whether its search may reach connected Slack, mail and Drive.

• Gate Google Drive

  as a pilot while it is in Developer Preview. The tool list is the safest here, and the status is the weakest.

• Skip Stripe writes

  unless finance owns them. The write tool reaches most of Stripe’s API, and the human-approval link covers only some actions, such as refunds and outbound payments.

• Skip Zapier’s default mode

  because the agent chooses its own tools. Use managed mode with a short list, or leave it out.

An approval path for a new server

Every vendor above publishes the facts you need. The work is putting them in order, so a request cannot skip from “can we connect this” to “connected” in one step.

Mistakes teams make

1. 01

   Treating “it uses the person’s permissions” as the control

   Salesforce, Microsoft, Notion and Google all say the agent inherits the user. That limits the agent to what the person can do, which for an admin is a great deal. AWS’s database example shows the gap: the task needed READ and CREATE, and the user could also DELETE.

   Do this todayRun agents under a role built for the task, not under an admin’s login.

2. 02

   Approving the app, not the tools

   A yes to “GitHub” or “Atlassian” is a yes to every tool in the default set. Approve a named tool list instead, and write it down.

   Do this todayStart from the read-only path and add one write tool per request.

3. 03

   Leaving auto-grant on

   Atlassian’s “apply to future additions” grants new tools in an allowed group with no review. Other vendors add tools too.

   Do this todayTurn the setting off and put a quarterly re-review in the calendar.

4. 04

   Not looking for the servers nobody approved

   Anthropic’s docs say anyone running Claude Code can connect any server by default. OWASP calls the unapproved ones shadow MCP servers. Cloudflare describes scanning gateway traffic for MCP calls to find them.

   Do this todayDeploy an allowlist before you publish the approved list. Shadow AI covers the people side.

What we read and left out

HubSpot. Its remote server is first-party, and its two pages disagree. The older MCP page lists CRM objects under “Read and write access”, then says the server has read-only access to standard records such as contacts and deals. The newer developer docs (marked Beta) list writes for CRM records, emails and published pages. We did not rank a server whose pages contradict each other. Ask HubSpot which one is current.

Cloudflare API MCP server. Official, and it covers 2,500-plus API endpoints through two tools, with OAuth where you pick the permissions to grant. It is infrastructure for engineers, not a business app, so it sits outside this list. Sentry. The pages we read say it uses OAuth and can be scoped to one organization or project, but list no permissions, so we could not fill the grid.

Sources

1. “Salesforce Hosted MCP Servers: Get Started.” Salesforce Developers, accessed October 16, 2026.
2. “Standard MCP Servers Reference.” Salesforce Developers, accessed October 16, 2026.
3. “SObject All MCP Server.” Salesforce Developers, accessed October 16, 2026.
4. “Security Best Practices (Hosted MCP Servers).” Salesforce Developers, accessed October 16, 2026.
5. “Get started with the Atlassian Rovo MCP Server.” Atlassian Support, accessed October 16, 2026.
6. “Supported tools (Atlassian Rovo MCP Server).” Atlassian Support, accessed October 16, 2026.
7. “Configure Atlassian Rovo MCP server permission.” Atlassian Support, accessed October 16, 2026.
8. “Control Atlassian Rovo MCP server settings.” Atlassian Support, accessed October 16, 2026.
9. “MCP server.” Linear Docs, accessed October 16, 2026.
10. “GitHub’s official MCP Server (README).” GitHub, accessed October 16, 2026.
11. “Server configuration guide.” GitHub, github-mcp-server repository, accessed October 16, 2026.
12. “Work IQ MCP overview.” Microsoft Learn, accessed October 16, 2026.
13. “Policy governance for Work IQ MCP.” Microsoft Learn, accessed October 16, 2026.
14. “Work IQ MCP tool reference.” Microsoft Learn, accessed October 16, 2026.
15. “Work IQ API permissions reference.” Microsoft Learn, accessed October 16, 2026.
16. “Define MCP Server and Tool Approval Policy.” Microsoft Zero Trust Assessment workshop guidance, accessed October 16, 2026.
17. “Slack MCP server overview.” Slack developer docs, accessed October 16, 2026.
18. “Supported tools (Notion MCP).” Notion Docs, accessed October 16, 2026.
19. “Security best practices (Notion MCP).” Notion Docs, accessed October 16, 2026.
20. “Configure the Drive MCP server.” Google for Developers, last updated October 12, 2026; accessed October 16, 2026.
21. “MCP Reference: drivemcp.googleapis.com.” Google for Developers, accessed October 16, 2026.
22. “Configure the Google Workspace MCP servers.” Google for Developers, accessed October 16, 2026.
23. “Model Context Protocol (MCP).” Stripe Documentation, accessed October 16, 2026.
24. “Zapier MCP overview.” Zapier Docs, accessed October 16, 2026.
25. “Zapier MCP security and governance.” Zapier Docs, accessed October 16, 2026.
26. “How Zapier MCP tools work.” Zapier Docs, accessed October 16, 2026.
27. “MCP governance strategy.” AWS Prescriptive Guidance, accessed October 16, 2026.
28. “Control MCP server access for your organization.” Claude Code Docs, Anthropic, accessed October 16, 2026.
29. Sharon Goldberg, Matt Carey and Ivan Anguiano. “Scaling MCP adoption: Our reference architecture for simpler, safer and cheaper enterprise deployments of MCP.” Cloudflare Blog, April 14, 2026.
30. “OWASP MCP Top 10.” OWASP Foundation, beta draft, accessed October 16, 2026.
31. “HubSpot MCP Server.” HubSpot Developers, accessed October 16, 2026.
32. “Integrate AI tools with the HubSpot MCP server.” HubSpot Docs, accessed October 16, 2026.
33. “Cloudflare’s own MCP servers.” Cloudflare Agents docs, last updated October 12, 2026; accessed October 16, 2026.
34. “Sentry MCP Server.” Sentry Docs, accessed October 16, 2026.
35. “Trust and governance.” Nolli, accessed October 16, 2026.

Plain-text copy: /blog/best-mcp-servers-for-business-teams-2026.md