# MCP server catalog

kosa8 carries a list of well-known MCP servers, each checked against its publisher's own repository or docs. Add one with a single command, from the desktop app, or by copying the command from the kosa8 Cloud dashboard. It runs the way every gateway server runs: in a sandbox of its own, with its tool definitions pinned, behind your org's MCP policy.

## Find one and add it

```
$ kosa8 mcp search github
$ kosa8 mcp info github
$ kosa8 mcp add github
GITHUB_PERSONAL_ACCESS_TOKEN:          # typed without echo
added github (github@remote)
$ kosa8 mcp serve
```

`kosa8 mcp search` looks in the curated list below and in the official [MCP Registry](https://registry.modelcontextprotocol.io). Registry results are what their publishers say about them, not reviewed by kosa8, and are added by their command: `kosa8 mcp add NAME --image node:24-alpine --egress-allow HOST -- npx -y PACKAGE@VERSION`. Without a network, or with `--offline`, only the curated list is searched.

Servers that work on files take the directory they may see: `kosa8 mcp add filesystem --dir ~/code/project`. It is shared read-only unless you add `--writable`. In a script, set the secrets in the shell and pass `--secrets-from-env` instead of being asked.

## What one step sets up

**A sandbox of its own**A local server runs the publisher's package, pinned to the version in the catalog, in a microVM named `mcp-ID`. It does not run as you and cannot see your files, apart from a `--dir` you share.

**Egress: only what it needs**Its sandbox may reach the package registry that installs it and the vendor's API hosts, nothing else. A server whose job is to reach arbitrary sites (fetch, the browser) or a database at an address you choose is marked *any host* below.

**Secrets out of reach**Tokens are typed once and kept in kosa8's owner-only secret store, never in `mcp-servers.json`, and nothing prints them back. A remote server's token is added as a header by the gateway on your computer and sent to that server's host only: no sandbox holds it. A local server's token goes into its own sandbox's environment, never the agent's; the agent only ever talks to the gateway.

**Pinned tools**The first time `kosa8 mcp serve` starts it, every tool definition is pinned. A changed description or a new tool is withheld until you look at it with `kosa8 mcp pins diff ID` and accept it. See [Tool servers](https://docs.kosa8.com/guides/mcp-servers/).

**Org policy first**With a signed MCP policy installed, a server no scope approves is refused at `kosa8 mcp add`, before you are asked for a token. The image (or, for a remote server, URL) allowlist of `kosa8 policy` is checked too.

Remote servers are reached through the gateway like local ones, so their tools are pinned, governed, argument-checked and audited the same way. The gateway's HTTP client refuses any request, redirect included, that is not for the server's own host.

## The catalog

Every entry here is published by the vendor whose service it serves, or by the MCP project. A community server would be marked *community* wherever it is shown. Remote servers that only accept an OAuth sign-in (Slack's, Google Cloud's) are not listed yet: kosa8 adds servers that take a token.

| Add with | Server | Runs as | Secrets | Egress | Risk |
|---|---|---|---|---|---|
| `kosa8 mcp add atlassian` | [Atlassian (Jira, Confluence)](https://support.atlassian.com/atlassian-rovo-mcp-server/docs/getting-started-with-the-atlassian-remote-mcp-server/) Atlassian, official | remote endpoint https://mcp.atlassian.com/v2/mcp, through the kosa8 gateway | ATLASSIAN_BASIC | the gateway reaches mcp.atlassian.com only | Reads and writes Jira issues and Confluence pages as the token's user. |
| `kosa8 mcp add aws-docs` | [AWS Documentation](https://github.com/awslabs/mcp/tree/main/src/aws-documentation-mcp-server) AWS Labs, official | uvx awslabs.aws-documentation-mcp-server@1.2.5 in its own sandbox | none | pypi.org, files.pythonhosted.org, docs.aws.amazon.com, proxy.search.docs.aws.com, api.contentrecs.docs.aws.com | Read-only search and fetch of AWS documentation. |
| `kosa8 mcp add aws-knowledge` | [AWS Knowledge](https://github.com/awslabs/mcp/tree/main/src/aws-knowledge-mcp-server) AWS, official | remote endpoint https://knowledge-mcp.global.api.aws, through the kosa8 gateway | none | the gateway reaches knowledge-mcp.global.api.aws only | Read-only AWS documentation; rate limited. |
| `kosa8 mcp add azure` | [Azure](https://github.com/microsoft/mcp/tree/main/servers/Azure.Mcp.Server) Microsoft, official | npx -y @azure/mcp@4.0.0-beta.7 server start in its own sandbox | AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET | registry.npmjs.org, management.azure.com, login.microsoftonline.com | Manages Azure resources with the service principal's roles; data-plane tools for some services need hosts beyond Azure Resource Manager. |
| `kosa8 mcp add brave-search` | [Brave Search](https://github.com/brave/brave-search-mcp-server) Brave, official | npx -y @brave/brave-search-mcp-server@2.1.4 in its own sandbox | BRAVE_API_KEY | registry.npmjs.org, api.search.brave.com | Search results are third-party text the model reads; spends the API key's quota. |
| `kosa8 mcp add cloudflare` | [Cloudflare API](https://github.com/cloudflare/mcp) Cloudflare, official | remote endpoint https://mcp.cloudflare.com/mcp, through the kosa8 gateway | CLOUDFLARE_API_TOKEN | the gateway reaches mcp.cloudflare.com only | Calls any Cloudflare API endpoint the token's permissions allow. |
| `kosa8 mcp add context7` | [Context7](https://github.com/upstash/context7) Upstash, official | remote endpoint https://mcp.context7.com/mcp, through the kosa8 gateway | CONTEXT7_API_KEY (optional) | the gateway reaches mcp.context7.com only | Read-only documentation lookup; returned docs are third-party text the model reads. |
| `kosa8 mcp add everything` | [Everything (test server)](https://github.com/modelcontextprotocol/servers/tree/main/src/everything) MCP project (modelcontextprotocol), official | npx -y @modelcontextprotocol/server-everything@2.3.0 in its own sandbox | none | registry.npmjs.org | Test server: one tool returns its environment; its sandbox reaches nothing but the npm registry. |
| `kosa8 mcp add fetch` | [Fetch](https://github.com/modelcontextprotocol/servers/tree/main/src/fetch) MCP project (modelcontextprotocol), official | uvx mcp-server-fetch@2026.11.11 in its own sandbox | none | any host | Fetches any public URL, so its sandbox may reach any host; fetched pages are untrusted text the model reads. |
| `kosa8 mcp add filesystem --dir .` | [Filesystem](https://github.com/modelcontextprotocol/servers/tree/main/src/filesystem) MCP project (modelcontextprotocol), official | npx -y @modelcontextprotocol/server-filesystem@2.3.0 /workspace in its own sandbox | none | registry.npmjs.org | Reads, writes, moves and deletes files in the shared directory; shared read-only unless --writable. |
| `kosa8 mcp add git --dir .` | [Git](https://github.com/modelcontextprotocol/servers/tree/main/src/git) MCP project (modelcontextprotocol), official | uvx mcp-server-git@2026.11.11 --repository /workspace in its own sandbox | none | pypi.org, files.pythonhosted.org | Changes the shared repository (add, commit, reset, checkout, merge) when shared --writable; no push. |
| `kosa8 mcp add github` | [GitHub](https://github.com/github/github-mcp-server) GitHub, official | remote endpoint https://api.githubcopilot.com/mcp/, through the kosa8 gateway | GITHUB_PERSONAL_ACCESS_TOKEN | the gateway reaches api.githubcopilot.com only | Reads and writes repositories, issues, pull requests and Actions as the token's user. |
| `kosa8 mcp add github-local` | [GitHub (local)](https://github.com/github/github-mcp-server) GitHub, official | image ghcr.io/github/github-mcp-server:2.1.0 in its own sandbox | GITHUB_PERSONAL_ACCESS_TOKEN | api.github.com | Reads and writes repositories, issues, pull requests and Actions as the token's user. |
| `kosa8 mcp add grafana` | [Grafana](https://github.com/grafana/mcp-grafana) Grafana Labs, official | uvx mcp-grafana@2.2.0 --disable-write in its own sandbox | GRAFANA_URL, GRAFANA_SERVICE_ACCOUNT_TOKEN | any host | Read-only as added (--disable-write); its sandbox may reach any host because the Grafana URL is yours to choose. |
| `kosa8 mcp add huggingface` | [Hugging Face](https://github.com/huggingface/hf-mcp-server) Hugging Face, official | remote endpoint https://huggingface.co/mcp, through the kosa8 gateway | HF_TOKEN (optional) | the gateway reaches huggingface.co only | Searches the Hub; tools you enable in your HF settings can write repos and run jobs on HF compute. |
| `kosa8 mcp add linear` | [Linear](https://linear.app/docs/mcp) Linear, official | remote endpoint https://mcp.linear.app/mcp, through the kosa8 gateway | LINEAR_API_KEY | the gateway reaches mcp.linear.app only | Creates and edits issues, projects and comments. |
| `kosa8 mcp add memory` | [Knowledge graph memory](https://github.com/modelcontextprotocol/servers/tree/main/src/memory) MCP project (modelcontextprotocol), official | npx -y @modelcontextprotocol/server-memory@2.1.1 in its own sandbox | none | registry.npmjs.org | Stores what the agent tells it inside its own sandbox; no network beyond installing itself. |
| `kosa8 mcp add mongodb` | [MongoDB](https://github.com/mongodb-js/mongodb-mcp-server) MongoDB, official | npx -y mongodb-mcp-server@3.3.0 --readOnly in its own sandbox | MDB_MCP_CONNECTION_STRING | any host | Read-only as added (--readOnly); its sandbox may reach any host because the database host is yours to choose. |
| `kosa8 mcp add neon` | [Neon](https://github.com/neondatabase/mcp-server-neon) Neon, official | remote endpoint https://mcp.neon.tech/mcp, through the kosa8 gateway | NEON_API_KEY | the gateway reaches mcp.neon.tech only | Creates and deletes projects and branches, runs SQL and migrations. |
| `kosa8 mcp add notion` | [Notion](https://developers.notion.com/docs/mcp) Notion, official | remote endpoint https://mcp.notion.com/mcp, through the kosa8 gateway | NOTION_MCP_TOKEN | the gateway reaches mcp.notion.com only | Searches, reads and edits workspace pages and databases. |
| `kosa8 mcp add notion-local` | [Notion (local, unmaintained)](https://github.com/makenotion/notion-mcp-server) Notion, official | npx -y @notionhq/notion-mcp-server@2.6.1 in its own sandbox | NOTION_TOKEN | registry.npmjs.org, api.notion.com | Reads and writes pages and databases shared with the integration; no longer maintained by Notion. |
| `kosa8 mcp add playwright` | [Playwright](https://github.com/microsoft/playwright-mcp) Microsoft, official | image mcr.microsoft.com/playwright/mcp:v0.0.85 in its own sandbox | none | any host | Drives a real browser to any site (navigates, clicks, types, uploads); pages are untrusted text the model reads. |
| `kosa8 mcp add postgres-toolbox` | [PostgreSQL (MCP Toolbox for Databases)](https://github.com/googleapis/mcp-toolbox) Google, official | npx -y @toolbox-sdk/server@1.16.0 --prebuilt=postgres --stdio in its own sandbox | POSTGRES_HOST, POSTGRES_DATABASE, POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_PORT (optional) | any host | Runs arbitrary SQL as the database user; its sandbox may reach any host because the database host is yours to choose. |
| `kosa8 mcp add sentry` | [Sentry](https://github.com/getsentry/sentry-mcp) Sentry, official | remote endpoint https://mcp.sentry.dev/mcp, through the kosa8 gateway | SENTRY_ACCESS_TOKEN | the gateway reaches mcp.sentry.dev only | Reads issues, events and traces; can change projects and teams within the token's scopes. |
| `kosa8 mcp add sentry-local` | [Sentry (local)](https://github.com/getsentry/sentry-mcp) Sentry, official | npx -y @sentry/mcp-server@0.49.0 in its own sandbox | SENTRY_AUTH_TOKEN | registry.npmjs.org, sentry.io, *.sentry.io | Reads issues, events and traces; can change projects and teams within the token's scopes. |
| `kosa8 mcp add sequential-thinking` | [Sequential thinking](https://github.com/modelcontextprotocol/servers/tree/main/src/sequentialthinking) MCP project (modelcontextprotocol), official | npx -y @modelcontextprotocol/server-sequential-thinking@2.1.1 in its own sandbox | none | registry.npmjs.org | No side effects. |
| `kosa8 mcp add stripe` | [Stripe](https://github.com/stripe/ai) Stripe, official | remote endpoint https://mcp.stripe.com, through the kosa8 gateway | STRIPE_AGENT_KEY | the gateway reaches mcp.stripe.com only | Creates and changes Stripe objects (customers, payments, refunds, invoices) within the key's permissions. |
| `kosa8 mcp add supabase` | [Supabase](https://github.com/supabase-community/supabase-mcp) Supabase, official | remote endpoint https://mcp.supabase.com/mcp?read_only=true, through the kosa8 gateway | SUPABASE_ACCESS_TOKEN | the gateway reaches mcp.supabase.com only | Read-only as added (read_only=true); without it, runs SQL and migrations and manages projects. |
| `kosa8 mcp add terraform` | [Terraform](https://github.com/hashicorp/terraform-mcp-server) HashiCorp, official | image hashicorp/terraform-mcp-server:1.4.1 in its own sandbox | TFE_TOKEN (optional) | registry.terraform.io, app.terraform.io | Registry lookups only, unless given a token: then it can manage HCP Terraform workspaces and runs. |
| `kosa8 mcp add time` | [Time](https://github.com/modelcontextprotocol/servers/tree/main/src/time) MCP project (modelcontextprotocol), official | uvx mcp-server-time@2026.11.11 in its own sandbox | none | pypi.org, files.pythonhosted.org | Read-only; no side effects. |

## Manage them

```
$ kosa8 mcp ls                       # what is added, its egress, which secrets are set
$ kosa8 mcp secret set github GITHUB_PERSONAL_ACCESS_TOKEN
$ kosa8 mcp pins show github
$ kosa8 mcp rm github                 # also forgets its pins and secrets
```

The desktop app (`kosa8 desk`) has the same catalog under *MCP servers*: search, connect with a form for the secrets, and see each connected server's pinned tools and pending changes. kosa8 Cloud's dashboard lists the catalog under *Integrations* with the command to copy; Cloud sandboxes do not run local MCP servers, so you add them on your own machine.

---
Source: https://docs.kosa8.com/guides/mcp-catalog/