Guides / MCP server catalog
MCP server catalog
kosa8 carries a list of well-known MCP servers, each checked against its publisher's own repository or docs. Add one with a single command, from the desktop app, or by copying the command from the kosa8 Cloud dashboard. It runs the way every gateway server runs: in a sandbox of its own, with its tool definitions pinned, behind your org's MCP policy.
Find one and add it
$ kosa8 mcp search github $ kosa8 mcp info github $ kosa8 mcp add github GITHUB_PERSONAL_ACCESS_TOKEN: # typed without echo added github (github@remote) $ kosa8 mcp serve
kosa8 mcp search looks in the curated list below and in the official
MCP Registry. Registry results are what their
publishers say about them, not reviewed by kosa8, and are added by their command:
kosa8 mcp add NAME --image node:24-alpine --egress-allow HOST -- npx -y PACKAGE@VERSION.
Without a network, or with --offline, only the curated list is searched.
Servers that work on files take the directory they may see: kosa8 mcp add filesystem --dir
~/code/project. It is shared read-only unless you add --writable. In a script, set the
secrets in the shell and pass --secrets-from-env instead of being asked.
What one step sets up
A sandbox of its ownA local server runs the publisher's package, pinned
to the version in the catalog, in a microVM named
mcp-ID. It does not run as you and cannot
see your files, apart from a --dir you share.Egress: only what it needsIts sandbox may reach the package registry
that installs it and the vendor's API hosts, nothing else. A server whose job is to reach arbitrary
sites (fetch, the browser) or a database at an address you choose is marked any host below.
Secrets out of reachTokens are typed once and kept in kosa8's owner-only
secret store, never in
mcp-servers.json, and nothing prints them back. A remote server's
token is added as a header by the gateway on your computer and sent to that server's host only: no
sandbox holds it. A local server's token goes into its own sandbox's environment, never the agent's;
the agent only ever talks to the gateway.Pinned toolsThe first time
kosa8 mcp serve starts it, every
tool definition is pinned. A changed description or a new tool is withheld until you look at it with
kosa8 mcp pins diff ID and accept it. See Tool servers.Org policy firstWith a signed MCP policy installed, a server no scope
approves is refused at
kosa8 mcp add, before you are asked for a token. The image (or, for a
remote server, URL) allowlist of kosa8 policy is checked too.Remote servers are reached through the gateway like local ones, so their tools are pinned, governed, argument-checked and audited the same way. The gateway's HTTP client refuses any request, redirect included, that is not for the server's own host.
The catalog
Every entry here is published by the vendor whose service it serves, or by the MCP project. A community server would be marked community wherever it is shown. Remote servers that only accept an OAuth sign-in (Slack's, Google Cloud's) are not listed yet: kosa8 adds servers that take a token.
| Add with | Server | Runs as | Secrets | Egress | Risk |
|---|---|---|---|---|---|
kosa8 mcp add atlassian | Atlassian (Jira, Confluence) Atlassian, official | remote endpoint https://mcp.atlassian.com/v2/mcp, through the kosa8 gateway | ATLASSIAN_BASIC | the gateway reaches mcp.atlassian.com only | Reads and writes Jira issues and Confluence pages as the token's user. |
kosa8 mcp add aws-docs | AWS Documentation AWS Labs, official | uvx [email protected] in its own sandbox | none | pypi.org, files.pythonhosted.org, docs.aws.amazon.com, proxy.search.docs.aws.com, api.contentrecs.docs.aws.com | Read-only search and fetch of AWS documentation. |
kosa8 mcp add aws-knowledge | AWS Knowledge AWS, official | remote endpoint https://knowledge-mcp.global.api.aws, through the kosa8 gateway | none | the gateway reaches knowledge-mcp.global.api.aws only | Read-only AWS documentation; rate limited. |
kosa8 mcp add azure | Azure Microsoft, official | npx -y @azure/[email protected] server start in its own sandbox | AZURE_TENANT_ID, AZURE_CLIENT_ID, AZURE_CLIENT_SECRET | registry.npmjs.org, management.azure.com, login.microsoftonline.com | Manages Azure resources with the service principal's roles; data-plane tools for some services need hosts beyond Azure Resource Manager. |
kosa8 mcp add brave-search | Brave Search Brave, official | npx -y @brave/[email protected] in its own sandbox | BRAVE_API_KEY | registry.npmjs.org, api.search.brave.com | Search results are third-party text the model reads; spends the API key's quota. |
kosa8 mcp add cloudflare | Cloudflare API Cloudflare, official | remote endpoint https://mcp.cloudflare.com/mcp, through the kosa8 gateway | CLOUDFLARE_API_TOKEN | the gateway reaches mcp.cloudflare.com only | Calls any Cloudflare API endpoint the token's permissions allow. |
kosa8 mcp add context7 | Context7 Upstash, official | remote endpoint https://mcp.context7.com/mcp, through the kosa8 gateway | CONTEXT7_API_KEY (optional) | the gateway reaches mcp.context7.com only | Read-only documentation lookup; returned docs are third-party text the model reads. |
kosa8 mcp add everything | Everything (test server) MCP project (modelcontextprotocol), official | npx -y @modelcontextprotocol/[email protected] in its own sandbox | none | registry.npmjs.org | Test server: one tool returns its environment; its sandbox reaches nothing but the npm registry. |
kosa8 mcp add fetch | Fetch MCP project (modelcontextprotocol), official | uvx [email protected] in its own sandbox | none | any host | Fetches any public URL, so its sandbox may reach any host; fetched pages are untrusted text the model reads. |
kosa8 mcp add filesystem --dir . | Filesystem MCP project (modelcontextprotocol), official | npx -y @modelcontextprotocol/[email protected] /workspace in its own sandbox | none | registry.npmjs.org | Reads, writes, moves and deletes files in the shared directory; shared read-only unless --writable. |
kosa8 mcp add git --dir . | Git MCP project (modelcontextprotocol), official | uvx [email protected] --repository /workspace in its own sandbox | none | pypi.org, files.pythonhosted.org | Changes the shared repository (add, commit, reset, checkout, merge) when shared --writable; no push. |
kosa8 mcp add github | GitHub GitHub, official | remote endpoint https://api.githubcopilot.com/mcp/, through the kosa8 gateway | GITHUB_PERSONAL_ACCESS_TOKEN | the gateway reaches api.githubcopilot.com only | Reads and writes repositories, issues, pull requests and Actions as the token's user. |
kosa8 mcp add github-local | GitHub (local) GitHub, official | image ghcr.io/github/github-mcp-server:2.1.0 in its own sandbox | GITHUB_PERSONAL_ACCESS_TOKEN | api.github.com | Reads and writes repositories, issues, pull requests and Actions as the token's user. |
kosa8 mcp add grafana | Grafana Grafana Labs, official | uvx [email protected] --disable-write in its own sandbox | GRAFANA_URL, GRAFANA_SERVICE_ACCOUNT_TOKEN | any host | Read-only as added (--disable-write); its sandbox may reach any host because the Grafana URL is yours to choose. |
kosa8 mcp add huggingface | Hugging Face Hugging Face, official | remote endpoint https://huggingface.co/mcp, through the kosa8 gateway | HF_TOKEN (optional) | the gateway reaches huggingface.co only | Searches the Hub; tools you enable in your HF settings can write repos and run jobs on HF compute. |
kosa8 mcp add linear | Linear Linear, official | remote endpoint https://mcp.linear.app/mcp, through the kosa8 gateway | LINEAR_API_KEY | the gateway reaches mcp.linear.app only | Creates and edits issues, projects and comments. |
kosa8 mcp add memory | Knowledge graph memory MCP project (modelcontextprotocol), official | npx -y @modelcontextprotocol/[email protected] in its own sandbox | none | registry.npmjs.org | Stores what the agent tells it inside its own sandbox; no network beyond installing itself. |
kosa8 mcp add mongodb | MongoDB MongoDB, official | npx -y [email protected] --readOnly in its own sandbox | MDB_MCP_CONNECTION_STRING | any host | Read-only as added (--readOnly); its sandbox may reach any host because the database host is yours to choose. |
kosa8 mcp add neon | Neon Neon, official | remote endpoint https://mcp.neon.tech/mcp, through the kosa8 gateway | NEON_API_KEY | the gateway reaches mcp.neon.tech only | Creates and deletes projects and branches, runs SQL and migrations. |
kosa8 mcp add notion | Notion Notion, official | remote endpoint https://mcp.notion.com/mcp, through the kosa8 gateway | NOTION_MCP_TOKEN | the gateway reaches mcp.notion.com only | Searches, reads and edits workspace pages and databases. |
kosa8 mcp add notion-local | Notion (local, unmaintained) Notion, official | npx -y @notionhq/[email protected] in its own sandbox | NOTION_TOKEN | registry.npmjs.org, api.notion.com | Reads and writes pages and databases shared with the integration; no longer maintained by Notion. |
kosa8 mcp add playwright | Playwright Microsoft, official | image mcr.microsoft.com/playwright/mcp:v0.0.85 in its own sandbox | none | any host | Drives a real browser to any site (navigates, clicks, types, uploads); pages are untrusted text the model reads. |
kosa8 mcp add postgres-toolbox | PostgreSQL (MCP Toolbox for Databases) Google, official | npx -y @toolbox-sdk/[email protected] --prebuilt=postgres --stdio in its own sandbox | POSTGRES_HOST, POSTGRES_DATABASE, POSTGRES_USER, POSTGRES_PASSWORD, POSTGRES_PORT (optional) | any host | Runs arbitrary SQL as the database user; its sandbox may reach any host because the database host is yours to choose. |
kosa8 mcp add sentry | Sentry Sentry, official | remote endpoint https://mcp.sentry.dev/mcp, through the kosa8 gateway | SENTRY_ACCESS_TOKEN | the gateway reaches mcp.sentry.dev only | Reads issues, events and traces; can change projects and teams within the token's scopes. |
kosa8 mcp add sentry-local | Sentry (local) Sentry, official | npx -y @sentry/[email protected] in its own sandbox | SENTRY_AUTH_TOKEN | registry.npmjs.org, sentry.io, *.sentry.io | Reads issues, events and traces; can change projects and teams within the token's scopes. |
kosa8 mcp add sequential-thinking | Sequential thinking MCP project (modelcontextprotocol), official | npx -y @modelcontextprotocol/[email protected] in its own sandbox | none | registry.npmjs.org | No side effects. |
kosa8 mcp add stripe | Stripe Stripe, official | remote endpoint https://mcp.stripe.com, through the kosa8 gateway | STRIPE_AGENT_KEY | the gateway reaches mcp.stripe.com only | Creates and changes Stripe objects (customers, payments, refunds, invoices) within the key's permissions. |
kosa8 mcp add supabase | Supabase Supabase, official | remote endpoint https://mcp.supabase.com/mcp?read_only=true, through the kosa8 gateway | SUPABASE_ACCESS_TOKEN | the gateway reaches mcp.supabase.com only | Read-only as added (read_only=true); without it, runs SQL and migrations and manages projects. |
kosa8 mcp add terraform | Terraform HashiCorp, official | image hashicorp/terraform-mcp-server:1.4.1 in its own sandbox | TFE_TOKEN (optional) | registry.terraform.io, app.terraform.io | Registry lookups only, unless given a token: then it can manage HCP Terraform workspaces and runs. |
kosa8 mcp add time | Time MCP project (modelcontextprotocol), official | uvx [email protected] in its own sandbox | none | pypi.org, files.pythonhosted.org | Read-only; no side effects. |
Manage them
$ kosa8 mcp ls # what is added, its egress, which secrets are set $ kosa8 mcp secret set github GITHUB_PERSONAL_ACCESS_TOKEN $ kosa8 mcp pins show github $ kosa8 mcp rm github # also forgets its pins and secrets
The desktop app (kosa8 desk) has the same catalog under MCP servers: search,
connect with a form for the secrets, and see each connected server's pinned tools and pending changes.
kosa8 Cloud's dashboard lists the catalog under Integrations with the command to copy; Cloud
sandboxes do not run local MCP servers, so you add them on your own machine.