In Claude Code you add an MCP server with the claude mcp add command, choosing HTTP for a remote server or stdio for a local one. Then you run the list command or open the in-session mcp view to confirm the server shows as connected. This guide shows each form, as documented by Anthropic.
Add a remote server over HTTP
HTTP is the recommended transport for remote servers. The shape is a transport, a name and a URL.
claude mcp add --transport http notion https://mcp.notion.com/mcp
If the server expects a fixed token instead of OAuth, add a header.
claude mcp add --transport http secure-api https://api.example.com/mcp \
--header "Authorization: Bearer your-token"
The older SSE transport is marked deprecated in the docs. Newer versions try HTTP first and fall back to SSE automatically.
Add a local stdio server
For a server that runs as a process on your machine, put the command after a double dash so Claude's own options are not mixed with the server's.
claude mcp add --env AIRTABLE_API_KEY=YOUR_KEY --transport stdio airtable \
-- npx -y airtable-mcp-server
Only install packages you trust. A stdio server runs with your permissions.
Add from JSON. If you already have a definition, use add-json and always include the type field. A JSON entry with a URL but no type is treated as stdio and skipped.
claude mcp add-json weather-api \
'{"type":"http","url":"https://api.weather.com/mcp","headers":{"Authorization":"Bearer token"}}'
Sign in with OAuth. For servers that use OAuth, open the mcp view inside a session and complete the browser login, or run this from your shell.
claude mcp login notion
Use logout to clear it. Removing a server also deletes its stored OAuth tokens.
Check, inspect and remove
claude mcp list
claude mcp get notion
claude mcp remove notion
Inside a session, the mcp view shows status, lets you reconnect, and lets you switch a server off without deleting it. Look for a checkmark next to the name.
Safety habits
The docs say to add only servers you trust, because servers that fetch external content can expose you to prompt injection. For database servers, use a read-only database user.
If you run a Safeguard workspace, Safeguard also exposes an MCP endpoint, listed on its download page as https://mcp.safeguard.sh/mcp. Follow the Safeguard setup guide for authentication, and see getting started with Safeguard MCP in Claude Desktop.
Click through it at your own pace, or open it full screen.
Limits worth knowing
Anthropic documents a few defaults that affect real use. Tool results are capped at 25,000 tokens by default, with a warning above 10,000. Long text results over 50,000 characters are saved to a file instead of entering context. A server startup timeout and a per-tool timeout can both be set through environment variables. If a server returns large payloads, filter on the server side rather than raising limits, since everything that enters the context is also something an injected instruction could hide in.
Quick check
Why does my JSON entry get skipped?
Most likely the type field is missing. A URL without a type is treated as stdio and skipped. Add "type": "http".
Does removing a server clean up its login?
Yes. The remove command also deletes stored OAuth tokens for that server.
Sources
Last reviewed: 19 October 2026.
