TopolearnMCP connects Claude to systems beyond your files and shell, and it is where much of the security risk enters.
The Model Context Protocol (MCP) is an open standard for plugging tools into AI applications. An MCP server is a small program or web service that offers tools (for example "create Jira ticket" or "run SQL query"); Claude Code connects to it and Claude can call those tools like its built-in ones.
Servers come in two main kinds. Remote servers are reached over HTTP at a URL, often with a browser login (OAuth). Local servers are programs started on your machine and spoken to over standard input/output, called stdio.
Adding them, from your shell:
- remote:
claude mcp add --transport http notion https://mcp.notion.com/mcp - local:
claude mcp add --transport stdio airtable --env AIRTABLE_API_KEY=... -- npx -y airtable-mcp-server. Everything after--is the command that starts the server.
Each server has a scope: local (default: just you, this project), project (written to .mcp.json in the repo for the team; others are asked to approve it) or user (you, all projects). Pass --scope project to share.
claude mcp list, claude mcp get <name> and claude mcp remove <name> manage them; inside a session /mcp shows status, handles logins and can disable servers. Tools appear as mcp__<server>__<tool>, which is the name you use in permission rules.
Two cautions. First, tool descriptions take context; Claude Code loads them on demand, but unused servers still add overhead, so disable what you don't use. A CLI such as gh is often cheaper than an MCP server. Second, a server can read data and act for you. Only connect servers you trust, and be careful with ones that fetch outside content, because that content can carry hidden instructions.
Example
# remote server over HTTP (OAuth login happens via /mcp)
claude mcp add --transport http notion https://mcp.notion.com/mcp
# local stdio server; the part after -- starts it
claude mcp add --transport stdio --env AIRTABLE_API_KEY="$AIRTABLE_API_KEY" \
airtable -- npx -y airtable-mcp-server
# share with the team: writes .mcp.json in the repo
claude mcp add --transport http --scope project docs https://mcp.example.com/mcp
claude mcp list # servers and health
claude mcp remove notionRemember
- MCP servers add tools; remote ones use HTTP, local ones use stdio
- claude mcp add with --scope local, project (.mcp.json) or user
- Tools are named mcp__server__tool; connect only servers you trust
Watch out for
- Forgetting the -- before a stdio server's command, so its flags are parsed as Claude Code options.