The MCP Servers I Actually Keep Installed (2026 Field Log)
A three-month field log on the best MCP servers in 2026: the five that earned a permanent slot, the ones I uninstalled, and the context and trust costs no listicle mentions.
Author
Backend dev. Writes when something breaks. Currently shipping a B2B agent product with one cofounder.
A three-month field log on the best MCP servers in 2026: the five that earned a permanent slot, the ones I uninstalled, and the context and trust costs no listicle mentions.
My CI step running claude -p hung for the full timeout, waiting on a permission prompt no human would answer. The three flags that fix headless Claude Code, the jobs I kept, and the two I ripped back out.
A field log of Claude Code's built-in /sandbox: what its OS-level cage actually locks down, the setup that bit me, what auto-allow still stops for, the tools that broke, and the one thing it does not protect.
A first-person weekend log of cloning and running ai-app-builder-open, an open source AI app builder, on localhost. What worked, the one API key you need, and the honest catch versus local-first Dyad.
Two weeks of pushing real work onto Claude Code subagents. The two I kept, the frontmatter line that actually decides delegation, and the gotcha that cost me an afternoon.
I ran spec-driven development for a month on a live B2B product. An honest 2026 field log: where the spec earned its overhead, where it was pure ceremony, and the six-heading spec that survived.
Claude Code can now drive a real browser: read the console, click through your app, fill forms, pull data. Two weeks of using it on live work, what it replaced, where it still hands the keyboard back, and the context-cost footgun nobody warns you about.
The standalone /output-style command is gone as of v2.1.91, so most guides are stale. Here is the current way to switch styles, which of the four built-ins earn their place, and the keep-coding-instructions flag that quietly breaks custom styles.
A config field log: the exact Claude Code statusline I run in 2026, the four fields that earn their place, the ones I deleted, and why the bar sometimes shows up empty.
GhostApproval showed my Claude Code approval box a fake filename while the write went to my SSH keys. Anthropic called it outside its threat model, so the fix was mine. Here is the field log: what the symlink flaw does, who patched, and the three setup changes that held.
I ran Claude Code dynamic workflows daily for two weeks on a real Next.js project. Where the parallel subagents earned the token bill, where they quietly wasted it, and the four-question test I run before I type ultracode.
Claude Code memory is three things, and auto memory quietly remembered a workaround I never asked it to keep. My exact keep/prune split, plus a three-question test for what earns a slot.