Practical Notes
- Data point: default HTTP endpoint in docs is
http://localhost:8000/mcp. - Quant: start with
--tool-tier corebefore enabling extended/complete to reduce scope.
Pattern: separate auth setup from tool rollout
With Google OAuth, the most reliable rollout is:
- make auth succeed for one user,
- run read-only tools,
- then enable write scopes.
Hardening tips
- Prefer HTTP transport for OAuth flows and multi-user setups.
- Store OAuth client secrets in a secret manager (not
.envcommitted to git). - Restrict available tools to the minimum required per workflow.
FAQ
Q: Can it run in stdio mode? A: The README recommends HTTP mode for OAuth 2.1 and multi-user support.
Q: How do I limit permissions? A: Start with a smaller tool tier and enable write tools only when needed.
Q: Does it support VS Code MCP?
A: Yes. The README includes a .vscode/mcp.json example and notes about HTTP transport.