Add remote MCP servers safely, then build and connect your own TypeScript server so Claude can use your internal tools.
Claude Code is strong inside your repository and blind outside it. It cannot see your error tracker, your issue board or the internal API your team built, until you connect them. MCP, the Model Context Protocol, is how you do that. This guide is for builders who want Claude to work with real tools: you will connect a hosted server in a few minutes, set it up so secrets stay out of git, and then build and connect a small server of your own in TypeScript.
What you will have at the end
A remote MCP server connected and signed in, visible in /mcp.
A clear rule for which scope to use, and a .mcp.json you can commit without leaking keys.
Your own MCP server, written in TypeScript with the official SDK, that Claude can call.
Permission rules that let read-only tools run freely and keep write tools behind a prompt.
A checklist for tool descriptions that Claude actually follows.
For step 1, an account with a service that runs a hosted MCP server. The example uses Sentry; any service from your stack with a hosted MCP server works the same way.
Only connect servers you trust. A server that fetches outside content can carry prompt injection into your session.
Step 1: Connect a hosted server
Run this in your shell, not inside Claude Code:
claude mcp add --transport http sentry https://mcp.sentry.dev/mcp
The parts of the command:
claude mcp add writes a server entry to your configuration. A successful add prints an Added ... line. It saves the config without checking credentials, so a bad token only shows up later as a failed connection in /mcp.
sentry is the name you choose. It becomes part of every tool name from this server, so keep it short.
The URL is the server's endpoint, from the service's own docs.
Now start Claude Code and open the MCP panel:
/mcp
Sentry uses OAuth, so the panel shows that the server needs authentication. Select it, sign in in the browser window that opens, and come back. Tokens are stored and refreshed for you.
Some servers use a token instead of OAuth. For those, pass a header when you add the server. This is the shape the docs use for GitHub:
YOUR_GITHUB_PAT is a placeholder for a fine-grained personal access token. Because claude mcp add does not validate it, a wrong token only shows up later as a failed connection in /mcp.
Try it. Ask Claude something only the server can answer, for example "What are the five most frequent unresolved errors in my project this week?" Claude finds the right tool, shows you an MCP tool permission prompt in the default mode, and answers from live data.
That covers hosted services. The rest of this guide handles the parts that matter once a team relies on MCP: where config lives, how to keep keys out of git, how to build a server for a tool nobody has wrapped yet, and how to control what Claude may do with it.