Interactive Developer Utility • Zero Auth • 100% Client-Side

Model Context Protocol (MCP) Config Generator

Effortlessly build, validate, and export validated MCP server configurations for Claude Desktop, Cursor IDE, Claude Code, and Windsurf Cascade. Zero telemetry, zero logins.

Select Client

Configured Servers (2)

filesystemstdio
githubstdio
Quick Presets Library:

Configure: filesystem

Local directory filesystem access

No environment variables set. Click "Add Variable" to attach API keys or tokens.

claude_desktop_config.json
{
  "mcpServers": {
    "filesystem": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-filesystem",
        "/Users/username/Desktop"
      ]
    },
    "github": {
      "command": "npx",
      "args": [
        "-y",
        "@modelcontextprotocol/server-github"
      ],
      "env": {
        "GITHUB_PERSONAL_ACCESS_TOKEN": "ghp_••••••••"
      }
    }
  }
}
Where to Save Configuration
~/Library/Application Support/Claude/claude_desktop_config.json

Requires complete application restart (Quit Claude from dock/tray, then reopen) after modifying configuration.

Architectural Reference

MCP Architecture: Transport Protocols, Client Differences & Security

Stdio vs. SSE: Selecting the Optimal MCP Transport

BLUF (Bottom Line Up Front): Use stdio for local subprocesses (filesystem access, SQLite, git tooling) because it operates with zero networking latency and inherits OS process boundaries. Use SSE (Server-Sent Events) for centralized enterprise tool pools, shared databases, or containerized cloud microservices where multiple agents share state.

The Model Context Protocol (MCP) standardizes how AI agents discover tools, inspect resources, and query prompts. In stdio transport, the host client launches the server as a child process and exchanges newline-delimited JSON-RPC 2.0 messages over standard input/output streams.

In contrast, SSE transport binds an HTTP server that provides persistent event streams for incoming tool calls and HTTP POST endpoints for responses. While flexible, SSE requires explicit authentication, TLS termination, and network firewall protection.

Cross-Client Compatibility: Claude Desktop, Cursor & Windsurf

BLUF: While all four major clients adopt the mcpServers top-level JSON structure, configuration file paths and SSE parameter keys vary. Windsurf Cascade expects serverUrl instead of url for HTTP streams, and Cursor allows both workspace-level (.cursor/mcp.json) and global editor tools.

ClientDefault File NameConfig ScopeSSE Transport Key
Claude Desktopclaude_desktop_config.jsonGlobal OS Configurl
Cursor IDEmcp.jsonWorkspace & Globalurl
Claude Codeclaude.jsonUser CLI Configurl / CLI
Windsurf (Cascade)mcp_config.jsonGlobal Codeium ConfigserverUrl

Security & Secret Isolation in MCP Servers

BLUF: Never commit API keys or database connection strings to version control in workspace-level .cursor/mcp.json files. Use environment variable indirection or OS-level credential stores to prevent secret leakage in public git repositories.

When an MCP server is invoked via stdio, child processes inherit environment variables defined in the env map. To minimize attack surfaces:

  • Scope filesystem server arguments strictly to project worktrees rather than root directories.
  • Provision read-only database roles for SQL servers to mitigate unauthorized updates from prompt injection.
  • Rotate long-lived personal access tokens (GitHub, Slack) using fine-grained repository permissions.
ZeroShot Studio Architecture Advisory

Deploying Production Multi-Agent Systems?

We design deterministic agent state machines, custom enterprise MCP servers, and prompt-injection guardrail pipelines for engineering teams and AI startups.

Request Architecture Audit