Claude Code + MCP: Connect External Tools to Your Dev Agent Safely

You are setting up a Model Context Protocol (MCP) server connection for Claude Code so I can stop copy-pasting data from an external system into chat. Use real Claude Code MCP commands and config formats only.

## The external system I want to connect
{{TARGET_SYSTEM}}

## What I want Claude to be able to do once connected
{{DESIRED_CAPABILITIES}}

## Phase 1 — Decide the setup (explain your choices)
Ask me anything you genuinely need, then recommend ONE concrete setup and justify it:
1. **Transport**: HTTP (recommended for remote cloud services, supports OAuth) vs stdio (a local process for tools needing direct system access / custom scripts) vs SSE (deprecated — avoid). Pick one for my system and say why.
2. **Scope** of the config:
   - `local` (default): only me, only this project.
   - `project`: shared with my team via a `.mcp.json` committed to the repo root.
   - `user`: just me, across all my projects.
   Recommend one based on whether this is a team tool or personal, and whether secrets are involved.
3. **Auth**: static header token, OAuth 2.0 (handled interactively via `/mcp`), or env-injected key for a stdio server. Tell me which my system uses.
4. **Secret safety**: a real plan so no API key ends up committed. For project scope, use environment variable expansion in `.mcp.json` (e.g. values like `${MY_API_KEY}`) and keep the actual secret out of git; for local/user scope, pass via `--env` or `--header`.

## Phase 2 — Give me the exact setup
Output, ready to run:

### A) The command or config
- If a CLI add is cleanest, give the exact `claude mcp add` command. Remember real syntax: all flags (`--transport`, `--scope`, `--env`, `--header`) come BEFORE the server name; for stdio, put `--` before the actual command, e.g.
  `claude mcp add --transport http <name> <url> --header "Authorization: Bearer <token>"`
  `claude mcp add --env KEY=value --transport stdio <name> -- npx -y <server-package>`
- If project/team scope, instead give me the `.mcp.json` snippet to place at the repo root, using `${ENV_VAR}` expansion for any secret, and remind me Claude Code prompts for approval before using project-scoped servers.

### B) Verify the connection
- `claude mcp list` to see all servers, `claude mcp get <name>` for one, and the in-session `/mcp` panel to check status, tool count, and run OAuth login if the server needs it.
- Tell me what a healthy vs pending/failed state looks like.

### C) Use it in a real task
Give me 2-3 concrete natural-language prompts that exercise my desired capabilities, and note how MCP surfaces them:
- Tools are namespaced `mcp__<server>__<tool>` — I don't call these by hand, I just ask in plain language and Claude routes to them.
- If the server exposes **resources**, I can pull them in by typing `@` in my prompt to pick from the autocomplete (resources appear alongside files).
- If it exposes **prompts**, they appear as `/mcp__<server>__<promptname>` slash commands.

### D) Safety + teardown
- Note least-privilege: only connect servers I trust; project `.mcp.json` servers require my approval before first use.
- Give me `claude mcp remove <name>` to disconnect, and where the config is stored for each scope.

## Rules
- Use only commands, flags, and config keys that actually exist in Claude Code. If unsure whether something exists, say so rather than guessing.
- Never put a real secret inline in a committed file; always route it through env expansion or `--env`/`--header`.
- Be specific to MY system in {{TARGET_SYSTEM}} — pick real, named transport/scope/auth, don't hand me a generic menu.
- End with a checklist: transport chosen ✅, scope chosen ✅, secret-safe ✅, verified via `/mcp` ✅, one working example prompt ✅.