Official servers are built and maintained by the platform itself, like GitHub MCP, Stripe MCP, or Supabase MCP, and carry the highest trust. Reference servers are built by Anthropic to demonstrate the spec, like @modelcontextprotocol/server-github or server-postgres, and are high-trust but not the vendor's own. Community servers are built by anyone and vary widely in quality — check stars, last commit date, and maintenance activity before trusting one with real credentials.

With thousands of public MCP servers now available, the trust tier matters as much as the feature list: an official server is accountable to the platform it represents, while a community server could be abandoned, buggy, or malicious. Servers are commonly discovered through registries like mcp.so, smithery.ai, mcpservers.org, and the community-curated github.com/wong2/awesome-mcp-servers list — but registry listing alone isn't a trust signal.