Field Guide 25: 23 rules for choosing, pinning, scoping and operating an everyday MCP config. The kit has a claude_desktop_config.json (filesystem, git through uvx, read-only GitHub with OAuth, and the design system's token server) and a Claude Code .mcp.json (token server, read-only GitHub with ${VAR} expansion, fenced Playwright). Every pin was checked against npm, PyPI or ghcr.io, and every server that needs no account was launched from these files with the MCP Inspector. A zero-dependency validator flags inline secrets, missing pins, home-directory access, shell chaining and deprecated packages.
When you set up Claude Desktop or Claude Code on a new machine, inherit a config full of unpinned npx lines, or want one project .mcp.json the whole team can commit.