MCP server · Data + databases
Hugging Face MCP
Search Hugging Face models, datasets, Spaces, papers and docs through MCP, with optional Hub and compute tools.
Quick verdict
It exposes most of the Hugging Face ecosystem through one official endpoint instead of making an agent scrape search pages or hand-build Hub API calls.
- MaintainerHugging Face (official)
- Security scopeRead-write
- Transportsstreamable-http, stdio
- Install channelremote · https://huggingface.co/mcp
- EvidenceHands-on Verified · 1 configuration
- LicenseMIT · Open source
Hugging Face's official hosted MCP server, connecting an assistant to the Hub for model, dataset, Space, paper and documentation discovery. Its authority is not fixed: optional tools can contribute repository files, manage remote Jobs and sandboxes, or call MCP-enabled Gradio Spaces, so the token and the enabled tool set decide what it can actually do. Treat it as a configurable surface, not a search box.
Install Hugging Face MCP
http https://huggingface.co/mcp
{
"mcpServers": {
"huggingface": {
"url": "https://huggingface.co/mcp",
"headers": {
"Authorization": "Bearer <HF_TOKEN>"
}
}
}
}Vendor-hosted endpoint with a bearer token. Hugging Face also documents a `?login` interactive flow on clients that support it, and the open-source server can be run locally over stdio from npm or Docker.
Credentials
| Name | Required | What it is for |
|---|---|---|
HF_TOKEN | Required | Hugging Face user access token, sent as an Authorization bearer header. Use a fine-grained token limited to the repositories and actions the tools you enable actually need. |
Verified configurations
Each row is one client + runtime + OS combination that was actually run, with what was verified in that session.
| Configuration | Install | Auth | Discovery | Execution | Read | Write | Destructive | Errors |
|---|---|---|---|---|---|---|---|---|
| Claude Code | Verified | Partial | Verified | Verified | Verified | Not tested | Not tested | Not tested |
Evidence — Claude Code
- Install: `claude mcp list` → `claude.ai Hugging Face: https://huggingface.co/mcp - ✔ Connected`: the hosted endpoint was reached over streamable HTTP; nothing was installed locally. Scope limit, stated so it is not mistaken for coverage: this was the **claude.ai OAuth connector** path, NOT the `Bearer <HF_TOKEN>` configuration this profile publishes. Same endpoint and transport, different authentication path — the published copy block was not exercised.
- Auth: `hf_whoami` → status authenticated, account `OpenSourcesAI` (user, no organizations), credential type oauth. Recorded partial rather than verified for two reasons: the granted scopes were `openid, profile, read-mcp, read-repos, jobs, contribute-repos, inference-api`, so `contribute-repos` and `jobs` are broader than the least-privilege read posture this profile recommends; and the fine-grained `HF_TOKEN` path the published configuration uses was never exercised at all. Only read tools were invoked.
- Discovery: The tool set exposed to this session was 5: hf_whoami, hub_repo_search, hub_repo_details, hf_fs, dynamic_space. No repository-write, Job-management or sandbox tool was present, so the enabled tool surface was narrower than the OAuth grant. `dynamic_space` is the MCP-enabled Gradio Space surface and was not exercised.
- Execution: `hub_repo_search` (query "Qwen3-Coder", author "Qwen", repo_types [model], sort downloads, limit 3) → 3 models returned with owner, id, task, library, licence and link: Qwen/Qwen3-Coder-Next-FP8 (text-generation, apache-2.0), Qwen/Qwen3-Coder-30B-A3B-Instruct-FP8, Qwen/Qwen3-Coder-30B-A3B-Instruct.
- Read: Both invoked tools were read-only Hub queries; no repository content was created or modified.
- Write: No repository-write tool was exposed to this session, though the OAuth grant carried `contribute-repos`. Nothing was written.
No Job, sandbox or community Gradio Space was run, so no billable compute path was exercised. But this run did NOT satisfy the packet's least-privilege authentication plan, which asked for a dedicated fine-grained read token against the published bearer configuration: the connector's OAuth grant was broader than that, and the token path is untested. What this configuration establishes is that the endpoint, the exposed tool set and a real read capability work; a fine-grained-token verification is still outstanding.
Best for
AI builders who want first-party Hub discovery in their assistant and will configure a narrowly scoped token and tool set.
Why use it
It exposes most of the Hugging Face ecosystem through one official endpoint instead of making an agent scrape search pages or hand-build Hub API calls.
Tradeoffs
The useful surface is broad and configurable, and that is the risk: optional repository, Job, sandbox and community-Space tools can write data, execute remote workloads and incur cost, with Jobs billed for requested hardware while starting or running. Use a fine-grained token, enable only the tools you need, and treat third-party Spaces as separate trust decisions. The master list originally scoped this read-only; current first-party documentation no longer supports that, which is why it is recorded read-write.
Upstream state
repository active · in the official MCP Registry (active). Lifecycle is derived from a committed upstream snapshot at build time, never authored by hand.
Official MCP Registry name: co.huggingface/hf-mcp-server
Editorial review
Grade A — Hands-on Verified. Re-review is due by 2026-12-16. Config entries, credential names and package status can change upstream; verify against the source repository before granting an agent access.
Sources
Related MCP servers
- MemoryReference MCP server that gives an agent persistent memory as a local knowledge graph — entities, relations and observations stored in a JSONL file.
- Redis MCPLet agents read, write, search and manage Redis data structures through Redis's official MCP server.
- Supabase MCPSupabase's official MCP server: lets an agent manage tables, run SQL, read logs and deploy Edge Functions in your project — scope it read-only.