MCP server · Data + databases

OfficialHands-on VerifiedRead-writeMITUpdated August 2026

Hugging Face MCP

Search Hugging Face models, datasets, Spaces, papers and docs through MCP, with optional Hub and compute tools.

Quick verdict

It exposes most of the Hugging Face ecosystem through one official endpoint instead of making an agent scrape search pages or hand-build Hub API calls.

  • MaintainerHugging Face (official)
  • Security scopeRead-write
  • Transportsstreamable-http, stdio
  • Install channelremote · https://huggingface.co/mcp
  • EvidenceHands-on Verified · 1 configuration
  • LicenseMIT · Open source

Hugging Face's official hosted MCP server, connecting an assistant to the Hub for model, dataset, Space, paper and documentation discovery. Its authority is not fixed: optional tools can contribute repository files, manage remote Jobs and sandboxes, or call MCP-enabled Gradio Spaces, so the token and the enabled tool set decide what it can actually do. Treat it as a configurable surface, not a search box.

MCP security best practices

Install Hugging Face MCP

http https://huggingface.co/mcp

Config entry (mcpServers)
{
  "mcpServers": {
    "huggingface": {
      "url": "https://huggingface.co/mcp",
      "headers": {
        "Authorization": "Bearer <HF_TOKEN>"
      }
    }
  }
}

Vendor-hosted endpoint with a bearer token. Hugging Face also documents a `?login` interactive flow on clients that support it, and the open-source server can be run locally over stdio from npm or Docker.

Credentials

NameRequiredWhat it is for
HF_TOKENRequiredHugging Face user access token, sent as an Authorization bearer header. Use a fine-grained token limited to the repositories and actions the tools you enable actually need.

Verified configurations

Each row is one client + runtime + OS combination that was actually run, with what was verified in that session.

ConfigurationInstallAuthDiscoveryExecutionReadWriteDestructiveErrors
Claude Code
claude-opus-5 · Windows · streamable-http · tested 2026-08-17
Claude Code CLI 2.1.228 on Windows 11 Pro 10.0.26200 with Node v24.16.0; the hosted Hugging Face MCP server at https://huggingface.co/mcp connected as a claude.ai connector (OAuth — no local process, no hand-supplied HF_TOKEN) and exposed to the session, shown by `claude mcp list` as `claude.ai Hugging Face: https://huggingface.co/mcp - ✔ Connected` (2026-08-17); run by an agent session (Claude Opus 5, model id claude-opus-5, 1M-context variant) with genuine access to the client, the Hugging Face account and the server — spec §7 / decision F3.
VerifiedPartialVerifiedVerifiedVerifiedNot testedNot testedNot tested
Evidence — Claude Code
  • Install: `claude mcp list` → `claude.ai Hugging Face: https://huggingface.co/mcp - ✔ Connected`: the hosted endpoint was reached over streamable HTTP; nothing was installed locally. Scope limit, stated so it is not mistaken for coverage: this was the **claude.ai OAuth connector** path, NOT the `Bearer <HF_TOKEN>` configuration this profile publishes. Same endpoint and transport, different authentication path — the published copy block was not exercised.
  • Auth: `hf_whoami` → status authenticated, account `OpenSourcesAI` (user, no organizations), credential type oauth. Recorded partial rather than verified for two reasons: the granted scopes were `openid, profile, read-mcp, read-repos, jobs, contribute-repos, inference-api`, so `contribute-repos` and `jobs` are broader than the least-privilege read posture this profile recommends; and the fine-grained `HF_TOKEN` path the published configuration uses was never exercised at all. Only read tools were invoked.
  • Discovery: The tool set exposed to this session was 5: hf_whoami, hub_repo_search, hub_repo_details, hf_fs, dynamic_space. No repository-write, Job-management or sandbox tool was present, so the enabled tool surface was narrower than the OAuth grant. `dynamic_space` is the MCP-enabled Gradio Space surface and was not exercised.
  • Execution: `hub_repo_search` (query "Qwen3-Coder", author "Qwen", repo_types [model], sort downloads, limit 3) → 3 models returned with owner, id, task, library, licence and link: Qwen/Qwen3-Coder-Next-FP8 (text-generation, apache-2.0), Qwen/Qwen3-Coder-30B-A3B-Instruct-FP8, Qwen/Qwen3-Coder-30B-A3B-Instruct.
  • Read: Both invoked tools were read-only Hub queries; no repository content was created or modified.
  • Write: No repository-write tool was exposed to this session, though the OAuth grant carried `contribute-repos`. Nothing was written.

No Job, sandbox or community Gradio Space was run, so no billable compute path was exercised. But this run did NOT satisfy the packet's least-privilege authentication plan, which asked for a dedicated fine-grained read token against the published bearer configuration: the connector's OAuth grant was broader than that, and the token path is untested. What this configuration establishes is that the endpoint, the exposed tool set and a real read capability work; a fine-grained-token verification is still outstanding.

Best for

AI builders who want first-party Hub discovery in their assistant and will configure a narrowly scoped token and tool set.

Why use it

It exposes most of the Hugging Face ecosystem through one official endpoint instead of making an agent scrape search pages or hand-build Hub API calls.

Tradeoffs

The useful surface is broad and configurable, and that is the risk: optional repository, Job, sandbox and community-Space tools can write data, execute remote workloads and incur cost, with Jobs billed for requested hardware while starting or running. Use a fine-grained token, enable only the tools you need, and treat third-party Spaces as separate trust decisions. The master list originally scoped this read-only; current first-party documentation no longer supports that, which is why it is recorded read-write.

Upstream state

repository active · in the official MCP Registry (active). Lifecycle is derived from a committed upstream snapshot at build time, never authored by hand.

Official MCP Registry name: co.huggingface/hf-mcp-server

Editorial review

Reviewed byOpenSourcesAI EditorialLast updatedAugust 2026SourcesHugging Face MCP Server documentation — Hub tools, configurable repository/Job/sandbox tools, Gradio tools; Hugging Face MCP source repository (hf-mcp-server); Hugging Face access-token permissions; Hugging Face Jobs pricing and billing

Grade A — Hands-on Verified. Re-review is due by 2026-12-16. Config entries, credential names and package status can change upstream; verify against the source repository before granting an agent access.

Sources

Related guides

All MCP servers →