MCP with local LLMs in November 2026: which clients work, what the model needs, setup and security

You can use Model Context Protocol (MCP) servers with a local model, but the MCP client is a separate program from the model server. On 7 November 2026 the working combinations are LM Studio (an MCP host since 0.3.17), Open WebUI (native MCP over Streamable HTTP since v0.6.31), llama.cpp's llama-server (experimental MCP flags), Claude Code pointed at Ollama's or LM Studio's Anthropic-compatible endpoint, and ollmcp 0.35.1 for Ollama; Ollama itself has no MCP client. The current spec is version 2026-07-28. The model must support tool calling and needs a large context: a 94-tool GitHub server's schemas take about 17,600 tokens, four times Ollama's 4k default on cards under 24 GiB.

Read 7 November 2026. "MCP since" is the first version the vendor names. Open WebUI's quick start mentions version 0.12.3 in an October 2026 test, so current builds are well past v0.6.31.

Which clients run MCP tools against a local model?

Any client that speaks MCP on one side and an OpenAI- or Anthropic-style API on the other; the model server never sees MCP, only tool definitions and tool results inside ordinary chat requests. That split explains the table above. LM Studio is the one product that is both model runner and MCP host in one app (the LM Studio vs Ollama comparison covers its license and server modes). Everything else pairs a client with a model server.

In my view Claude Code is the most complete MCP client in the list, and it works with local models because Ollama and LM Studio both answer the Anthropic Messages API. Ollama's Claude Code page gives three environment variables (or the shortcut ollama launch claude) and asks for a 64k or larger context. LM Studio's Anthropic docs do the same on port 1234. Claude Code then runs its MCP servers exactly as it would against a hosted model.

llama-server is the newest entry. Its README now lists --mcp-servers-config and --mcp-servers-json (Cursor-compatible definitions, marked experimental), built-in agent tools behind --tools, and a CORS proxy for the web UI behind --ui-mcp-proxy, each with the warning "do not enable in untrusted environments". In a GitHub discussion from March to June 2026, users got Streamable HTTP servers working through the web UI proxy while SSE endpoints failed, and a collaborator wrote that llama.cpp does not support the SSE variants.

Open WebUI's native client accepts Streamable HTTP servers only and keeps them admin-only, because they run inside its trust boundary with the connecting user's access. For a stdio server, wrap it in mcpo, which exposes MCP tools as an OpenAPI server. The broader Open WebUI tool system is covered in the Open WebUI tools guide.

What changed in the MCP specification in 2026?

The 2026-07-28 revision made the protocol stateless, and two of its deprecations matter for local setups. Per the changelog against the previous 2025-11-25 version:

• Protocol-level sessions and the Mcp-Session-Id header are gone, and so is the initialize handshake. Every request carries its protocol version and client capabilities in _meta, and servers must implement a new server/discover call.
• Server-initiated requests (sampling, roots, elicitation) are replaced by a multi-round-trip pattern in which the server returns an "input_required" result and the client retries.
• Roots, Sampling and Logging are deprecated, with a minimum twelve-month window before removal. The old HTTP+SSE transport is reclassified as deprecated in favor of Streamable HTTP.
• Version mismatches now return an UnsupportedProtocolVersionError.

Sampling was the feature that let an MCP server borrow the client's model, which was attractive with a free local model. The spec now suggests servers integrate with model APIs directly; with a local setup that means pointing the server at your own OpenAI-compatible endpoint. The SSE deprecation lines up with the llama.cpp report above: build new local servers on stdio or Streamable HTTP. Expect a mixed year in which some clients speak the new revision and many servers still speak 2025-11-25; that is the first thing to check when a server connects and lists no tools.

What does the local model need?

Trained tool calling, a chat template the runtime understands, and enough context for every tool schema plus the conversation. On templates: LM Studio's tool use docs distinguish native support (hammer badge; Qwen, Llama 3.1 and 3.2 and Mistral families listed) from a default mode that injects its own format, and warn that smaller or untrained models may emit malformed calls that come back as plain text. On vLLM, tool calls are parsed only with --enable-auto-tool-choice and the right --tool-call-parser (36 parsers in the tool calling docs). llama-server applies Jinja chat templates by default. Model choice is in the sibling article on the best open models for tool calling.

Context is where local setups fail quietly. StackOne's March 2026 analysis puts MCP tool schemas at 500 to 1,400 tokens each and GitHub's official server (94 tools) at 17,600 tokens of definitions per request. A worked budget, by my calculation:

Tool schema figures as reported by StackOne (published 31 March 2026, updated 22 October 2026), which attributes the GitHub figure to Atlassian. Rows 3 and 4 are my arithmetic and estimate.

Context costs memory. For Qwen3.8-27B, whose config.json has 16 full-attention layers with 4 KV heads of dimension 256, the KV cache is 64 KiB per token at f16 by my calculation, so a 64k context costs 4 GiB on top of an 18 GB 4-bit model: about 22 GB, which fits a 24 GB card only barely and a 32 GB card comfortably. Trimming tools is cheaper than buying memory. The GitHub MCP server enables five toolsets by default and takes a --toolsets allow-list (or GITHUB_TOOLSETS) and a --read-only flag.

How do you set it up?

Three working patterns, from one developer to a shared chat. First, Claude Code against Ollama with one MCP server, using the variables from Ollama's docs and the syntax from Claude Code's:

# terminal 1: the model server, with a 64k context
OLLAMA_CONTEXT_LENGTH=65536 ollama serve

# terminal 2: point Claude Code at it
export ANTHROPIC_AUTH_TOKEN=ollama
export ANTHROPIC_API_KEY=""
export ANTHROPIC_BASE_URL=http://localhost:11434

claude mcp add --transport stdio \
  --env GITHUB_PERSONAL_ACCESS_TOKEN=$GITHUB_PAT github \
  -- docker run -i --rm -e GITHUB_PERSONAL_ACCESS_TOKEN \
     -e GITHUB_TOOLSETS=repos,issues ghcr.io/github/github-mcp-server

claude --model qwen3.8:27b

Second, LM Studio: open the Program tab, choose Install, then Edit mcp.json, and add servers in Cursor's notation. The docs' remote example takes a URL and optional headers:

{
  "mcpServers": {
    "internal-wiki": {
      "url": "https://wiki.example.internal/mcp",
      "headers": { "Authorization": "Bearer <token>" }
    }
  }
}

Third, Open WebUI for a team: run stdio servers behind mcpo and add the result under Admin, Integrations, External Tool Servers as an OpenAPI connection. Remote servers that already speak Streamable HTTP go in the same place with the type set to MCP (Streamable HTTP):

uvx mcpo --port 8001 --api-key "a-long-random-key" -- uvx mcp-server-time --local-timezone=Europe/Prague

Open WebUI's docs also say to set WEBUI_SECRET_KEY, or OAuth-connected tools break with "Error decrypting tokens" when the container is recreated. Base installation of Open WebUI is in the Open WebUI setup guide, and the editor-agent configs for Continue, Cline and aider are in the coding agents guide.

How safe are local MCP servers?

Running the model locally does not make the tools safe: an MCP server is code with your permissions, and 2026 produced a steady stream of advisories against servers and the hosts that launch them. The MCP spec itself says tools "represent arbitrary code execution" and that hosts must get consent before invoking one.

Read 7 November 2026. The OX Security list names 14 CVEs and three entries without CVEs; LM Studio, Ollama and Open WebUI do not appear in it.

The rules I follow on a local machine:

• Use stdio for servers on the same machine. It is not reachable by a browser, so the DNS rebinding class does not apply. If a server must be HTTP, bind it to 127.0.0.1 and require a token; the TypeScript SDK advisory says running local HTTP servers without authentication is not recommended at all.
• Keep confirmation on. ollmcp asks before every tool call by default, and Claude Code asks before using project-scoped servers from a repository's .mcp.json. A repository you just cloned can ship one.
• Pin server versions and update them. The reference servers had nine advisories published between 25 and 28 October 2026 alone.
• Give servers the least access: read-only GitHub tokens and toolsets, a filesystem server pointed at one project directory, a container with no home directory mounted.
• Treat fetched content as hostile. Claude Code's MCP page warns that servers fetching external content carry prompt injection risk, and nothing about running the model locally protects against that.

Where the model and tools run on a rented machine rather than a laptop, the same rules apply plus network hardening; the guide to security hardening a rented GPU covers ports and keys.

Which setup should you pick?

For one developer I would use Claude Code against a local 27B to 35B model in Ollama or LM Studio, with two or three servers and their toolsets trimmed, and a 64k context. That combination has the most mature MCP client and costs nothing per token. For a team chat, Open WebUI with Streamable HTTP servers behind authentication, admin-managed, is the setup the docs are built for. llama-server's MCP support is promising for a single binary with no Python, but it is flagged experimental and SSE servers did not work for users in 2026, so I would wait before relying on it. For the lighter tool-calling path without MCP, the function calling guide shows plain OpenAI-style tools against your own endpoint.

FAQ

Sources

Every figure above is attributed to its source in the sentence or table where it appears. Pages were read on 7 November 2026 unless a date says otherwise.

• Specification, Model Context Protocol, 2026-07-28
• Key changes (2026-07-28), Model Context Protocol, 2026-07-28
• Use MCP servers, LM Studio docs
• Tool use, LM Studio docs
• Anthropic compatibility, LM Studio docs
• MCP, Open WebUI docs
• open-webui/mcpo, GitHub
• Quick start, Open WebUI docs
• llama-server README, GitHub
• Had anybody success in using MCP server in WebUI? (discussion 20698), GitHub, 2026-03-17
• Connect Claude Code to tools via MCP, Claude Code docs
• Claude Code, Ollama docs
• Anthropic compatibility, Ollama docs
• Context length, Ollama docs
• mcp-client-for-ollama, PyPI, 2026-09-30
• MCP token optimization: 4 approaches compared, StackOne, 2026-03-31
• github/github-mcp-server, GitHub
• MCP TypeScript SDK does not enable DNS rebinding protection by default (CVE-2025-66414), GitHub Advisory Database, 2025-12-02
• MCP STDIO command injection: full vulnerability advisory, OX Security, 2026-04-15
• Security update: CVE-2026-30623, command injection via Anthropic's MCP SDK, LiteLLM, 2026-04-21
• Chainlit command injection via MCP stdio transport (CVE-2026-45018), GitHub Advisory Database, 2026-08-25
• Security advisories · modelcontextprotocol/servers, GitHub, 2026-10-28
• Tool calling, vLLM docs
• Qwen/Qwen3.8-27B config.json, Hugging Face