Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(8554)

78
361
Medium Cost
mondaycom icon

mcp

by mondaycom

Sec2

This server provides an interface for AI agents to interact with the monday.com API, enabling automated workflows and integrations within the monday.com work operating system.

Setup Requirements

  • ⚠️Requires Node.js v20 or higher.
  • ⚠️Requires NPM v5.2.0 or higher.
  • ⚠️A monday.com API key is mandatory for authentication and API interaction.
  • ⚠️ATP mode, which includes a dynamic code execution tool, is an Alpha feature and may be unstable or change.
Review RequiredView Analysis
The server, particularly in 'ATP mode (Alpha)', exposes an `execute_code` tool that allows dynamic JavaScript code execution to call monday.com APIs. This is a critical security risk as it permits arbitrary code execution which, if not rigorously sandboxed and contained, could lead to system compromise or unauthorized data access. The server requires a monday.com API token, which grants significant access to a user's data and should be treated with extreme care. API tokens are passed via command line or environment variables, which is a standard practice, but the tokens themselves are sensitive. Developers are cautioned about the alpha status of ATP mode and the potential for changes in behavior.
Updated: 2026-01-19GitHub→
77
118
Medium Cost
matlab icon
Sec7

The MATLAB MCP Core Server enables AI applications to start and quit MATLAB, execute MATLAB code, and assess code quality.

Setup Requirements

  • ⚠️Requires MATLAB (MathWorks) 2020b or later to be installed on the system.
  • ⚠️MATLAB executable must be added to the system PATH environment variable.
  • ⚠️For Claude Desktop integration, Node.js and the `@modelcontextprotocol/server-filesystem` package are required.
Verified SafeView Analysis
The server's core function is to execute arbitrary MATLAB code provided via API calls, which inherently poses a high security risk if not properly managed. The README explicitly warns users to 'thoroughly review and validate all tool calls before you run them' and 'always keep a human in the loop'. The presence of path validators in the source code (e.g., in `checkmatlabcode`, `runmatlabfile`) suggests attempts to restrict file access, which is a good practice for mitigating some execution risks. No hardcoded secrets or obvious malicious patterns were found. Network communication within the watchdog mechanism appears to use Unix Domain Sockets or HTTP, with TLS for the embedded MATLAB connector, indicating attention to secure communication channels. The main security consideration is ensuring trusted and validated input to the code execution functions.
Updated: 2026-01-13GitHub→
77
146
Low Cost
mcp-shark icon

mcp-shark

by mcp-shark

Sec7

Aggregate multiple Model Context Protocol (MCP) servers into a single unified interface with a powerful monitoring UI.

Setup Requirements

  • ⚠️Requires Node.js 20.0.0 or higher.
  • ⚠️The 'Smart Scan' feature requires an external API token, which may incur costs from the associated service (smart.mcpshark.sh).
  • ⚠️Requires an existing Model Context Protocol (MCP) configuration file (e.g., ~/.cursor/mcp.json) or manual input for server setup.
Verified SafeView Analysis
The application relies on user-provided configuration files and an API token for its 'Smart Scan' feature. It uses `child_process.execSync` internally for system path detection, which is generally discouraged but appears limited in scope to information gathering rather than arbitrary command execution from untrusted input. The proxying of requests to configured MCP servers is an intended feature and its security depends on the trustworthiness of the configured backend MCP servers. No obvious hardcoded sensitive secrets or severe vulnerabilities were identified in the provided code snippets.
Updated: 2025-12-24GitHub→
77
399
Medium Cost
utensils icon

mcp-nixos

by utensils

Sec3

An MCP server providing accurate, real-time information about NixOS packages, configuration options, Home Manager, nix-darwin, Nixvim, FlakeHub, and package versions to prevent AI hallucinations.

Setup Requirements

  • ⚠️Requires Python 3.11+
  • ⚠️Requires an active internet connection as all queries hit live APIs (no caching)
  • ⚠️Hardcoded API credentials in source code (security risk)
Review RequiredView Analysis
CRITICAL: The NixOS Elasticsearch API credentials (username 'aWVSALXpZv' and password 'X8gPHnzL52wFEekuxsfQ9cSh') are hardcoded directly in `mcp_nixos/server.py`. This is a severe security vulnerability as it exposes sensitive API authentication details, making them publicly visible and non-rotatable. All API requests to `search.nixos.org/backend` use these hardcoded credentials. No other major risks like 'eval', obfuscation, or arbitrary code execution were found.
Updated: 2026-01-07GitHub→
77
126
High Cost
sudocode-ai icon

sudocode

by sudocode-ai

Sec7

Git-native spec and issue management for AI-assisted software development, enabling agents to track context, manage tasks, and collaborate through structured workflows and feedback loops within a version-controlled repository. It provides agent orchestration, context persistence, and real-time visualization for complex, long-horizon software development tasks.

Setup Requirements

  • ⚠️Requires Node.js >= 18.0.0 and npm >= 7.0.0.
  • ⚠️Requires Git CLI installed and configured.
  • ⚠️Requires local SQLite cache (`.sudocode/cache.db`), which is gitignored.
  • ⚠️AI service credentials (e.g., Claude Code, OpenAI API Key) must be configured locally for remote deployment/execution.
  • ⚠️Claude Code CLI (`@anthropic-ai/claude-cli`) may be required for Claude integration.
  • ⚠️Worktrees are used for agent isolation; ensure sufficient disk space and proper Git configuration.
  • ⚠️Third-party integration plugins extend functionality but require careful vetting and configuration.
  • ⚠️Manual cleanup of orphaned worktrees and branches may be necessary.
  • ⚠️Prompts can reference specs, issues, and files directly using `[[ID]]` or `@file` syntax, which needs to be understood for effective agent direction.
  • ⚠️For orchestrator workflows, goal-based workflows require the orchestrator engine (`config.engineType: 'orchestrator'`).
Verified SafeView Analysis
Sudocode operates directly within your Git repository, granting AI agents powerful capabilities including code modification, execution of arbitrary commands via tools (e.g., Bash), and direct manipulation of Git state (branches, worktrees). While designed for AI-assisted development, this level of access inherently carries risks. Key security considerations: 1. **Agent Autonomy**: Misconfigured or malicious agents could introduce bugs, compromise data, or execute unintended commands. The `dangerouslySkipPermissions` flag, if enabled, bypasses all interactive permission prompts, significantly increasing risk. 2. **Worktree Isolation**: Executions are isolated in Git worktrees by default, which is a strong protective measure, preventing direct modification of the main branch. However, changes are still intended to be merged back. 3. **Local-first Design**: All project data (`.sudocode/`) is version-controlled in your repository, and user-level credentials (`~/.config/sudocode/user_credentials.json`) are stored locally with restrictive `600` permissions, reducing external attack surface. 4. **External AI Services**: Relies on external AI CLI tools (Claude, Codex, Cursor). The security of the overall system is dependent on the security and behavior of these third-party agents. 5. **Plugins**: Supports third-party integration plugins, which could introduce vulnerabilities if not carefully vetted. 6. **Code Review**: Human oversight and code review of agent-generated changes are critical before merging to main branches. 7. **`restrictToWorkDir`**: The `AcpExecutorWrapper` supports a `restrictToWorkDir` option which, when enabled, configures a PreToolUse hook to block file operations outside the working directory. This enhances isolation but is not enabled by default for all execution modes.
Updated: 2026-01-18GitHub→
77
166
Low Cost
JSONbored icon
Sec9

A central directory and API gateway for discovering, searching, and managing various Claude configurations, including AI agents, MCP servers, rules, commands, and hooks. It provides content serving, search, and OAuth authorization for MCP clients.

Setup Requirements

  • ⚠️Requires Node.js >= 22.0.0 and pnpm >= 10.0.0.
  • ⚠️Requires a local Deno installation to serve/type-check Edge Functions locally (e.g., `brew install deno`).
  • ⚠️Heavy reliance on Supabase for database, authentication, and edge functions. Requires a Supabase project and associated keys.
Verified SafeView Analysis
The project demonstrates a strong focus on security, employing environment variables for all secrets, using timing-safe comparisons for critical keys, validating webhook signatures (Svix, Supabase), and sanitizing user-provided content (URLs, HTML). It uses Supabase's RLS and client isolation (anon vs. admin clients with justification) and implements rate limiting and circuit breakers for API resilience and abuse prevention. PII redaction is configured for logging. No 'eval' or obvious obfuscation was detected in the provided code snippets. Extensive architectural ESLint rules enforce secure coding practices.
Updated: 2026-01-18GitHub→
77
468
Medium Cost
smithery-ai icon

cli

by smithery-ai

Sec6

The Smithery CLI is a developer tool for installing, managing, building, running, and deploying Model Context Protocol (MCP) servers and integrating them with various AI clients.

Setup Requirements

  • ⚠️Requires NodeJS version 20 or above.
  • ⚠️Requires a Smithery API key for many operations (e.g., `login`, `search`, `deploy`, `dev` with tunneling), implying an account on the Smithery platform.
  • ⚠️Python (for `uvx`) or Bun (for `bunx`) might be required and prompted for installation if a `stdio` server connection uses these runtimes.
Verified SafeView Analysis
The CLI dynamically loads and executes server configurations, including `stdioFunction` (a deprecated feature but still present in code) using `new Function()`. If the Smithery registry is compromised, this could lead to arbitrary code execution when installing or running servers from it. The tool utilizes `keytar` for secure OS keychain storage of API keys, which is a good security practice. The `dev` and `playground` commands offer local server tunneling via `ngrok`, exposing local services to the internet, which carries inherent risks if not used carefully or with proper authentication for the exposed services.
Updated: 2026-01-16GitHub→
77
98
Medium Cost
nuxt-modules icon

mcp-toolkit

by nuxt-modules

Sec8

Develop a Model Context Protocol (MCP) server directly within a Nuxt application, allowing AI agents to interact with application functionalities, access data, and utilize predefined prompts.

Setup Requirements

  • ⚠️Requires manual installation of `zod` if not using `npx nuxt module add mcp-toolkit` for module setup.
  • ⚠️`nitro.experimental.asyncContext: true` must be enabled in `nuxt.config.ts` to access `useEvent()` within MCP handlers, which is crucial for middleware and context-aware tools (e.g., user authentication).
  • ⚠️Deployment to Cloudflare Workers requires an additional `agents` package to be installed.
Verified SafeView Analysis
The core functionality involves exposing HTTP server endpoints for AI agents. Implementers must ensure robust authentication and authorization, especially for sensitive operations. Examples provided use API keys and middleware for authentication, which is good practice. However, the 'file' resource example (e.g., `apps/playground/server/mcp/resources/file.ts`) demonstrates reading local files via a dynamic path (`file:///project/{+path}`). While its `list` function attempts to filter sensitive directories like `.git` and `node_modules`, the `handler` directly uses `variables.path` joined with `process.cwd()`. This poses a risk of arbitrary file access if the AI client is not strictly constrained or if the application layer does not implement comprehensive path validation or allow-listing. The documentation correctly notes that the application (not the AI) controls which resources are included in context, implying the implementer's responsibility to manage this risk.
Updated: 2026-01-19GitHub→
76
173
Medium Cost
universal-tool-calling-protocol icon

utcp-mcp

by universal-tool-calling-protocol

Sec3

This project acts as a versatile bridge exposing Universal Tool Calling Protocol (UTCP) tools as Model Context Protocol (MCP) tools, enabling AI agents and other MCP-compatible clients to discover, manage, and execute a wide range of external capabilities including APIs, command-line tools, and inline code execution.

Setup Requirements

  • ⚠️Requires Python 3.8+, Node.js 18+, or Rust toolchain, depending on the chosen bridge implementation and its specific features.
  • ⚠️Requires a `.utcp_config.json` file for defining tool providers and initial configurations.
  • ⚠️The default Docker setup exposes ports 8776 (Client MCP), 8777 (Proxy MCP), and 8778 (FastAPI web server) on all network interfaces (0.0.0.0), which may require firewall configuration or explicit binding to 127.0.0.1 for local development.
Review RequiredView Analysis
The server explicitly includes 'Code Mode' features in both its TypeScript and Rust implementations, allowing the execution of arbitrary user-provided code (TypeScript/Rhai scripts) with direct access to registered tools. This poses an extremely high security risk, as it enables arbitrary code execution on the host machine if the server is exposed to untrusted inputs or clients without robust sandboxing. Additionally, the Docker setup for the web UI/proxy/client services binds to 0.0.0.0 (all network interfaces) by default, increasing potential exposure.
Updated: 2025-11-27GitHub→
76
208
Medium Cost
atlassian icon
Sec9

The Atlassian Rovo MCP Server acts as a cloud-based bridge, connecting Atlassian Cloud sites (Jira, Compass, Confluence) with external AI tools and IDEs to enable real-time data interaction and automation of development workflows.

Setup Requirements

  • ⚠️Requires an Atlassian Cloud site with Jira, Compass, and/or Confluence.
  • ⚠️Requires access to a compatible client (e.g., OpenAI ChatGPT, Claude, Google Gemini) and a modern browser for OAuth 2.1 authorization.
  • ⚠️For local client/IDE setup, Node.js v18+ is required to run the `mcp-remote` proxy.
Verified SafeView Analysis
The server leverages secure OAuth 2.1 authorization and HTTPS (TLS 1.2+) to ensure data encryption and respect existing user permissions, including IP allowlisting. It highlights critical security warnings about prompt injection, indirect prompt injection, and tool poisoning attacks inherent when connecting AI agents to tools, emphasizing the need for trusted clients, least privilege, and human confirmation for high-impact actions. The JQL query builder script includes explicit input sanitization to prevent JQL injection. Admin controls for managing and monitoring app access, along with audit logging, are also noted. The core service is hosted by Atlassian, indicating enterprise-level security practices, though the full server-side code is not provided for complete analysis.
Updated: 2026-01-17GitHub→
76
278
Medium Cost
argoproj-labs icon

mcp-for-argocd

by argoproj-labs

Sec8

Enables AI assistants to interact with Argo CD applications through natural language, streamlining DevOps tasks.

Setup Requirements

  • ⚠️Requires an Argo CD instance with API access and an API token for authentication.
  • ⚠️Requires Node.js v18 or higher to run.
  • ⚠️Using `NODE_TLS_REJECT_UNAUTHORIZED=0` to bypass TLS certificate validation for self-signed certificates reduces security and is only recommended for development environments.
  • ⚠️Can be configured for read-only mode via `MCP_READ_ONLY=true` environment variable, otherwise all modification tools are available.
Verified SafeView Analysis
The server uses environment variables (ARGOCD_BASE_URL, ARGOCD_API_TOKEN) for sensitive information, which is a good practice. It supports different transport protocols (stdio, SSE, HTTP Stream), requiring proper network security configuration (e.g., firewalls, access control) by the user. A significant security warning is explicitly mentioned in the README regarding `NODE_TLS_REJECT_UNAUTHORIZED=0` for self-signed certificates, which disables TLS verification and should be used with extreme caution. Input validation for tool parameters is handled using Zod, which helps prevent injection attacks. A `MCP_READ_ONLY` flag exists to disable modification tools, enhancing security for read-only deployments.
Updated: 2025-12-03GitHub→
75
368
High Cost
graphlit icon
Sec4

The Model Context Protocol (MCP) Server integrates with the Graphlit platform to ingest diverse data sources, build a searchable knowledge base, and enable LLM-powered search, retrieval, RAG, and generative capabilities for MCP clients.

Setup Requirements

  • ⚠️Requires Node.js 18.x or higher to be installed.
  • ⚠️An active account on the Graphlit Platform with specific API credentials (GRAPHLIT_ENVIRONMENT_ID, GRAPHLIT_ORGANIZATION_ID, GRAPHLIT_JWT_SECRET) is mandatory for basic operation.
  • ⚠️Accessing specific data connectors and features (e.g., Slack, Google Drive, Twitter, Notion, Jira) necessitates configuring a large number of additional, sensitive environment variables, each unique to the respective third-party service.
Review RequiredView Analysis
The server includes several functionalities that, if exposed to untrusted user input, could lead to severe vulnerabilities: 1. **Server-Side Request Forgery (SSRF):** The `ingestUrl` and `retrieveImages` tools directly accept a `url` parameter and perform `fetch(url)` or delegate to `client.ingestUri(url)`. An attacker could exploit this to make the server request arbitrary internal or external resources, potentially scanning internal networks, accessing sensitive local services, or bypassing firewall rules. 2. **Local File Inclusion (LFI):** The `ingestFile` tool accepts a `filePath` parameter and uses `fs.readFileSync(filePath)`. If an attacker can control this `filePath`, they could read any file on the server's filesystem that the Node.js process has permissions to access (e.g., `/etc/passwd`, `.env` files, SSH keys). 3. **Extensive Environment Variable Reliance:** Full functionality requires numerous environment variables for various third-party integrations (e.g., Slack, GitHub, Google, Twitter, Notion). Improper configuration or exposure of these secrets significantly increases the attack surface for account compromise. While the server's internal logic doesn't appear to contain explicit `eval` or intentional malicious code, the aforementioned input-driven vulnerabilities make it risky to run without robust input validation and strict isolation, especially when processing untrusted data.
Updated: 2026-01-12GitHub→
PreviousPage 24 of 713Next