Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(8554)

0
0
Medium Cost
peacockery-studio icon

sharepoint-mcp

by peacockery-studio

Sec8

Provides Claude with access to Microsoft SharePoint for folder and document management via the Microsoft Graph API.

Setup Requirements

  • ⚠️Requires manual Azure AD Application registration, including setting redirect URI, creating a client secret, and configuring API permissions (Sites.ReadWrite.All, Files.ReadWrite.All).
  • ⚠️Granting admin consent for Azure AD API permissions may be required, which necessitates Azure AD admin privileges.
  • ⚠️Initial authentication requires running a separate local HTTP server (`npm run auth-server`) and completing a browser-based OAuth flow.
Verified SafeView Analysis
The server correctly uses environment variables for sensitive credentials (client ID, client secret, tenant ID). OAuth tokens are stored locally in a file (`~/.sharepoint-mcp-tokens.json`), which is a common practice for local MCP servers, but implies that these tokens are vulnerable if the user's local machine is compromised. The authentication server runs on localhost using HTTP, which is standard for local OAuth callback flows. No 'eval' or obvious malicious patterns were found.
Updated: 2025-12-05GitHub→
0
0
Medium Cost
deshmukhsushil icon
Sec5

A server application designed to manage and send cold outreach emails.

Setup Requirements

  • ⚠️Email service API credentials (e.g., SMTP host, user, password)
Review RequiredView Analysis
Cannot perform a thorough security audit as the source code was summarized and not provided. Therefore, no specific risks like 'eval', obfuscation, network vulnerabilities, hardcoded secrets, or malicious patterns could be identified or ruled out. The score is neutral due to this critical lack of information.
Updated: 2025-11-27GitHub→
0
0
Low Cost
Legitate icon
Sec3

Manages employee data (CRUD) via Model Context Protocol (MCP) using various transports (HTTP SSE, Stdio, WebSocket) with Google OAuth for authentication and an external JSON-server for data storage.

Setup Requirements

  • ⚠️The `ENCRYPTION_KEY` environment variable is critical for secure token storage; if not set, an insecure default key is used, making user tokens vulnerable.
  • ⚠️Requires a separate external JSON-server API to be running concurrently on port 4000 via `node Deployment/run_api.js` for data persistence.
  • ⚠️The Stdio mode starts a local Express server on port 3000 (or `PORT` in .env) for OAuth callbacks, which can lead to port conflicts if another service (like the HTTP server) is already running on the same port.
Review RequiredView Analysis
CRITICAL: The `ENCRYPTION_KEY` used for token storage defaults to an 'insecure-default-secret' if the `ENCRYPTION_KEY` environment variable is not explicitly set. This makes stored authentication tokens vulnerable if deployed without proper configuration. Additionally, CORS is broadly enabled without specific origin restrictions, which might be a security concern in production environments. The external API endpoint relies on `http://localhost:4000` by default, which should be secured if exposed externally.
Updated: 2025-12-13GitHub→
0
0
Low Cost
CyrilDesch icon

SRAG-MCP

by CyrilDesch

Sec1

The specific use case for SRAG-MCP cannot be determined as its source code was not provided for analysis.

Review RequiredView Analysis
Source code was not provided for analysis. Therefore, a security audit cannot be performed, and its safety cannot be verified. It is considered unsafe to run without code review, as critical checks for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns could not be made.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
seo-jinseok icon

korean-law-mcp

by seo-jinseok

Sec9

Provides a comprehensive toolset for searching, retrieving, and analyzing Korean legal information from the National Law Information Center (law.go.kr).

Setup Requirements

  • ⚠️Requires a free API ID from law.go.kr (National Law Information Center) to be set as OPEN_LAW_ID.
  • ⚠️Requires an active internet connection to communicate with the law.go.kr Open API.
  • ⚠️Requires Python 3.10 or higher.
Verified SafeView Analysis
The server uses standard `requests` and `xmltodict` libraries for API communication and XML parsing. It correctly loads the `OPEN_LAW_ID` from environment variables, preventing hardcoding of secrets. No `eval` or `exec` functions are used in the core server logic. Development scripts use `subprocess.run` but are not part of the deployed server.
Updated: 2025-12-26GitHub→
0
0
Medium Cost
gauravkheterpal icon

copado_mcp

by gauravkheterpal

Sec9

Exposes Copado DevOps capabilities to LLMs for managing user stories, promotions, and deployments.

Setup Requirements

  • ⚠️Requires a Salesforce instance with Copado installed for real API mode.
  • ⚠️Requires Salesforce access token and instance URL for real API mode, provided via environment variables (SALESFORCE_INSTANCE_URL, SALESFORCE_ACCESS_TOKEN).
  • ⚠️Requires the Python 'requests' library for interacting with the Salesforce API.
Verified SafeView Analysis
The server uses environment variables for Salesforce API credentials, which is a secure practice. It runs over stdio, limiting direct network exposure. Reliance on Salesforce REST API security and permissions is external to this server's code but critical for overall security. No 'eval' or obvious malicious patterns found.
Updated: 2025-11-26GitHub→
0
0
Medium Cost
arielolin icon

apiiro-mongo-mcp

by arielolin

Sec3

This MCP server allows users to query and manage MongoDB deployments running in Kubernetes, handling gcloud authentication, permission escalation, and Kubernetes context/namespace selection.

Setup Requirements

  • ⚠️Requires `kubectl` and `gcloud` CLIs to be pre-installed and configured with appropriate access to Kubernetes clusters.
  • ⚠️Requires a MongoDB deployment named `lim-mongo` to exist in the target Kubernetes namespace.
  • ⚠️Requires manual initial `gcloud auth login` and `gcloud container clusters get-credentials` to set up Kubernetes contexts for GKE, as detailed in the README.
Review RequiredView Analysis
The server uses `child_process.exec` to run `kubectl` and `gcloud` commands. It constructs shell commands by interpolating user-provided values for Kubernetes context, namespace, MongoDB credentials (`mongoAuth`), and MongoDB queries (`query`/`expression`). Although there's an attempt to escape double quotes and dollar signs in the MongoDB query, this is insufficient for comprehensive shell injection prevention. Specifically, user-provided `context` and `namespace` are not escaped when used in `kubectl` commands, and user-provided `mongoAuth` (username/password) are interpolated into `mongosh` command-line arguments using simple double quotes, which are vulnerable if the credentials themselves contain malicious characters (e.g., `"$(evil_command)"`). This allows for potential arbitrary command execution on the host where the MCP server runs, or within the target MongoDB pod.
Updated: 2025-11-26GitHub→
0
0
Medium Cost
jhonny028966 icon

pg-aiguide

by jhonny028966

Sec9

An MCP server and Claude plugin designed to enhance AI coding tools by providing specialized PostgreSQL and TimescaleDB documentation, semantic search capabilities, and curated best practice skills.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid)
  • ⚠️Requires PostgreSQL database with `pgvector` extension enabled
  • ⚠️Local documentation ingestion (optional) requires Docbook Toolsets and `uv` (Python package manager)
Verified SafeView Analysis
The server employs standard security practices such as loading sensitive database credentials and API keys from environment variables, preventing hardcoding. SQL queries are parameterized to mitigate SQL injection risks. There is no usage of 'eval' or other obfuscation techniques. Network interactions are primarily with a PostgreSQL database and OpenAI for embedding generation, which are standard for its functionality. Overall, the codebase appears robust regarding common web application security concerns.
Updated: 2026-01-19GitHub→
0
0
Medium Cost

MCP-Server

by skytronex

Sec1

Provides a standardized interface for connecting AI applications with external tools and data, facilitating AI prompt engineering and a development approach called 'vibe coding'.

Setup Requirements

  • ⚠️Requires access to an external AI model API (e.g., OpenAI, Anthropic) or a locally running LLM.
Review RequiredView Analysis
Insufficient source code provided for a meaningful security audit. Only README and LICENSE files were available; no executable code was present to analyze for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns. Cannot confirm safety.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
mikesmallhelp icon

chatbot-and-mcp-servers

by mikesmallhelp

Sec6

A chatbot application that integrates with Model Context Protocol (MCP) servers, allowing AI assistants to use external tools for task execution and augmented capabilities.

Setup Requirements

  • ⚠️Requires `AI_GATEWAY_API_KEY` for Vercel AI Gateway, which is typically a paid service.
  • ⚠️External MCP servers (e.g., Playwright, Filesystem) must be installed and properly configured in `chatbot-and-mcp-servers-config.json`. The example `/path/to/folder` for the `filesystem` server needs to be replaced with a valid local directory.
  • ⚠️The `AI_GATEWAY_MODEL` environment variable must be set to a valid model identifier compatible with Vercel AI Gateway.
Verified SafeView Analysis
The application spawns external processes via `StdioClientTransport` by executing commands defined in `chatbot-and-mcp-servers-config.json`. While these commands are configured by the developer and not directly from user input in the chat, a compromised configuration file could lead to arbitrary command execution on the host system. Environment variables from `process.env` are merged with `serverConfig.env`, which could expose sensitive data if `serverConfig.env` is not carefully managed. No 'eval' or obvious obfuscation found. Hardcoded secrets are avoided by using environment variables.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
kukapay icon
Sec10

Access aggregated crypto news, market insights, and sentiment analysis.

Setup Requirements

  • ⚠️Requires a client (e.g., Claude Desktop, Cursor, Windsurf) that supports the MCP specification and `streamable_http` transport.
Verified SafeView Analysis
The provided source code is only a README.md file, describing how to connect to a publicly hosted server. There is no executable code in this repository to audit for local security risks, 'eval', obfuscation, hardcoded secrets, or malicious patterns. Security concerns would be related to the remote server itself, which is outside the scope of analyzing this repository's source code.
Updated: 2025-11-29GitHub→
0
0
Low Cost
glandua icon

regen-mcps

by glandua

Sec8

Centralized management and configuration of Regen Network Model Context Protocol (MCP) servers for integration with Claude Code.

Setup Requirements

  • ⚠️Requires Node.js and npm
  • ⚠️Requires `uv` Python dependency manager
  • ⚠️Relies on Git submodules
Verified SafeView Analysis
The `update-mcps.sh` script executes standard `git pull`, `npm install`, `npm run build`, and `uv sync` commands. It does not contain 'eval', obfuscation, or hardcoded secrets. The primary security consideration is the implicit trust in the external submodule repositories (regen-network/mcp, gaiaaiagent/regen-koi-mcp, gaiaaiagent/regen-python-mcp) which are fetched and built. No direct vulnerabilities in this project's own logic are identified from the provided source.
Updated: 2025-12-10GitHub→
PreviousPage 304 of 713Next