Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(8554)

0
0
Low Cost
xuemingqi icon

mcp

by xuemingqi

Sec3

This server acts as a Model Context Protocol (MCP) tool provider, exposing various functionalities (like user management and mail services) as AI-callable tools for Spring AI applications.

Setup Requirements

  • ⚠️Requires a MySQL database instance to be accessible at the configured URL, username, and password.
  • ⚠️Requires a Redis server instance to be accessible at the configured address and password.
  • ⚠️Requires `x-framework` libraries to be built and available as dependencies (suggesting a multi-module Maven/Gradle project).
  • ⚠️The default configurations in `application.yml` for database and Redis (`username: username`, `password: ''`) are insecure and must be changed for any non-local/test environment.
Review RequiredView Analysis
Critical security risks identified: 1. **Hardcoded Empty Passwords:** `application.yml` contains hardcoded empty passwords for MySQL (`password: ''`) and Redis (`password: ''`). This is highly insecure and makes the server vulnerable to unauthorized access. 2. **Hardcoded API Keys:** The client's `application.yml` (though not the primary focus, it's part of the repo) contains a hardcoded DeepSeek/OpenAI API key (`api-key: sk-413c6606010c4852939181278ed7e4a2`), which is a critical secret exposure. 3. **Custom Authentication via Query Params:** The `McpFilter` implements custom authentication using `key` or `sessionId` passed as query parameters. Relying on query parameters for sensitive authentication tokens is generally less secure than using HTTP headers, as query parameters can be logged more easily and persist in browser history/proxy logs. 4. **Extensive Logging:** The `McpFilter` logs full request and response bodies, which could inadvertently expose sensitive data if not handled with caution in production environments. 5. **Test Secrets:** The `ClientSse.java` test file contains a hardcoded key (`sk-e7030e17d1d64881a44a53b359af1644`), which is poor practice even in test code as it could be mistakenly deployed or reveal patterns.
Updated: 2025-11-19GitHub→
0
0
Low Cost
aanal25patel icon

test_remote_mcp_server

by aanal25patel

Sec8

This server functions as an expense tracker, allowing users to add, list, and summarize financial expenditures via an API.

Setup Requirements

  • ⚠️Requires Python 3.12 or newer.
  • ⚠️Requires file system write access in the temporary directory for the SQLite database.
Verified SafeView Analysis
The server uses parameterized queries for all database operations, effectively preventing SQL injection. It does not contain 'eval', hardcoded secrets, or obvious obfuscation. File system write access is required for the SQLite database in the temporary directory. Listening on '0.0.0.0' makes it accessible on all network interfaces, which is a deployment consideration rather than a code vulnerability.
Updated: 2025-11-27GitHub→
0
0
High Cost
vreme-ai icon

temporal-mcp

by vreme-ai

Sec8

Provides an AI assistant with comprehensive temporal intelligence, including timezone conversions, multi-cultural calendars, holiday data, business time calculations, and astronomical events.

Setup Requirements

  • ⚠️Requires an active connection to the external Vreme Time API (api.vreme.ai) for its core functionality, which may incur costs or require registration/API keys not detailed in the provided context.
  • ⚠️Requires Node.js runtime version 18.0.0 or higher.
  • ⚠️It is designed to be run as an MCP server, meaning an MCP-compatible AI client (e.g., Claude Desktop, VS Code, Continue, Cline) is necessary for its intended use.
Verified SafeView Analysis
The server primarily acts as a proxy to an external Vreme Time API (defaulting to https://api.vreme.ai). While API calls are made over HTTPS, the security and reliability of this external service are critical dependencies outside the scope of this source code analysis. The server uses `StdioServerTransport` for communication with MCP clients, which typically involves standard I/O and does not inherently expose network ports. Input validation for tools is implemented using Zod schemas. Local activity context is stored in a file (`~/.vreme/temporal-context.json`), which could be sensitive depending on user interaction patterns, but no direct filesystem vulnerabilities or hardcoded secrets were identified. No `eval` or obvious obfuscation patterns were detected.
Updated: 2025-12-30GitHub→
0
0
Medium Cost
Tuckdin icon
Sec8

The Cortex MCP Server provides a semantic search interface and content ingestion capabilities for a knowledge base focused on ICT trading and social intelligence.

Setup Requirements

  • ⚠️Requires an OpenAI API Key (Paid service for embeddings)
  • ⚠️Requires a Supabase project URL and API Key for data storage
  • ⚠️Python environment with specific dependencies (fastmcp, openai, supabase) must be set up
Verified SafeView Analysis
The application uses environment variables for sensitive API keys (OpenAI, Supabase) and initializes clients lazily, which are good practices. There's no evident use of 'eval' or direct arbitrary code execution. Database interactions use the Supabase client library, which is generally expected to handle parameterization and prevent basic SQL injection for queries and inserts. The `ilike` pattern in `search_text` passes user input directly; while Supabase client usually handles this, it's a point where a very sophisticated payload *could* potentially cause issues if not fully escaped by the library (though unlikely for typical `ilike` usage). Overall, appears reasonably secure for a Python application using modern client libraries.
Updated: 2025-12-04GitHub→
0
0
Medium Cost
Hao17 icon
Sec7

Provides AI systems programmatic access to Ghidra's reverse engineering capabilities via an HTTP JSON API.

Setup Requirements

  • ⚠️Requires Ghidra to be running; the `ghidra_mcp_server.py` script must be executed within Ghidrathon.
  • ⚠️Requires `pip install mcp uvicorn httpx` for the MCP SSE proxy functionality.
  • ⚠️The Python interpreter path for the MCP SSE proxy (`scripts/mcp_sse_proxy.py`) might need to be explicitly set via the `GHIDRA_MCP_PYTHON` environment variable if Ghidrathon's embedded Python is not accessible to subprocesses.
Verified SafeView Analysis
The server binds to localhost (127.0.0.1) by default, limiting network exposure. The use of `eval` in `api/demo.py` is contained within hardcoded, known strings, making it non-exploitable as implemented. `subprocess.Popen` is used to run an SSE proxy, which is a legitimate architectural pattern. The core functionality involves passing HTTP query parameters directly to Ghidra's Java APIs via Ghidrathon; the security relies heavily on the robustness of Ghidra's APIs against malicious input, which could potentially lead to crashes or unexpected behavior within the Ghidra environment. However, direct remote code execution on the underlying system is not an apparent risk due to these design choices.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
t-neumann icon

TxGemma-MCP

by t-neumann

Sec1

Deploying the TxGemma model as a local MCP server for AI/ML inference.

Setup Requirements

  • ⚠️Gemma model files must be downloaded and configured for the server.
  • ⚠️Requires sufficient compute resources (CPU/GPU, RAM) for running the Gemma model locally.
Review RequiredView Analysis
No source code (beyond README.md) was provided for analysis. Therefore, a security audit cannot be performed for patterns like 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns. The server's safety cannot be verified.
Updated: 2026-01-19GitHub→
0
0
Low Cost
FaisalAhmedBijoy icon

AI-Agent-MCP-Server

by FaisalAhmedBijoy

Sec3

Serves as a backend for AI agents, likely in the context of Minecraft (MCP).

Review RequiredView Analysis
Only the README.md file was provided as source code, preventing a comprehensive security audit for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns. The safety of running this project cannot be determined without access to its actual implementation.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
HeshamWM icon

idfm-mcp-server

by HeshamWM

Sec9

Provides real-time Paris public transport data (Île-de-France Mobilités) to AI assistants via an MCP server.

Setup Requirements

  • ⚠️Requires Docker Desktop with MCP Toolkit enabled.
  • ⚠️Requires a PRIM API key from prim.iledefrance-mobilites.fr (registration likely required, possibly paid tiers).
  • ⚠️Uses Python 3.11.
Verified SafeView Analysis
The server correctly handles API keys by fetching them from environment variables or Docker-mounted secret files, preventing hardcoding. It uses `httpx` for HTTP requests, which is standard. No `eval` or other dangerous code execution patterns are observed. The container is designed to run as a non-root user. Overall, it follows good security practices for an API wrapper.
Updated: 2025-11-19GitHub→
0
0
Low Cost
serser152 icon

planner_mcp

by serser152

Sec9

A Micro-Capability Protocol (MCP) server designed to serve as a planning tool for an intelligent agent, providing task management and time/date functionalities.

Setup Requirements

  • ⚠️Requires Docker for the recommended installation and execution method.
  • ⚠️The 'add_task' function, although defined in 'mcp_server.py' and mentioned in the README's function list, is not decorated with '@mcp.tool()' and therefore not exposed as an accessible tool for agents via the MCP server.
  • ⚠️The 'get_current_time' function hardcodes a '+3 hours' timedelta, potentially leading to unexpected time values if the agent/user expects UTC or a different local timezone.
Verified SafeView Analysis
The server uses SQLAlchemy for all database interactions, which properly parameterizes queries and mitigates SQL injection risks. No 'eval' or direct shell command execution with user input was identified. No hardcoded sensitive credentials were found. The server binds to '0.0.0.0' for network access, which is standard for container deployments but requires appropriate host firewall configuration for external exposure.
Updated: 2025-11-26GitHub→
0
0
Medium Cost
Clauskraft icon
Sec9

Serves as a universal API gateway for Claude Desktop, providing access to various external services like social media, search engines, and LLMs through the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires API keys for external services (Twitter, Google, OpenAI/LLM, Brave), which may incur costs or rate limits.
  • ⚠️Requires Node.js/npm or Docker runtime environment.
  • ⚠️Designed for integration with Claude Desktop.
Verified SafeView Analysis
The provided `src/index.ts` is a stub that defines tools but does not implement their actual functionality to call external APIs (Twitter, Google, LLM, Brave). It currently only logs tool calls and returns a dummy string. No 'eval' or direct network requests are present in this specific file. Environment variables are used for API keys, which is good practice. If the actual API integration logic were present, a deeper security analysis of those integrations (e.g., handling credentials, input sanitization for external calls) would be necessary.
Updated: 2025-11-18GitHub→
0
0
Medium Cost
vibeatlas icon

ship-mcp-server

by vibeatlas

Sec9

Provides AI coding reliability scores and feedback mechanisms for AI coding assistants like Claude Desktop and Cursor by integrating with the SHIP Protocol API.

Setup Requirements

  • ⚠️Requires Node.js (version 18 or higher) and npm/npx to be installed on the host machine.
  • ⚠️Requires manual configuration in the settings of AI coding environments (e.g., Claude Desktop or Cursor).
  • ⚠️Optional `SHIP_API_KEY` can be provided for personalized predictions, which may involve usage costs or registration with the external SHIP Protocol service.
Verified SafeView Analysis
The server's source code is clear and does not exhibit direct use of dangerous functions like 'eval', code obfuscation, or hardcoded secrets. It utilizes environment variables for sensitive data like API keys. The primary security consideration lies in its reliance on an external SHIP Protocol API (ship.vibeatlas.dev). While the client code itself appears robust, the security and data handling practices of the external API are critical and should be trusted by the user.
Updated: 2025-12-06GitHub→
0
0
Medium Cost
multiluca2020 icon

visum-thinker-mcp-server

by multiluca2020

Sec1

AI-driven sequential thinking, large PDF processing, and PTV Visum transportation modeling analysis and automation.

Setup Requirements

  • ⚠️Requires Windows operating system due to heavy reliance on PowerShell and PTV Visum COM API.
  • ⚠️Requires PTV Visum (defaulting to 2025 64-bit) to be installed on the system, including its Python API (VisumPy).
  • ⚠️Many hardcoded file paths (e.g., 'H:\Program Files\PTV Vision\PTV Visum 2025\Exe\Python\python.exe', 'H:\go\italferr2025\Campoleone\...') necessitate adaptation to the specific deployment environment.
  • ⚠️Processing large PDF files and complex Visum projects can be memory and disk intensive.
Review RequiredView Analysis
CRITICAL VULNERABILITY: The server executes dynamically generated or user-provided Python code directly using `exec()` within a privileged Python environment that has access to the PTV Visum COM object. This allows for arbitrary code execution, which is extremely dangerous. Any malicious input to tools like `visum_custom_analysis`, `project_execute_analysis`, or `project_execute` could compromise the entire system if not properly sandboxed or strictly sanitized. Given the COM object access, this could lead to system-level compromise on the host machine.
Updated: 2026-01-18GitHub→
PreviousPage 356 of 713Next