Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(8554)

0
0
Low Cost
Ryno-Crypto-Mining-Services icon

braiins-os-mcp-server

by Ryno-Crypto-Mining-Services

Sec7

AI-assisted management and monitoring of Braiins OS ASIC mining operations via Model Context Protocol (MCP), enabling AI agents like Claude to interact with miner firmware.

Setup Requirements

  • ⚠️Requires Node.js 20.x LTS.
  • ⚠️Docker and Docker Compose are listed as prerequisites, but recent internal reviews note deployment infrastructure (Dockerfile, docker-compose.yml, K8s configs) is incomplete.
  • ⚠️Relies on a non-native cron scheduling workaround, as the Braiins OS API lacks native cron support for power schedules. This requires an application-level scheduler or external system cron.
  • ⚠️A recent internal review (2026-01-13) notes 9 failing tests and broken test coverage reporting, which require investigation for full stability.
Verified SafeView Analysis
The project demonstrates strong intent and implementation of security best practices, including TLS 1.3 for transport, JWT for authentication, role-based access control (RBAC), AES-256 encryption for data at rest, comprehensive audit logging, and masking of sensitive data in logs. It also uses `helmet` for HTTP security. However, internal documentation (PRODUCTION_READINESS_CHECKLIST.md) indicates the OWASP Top 10 security audit is 0% executed, suggesting formal verification and hardening is still in progress. No critical immediate vulnerabilities (e.g., 'eval', hardcoded critical secrets) were found.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
bassa01 icon
Sec8

Provides a Model Context Protocol (MCP) server that connects to Google Cloud services to offer context and tools for interacting with various Google Cloud resources.

Setup Requirements

  • ⚠️Requires Node.js 24.11.0 or newer.
  • ⚠️Requires pnpm 10.21.0+ via Corepack.
  • ⚠️Requires Google Cloud authentication (e.g., `GOOGLE_APPLICATION_CREDENTIALS` or `gcloud` ADC) configured to access GCP services.
  • ⚠️The `gcloud-run-read-command` tool requires the Google Cloud CLI (`gcloud`) to be installed and available on the system's PATH.
Verified SafeView Analysis
The server integrates with the Google Cloud CLI (`gcloud`), which is inherently a high-risk operation. However, the codebase implements robust guardrails to mitigate this risk, including: 1. A strict read-only policy for `gcloud` commands, blocking mutable verbs (e.g., `create`, `delete`, `update`) and sensitive prefixes (e.g., `iam`, `secret-manager`, `kms`). 2. Enforcement of service account identity for `gcloud` commands, preventing execution with personal credentials. 3. Comprehensive read-only assertion for SQL queries in BigQuery and Spanner, explicitly denying destructive statements (`INSERT`, `UPDATE`, `DELETE`, `DROP`, `ALTER`, `CREATE`). 4. Log redaction policies to scrub sensitive data (IPs, user identifiers, request bodies) from Logging outputs unless explicitly authorized by roles. 5. General input sanitization and rate-limiting via an `McpSecurityValidator`. While the `gcloud` CLI integration remains a potential vector, the implemented policies significantly reduce its exploitability. No obvious hardcoded secrets or `eval` misuse were found.
Updated: 2025-11-19GitHub→
0
0
Medium Cost
sharkusmanch icon

steam-mcp-server

by sharkusmanch

Sec9

An MCP server that provides tools for interacting with the Steam Web API to access game library, achievements, and player data.

Setup Requirements

  • ⚠️Requires a Steam Web API Key (Free, but needs a Steam account).
  • ⚠️Requires Node.js >= 18.0.0.
  • ⚠️Many tools (e.g., `get_inventory`, `get_achievements`, `get_friends_list` with full info) require the target Steam profile to be public, otherwise calls may fail or return incomplete data.
Verified SafeView Analysis
The server implements strong security practices: Steam API keys are loaded from environment variables (`STEAM_API_KEY`), preventing hardcoding. Input validation is applied to sensitive parameters like Steam IDs, vanity URLs, and IP addresses, using regular expressions. Critically, the `get_servers_at_address` tool explicitly blocks private, internal, loopback, and multicast IP ranges to prevent Server-Side Request Forgery (SSRF) attacks. Error messages are sanitized by `sanitizeErrorMessage` to avoid leaking internal server details or sensitive information, replacing them with generic, actionable messages.
Updated: 2026-01-15GitHub→
0
0
High Cost
HarryReidx icon

spring-mcps

by HarryReidx

Sec3

Ingest and semantically enhance documents (PDF, Markdown) into Dify knowledge bases, with VLM for image analysis and LLM for text summarization, while monitoring task status via a web frontend.

Setup Requirements

  • ⚠️Requires PostgreSQL database for task management and image metadata persistence.
  • ⚠️Requires external MinerU service for PDF/document parsing.
  • ⚠️Requires Dify instance and API Key for knowledge base interaction.
  • ⚠️Requires external VLM and LLM services (e.g., OpenAI, Qwen, Ollama) which may incur usage costs and need specific API keys/credentials.
Review RequiredView Analysis
The `application.yml` file contains hardcoded default values for critical credentials (Dify API Key, PostgreSQL username/password, MinIO access key/secret key). While environment variables can override these, the defaults themselves are publicly visible in the repository, posing a significant security risk if used in production without being explicitly overridden. This could lead to unauthorized access to Dify, MinIO, and the database. External services (MinerU, VLM, LLM) URLs are also hardcoded to a specific IP (`117.50.75.212`) as defaults, which could expose internal network structure or lead to unintended connections if not overridden. The `RequestCleanupFilter` is a good practice for cleaning request bodies.
Updated: 2025-12-18GitHub→
0
0
Medium Cost
manutej icon
Sec8

Orchestrates multiple AI models through Crush CLI for Claude Code, enabling intelligent strategy selection based on speed, cost, and quality requirements.

Setup Requirements

  • ⚠️Requires Crush CLI installed (e.g., `brew install charmbracelet/tap/crush`).
  • ⚠️Requires API keys for AI models (Grok, Anthropic) to be configured in Crush CLI's configuration file (`~/.local/share/crush/crush.json`) for real execution, which may incur paid usage.
  • ⚠️Requires Node.js version 18 or higher to run the server.
  • ⚠️Manual configuration in Claude Code's settings file (`~/.claude/settings.json`) is needed for integration.
Verified SafeView Analysis
The server primarily uses stdio for communication, reducing direct network exposure. It spawns the external `Crush CLI` binary, delegating actual model interactions and API key management to it. Security largely depends on the `Crush CLI`'s configuration (e.g., API keys stored in `~/.local/share/crush/crush.json`) and the security of the Crush binary itself. No direct `eval` or obvious malicious patterns were found in the provided source code.
Updated: 2025-11-29GitHub→
0
0
Medium Cost
msilverblatt icon

wiki-mcp

by msilverblatt

Sec9

Provide comprehensive access to Wikipedia articles via a Model Context Protocol (MCP) server, offering tools for searching, content retrieval, summaries, categories, links, images, languages, and external references.

Setup Requirements

  • ⚠️Requires Bun runtime (version 1.2.0 or higher)
Verified SafeView Analysis
The server uses 'zod' for robust input validation, includes request timeout handling, and comprehensive error handling. It interacts with standard Wikipedia API endpoints (en.wikipedia.org/w/api.php and en.wikipedia.org/api/rest_v1). No 'eval' or obfuscation is present in the provided source. HTML stripping for search snippets is a good sanitization practice. No hardcoded sensitive secrets were found.
Updated: 2025-12-13GitHub→
0
0
Low Cost
Luis-E-Dev icon
Sec2

Connects to an MCP server to fetch account data and write it to Google Sheets.

Setup Requirements

  • ⚠️Requires a separate, locally running MCP server with a `search_accounts` tool (the server's code is not provided).
  • ⚠️The hardcoded absolute path to the MCP server (`/Users/luisescalante/Desktop/my-new-mcp-server/main.py`) in `client.py` must be updated by the user to their local server path.
  • ⚠️Requires Google Cloud project setup, Sheets API enablement, and a service account JSON key; the provided `googlecredential.json` file is incorrect for service account authentication and exposes personal credentials.
Review RequiredView Analysis
The repository includes a `googlecredential.json` file containing a plain text email and password, which is a severe security risk and exposes personal credentials. Although the `client.py` code expects a Google Service Account JSON key (as per the `creds.json` described in the README), the presence of this sensitive file in the repository is a major security flaw. Additionally, the client executes an external MCP server script via a hardcoded absolute path (`/Users/luisescalante/Desktop/my-new-mcp-server/main.py`), making its security dependent on the integrity and trustworthiness of that unprovided script and the execution environment.
Updated: 2026-01-17GitHub→
0
0
Medium Cost
dsd2077 icon
Sec1

Analysis of the server's function and purpose is not possible due to the absence of provided source code.

Setup Requirements

  • ⚠️Source code not provided, unable to identify specific setup requirements or friction points.
Review RequiredView Analysis
Source code was not provided for analysis. Therefore, a comprehensive security audit could not be performed, and the server's safety cannot be determined. All security risks are unknown, making it inherently unsafe to assume it's secure.
Updated: 2025-11-26GitHub→
0
0
Low Cost
skspyapa icon
Sec1

Provides personalized clothing suggestions based on current weather conditions.

Review RequiredView Analysis
Critical: Source code not provided beyond README.md, making it impossible to conduct a security audit for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns. Users should exercise extreme caution as safety cannot be verified without code inspection.
Updated: 2025-12-06GitHub→
0
0
High Cost
Satyampant icon
Sec8

A Python code security analyzer powered by OpenAI Agents and Semgrep MCP server, identifying vulnerabilities and recommending fixes through a web interface.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid)
  • ⚠️Python 3.12+
  • ⚠️Node.js 20+
  • ⚠️Semgrep CLI/MCP server needs to be installable/accessible (via `uvx semgrep-mcp`)
Verified SafeView Analysis
The core application (`backend/server.py`) uses `os.getenv` for API keys and securely limits AI agent tools to `semgrep_scan` via `create_static_tool_filter`, which is a strong positive. However, the `/semgrep-test` endpoint uses `subprocess.run` to execute `pip install semgrep`, which introduces a minor supply chain risk if the execution environment is compromised, though it's a fixed command. An unrelated `airline.py` file containing a direct `eval(expr)` exists in the repository but is not imported or used by the main API server.
Updated: 2025-12-02GitHub→
0
0
Medium Cost
agiprolabs icon
Sec9

An extended MCP server for AI-driven sequential problem-solving, enabling context persistence, task management, and auto-documentation of thinking sessions.

Setup Requirements

  • ⚠️Requires Node.js version 20 or higher.
  • ⚠️Relies on an MCP-compatible AI client (e.g., Claude Desktop) for interaction.
  • ⚠️Persistent storage for sessions, thoughts, and tasks is saved to a local directory defined by the `DATA_PATH` environment variable (defaults to `./data`), which needs appropriate permissions and management, especially in containerized environments.
Verified SafeView Analysis
The server uses a file-based storage mechanism (`FileStorage`) for persistence, relying on a configurable `DATA_PATH` to store JSON files. It communicates over standard I/O (`StdioServerTransport`) with the MCP client, limiting direct network exposure. No 'eval' or obvious code obfuscation was found. Potential risks are primarily related to file system access if `DATA_PATH` is misconfigured, but this is a standard risk for any file-writing application. The dependencies like `express` and `cors` are part of the broader `@modelcontextprotocol/sdk` but are not directly instantiated by this specific server's core logic which is focused on stdio transport.
Updated: 2025-12-03GitHub→
0
0
Low Cost

mcp-demo-repo

by deki18

Sec10

This file serves as a demonstration and description of a GitHub MCP Server's capabilities, focusing on repository management actions like searching, creating repositories, and creating files.

Setup Requirements

  • ⚠️The described 'GitHub MCP Server' would inherently require a GitHub API Token with appropriate permissions (e.g., repo scope) to perform repository search, creation, and file creation operations.
  • ⚠️The actual source code for the 'GitHub MCP Server' itself is not provided, making it impossible to identify its specific setup requirements or dependencies.
Verified SafeView Analysis
The provided 'SOURCE CODE' is a static markdown file (`demo.md`) and contains no executable code, scripting, or dynamic content. As such, it poses no direct security risks. The actual 'GitHub MCP Server' it describes is not part of this audit.
Updated: 2025-11-24GitHub→
PreviousPage 453 of 713Next