Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(8554)

0
0
Low Cost
jordantdavis icon

phone-call-mcp-server

by jordantdavis

Sec9

Enables AI assistants to programmatically make and manage phone calls through Twilio.

Setup Requirements

  • ⚠️Requires Go 1.25.3 or later
  • ⚠️Requires a Twilio account (paid service) with Account SID, Auth Token, and a Twilio phone number
  • ⚠️Requires environment variables (TWILIO_ACCOUNT_SID, TWILIO_AUTH_TOKEN, TWILIO_FROM_NUMBER) to be set before startup. Missing variables will cause a fatal error.
Verified SafeView Analysis
The server uses environment variables for Twilio credentials, avoiding hardcoded secrets. It employs standard Go libraries and the official Twilio SDK. Communication with the MCP client is via stdio, which is secure for local integration. There is a TODO for phone number validation which could improve robustness but isn't a direct security vulnerability of the server itself.
Updated: 2025-11-25GitHub→
0
0
Low Cost
griffinwork40 icon
Sec9

Manages ElevenLabs Voice Agents, including their configuration, knowledge bases, webhook tools, and outbound calling capabilities, for integration with MCP clients like Claude.

Setup Requirements

  • ⚠️Requires Node.js 18 or higher.
  • ⚠️Requires a paid ElevenLabs API key.
  • ⚠️For outbound calling features, requires a Twilio account and imported Twilio phone numbers.
  • ⚠️For batch calling, ElevenLabs Zero Retention Mode (ZRM) must be disabled.
Verified SafeView Analysis
The server demonstrates strong security practices: extensive use of Zod schemas ensures strict input validation across all tool arguments, mitigating common injection and malformed request vulnerabilities. The `ELEVENLABS_API_KEY` is correctly sourced from environment variables, preventing hardcoding of secrets. By default, it uses stdio transport, which reduces network attack surface compared to a publicly exposed HTTP server. Error handling is centralized to provide user-friendly messages without leaking sensitive internal details. While some schemas use `z.record(z.any())` for flexible configuration objects, this data is passed to the trusted ElevenLabs API, which is expected to handle it securely.
Updated: 2026-01-02GitHub→
0
0
Low Cost
williamIIliu icon
Sec7

This server provides a wide range of image and video processing functionalities, including basic manipulations, color adjustments, filters, format conversions, metadata extraction, and document-to-image conversions, exposed as an MCP server.

Setup Requirements

  • ⚠️Requires Python >=3.10.
  • ⚠️The 'word_to_images' tool explicitly requires LibreOffice (soffice) to be installed on the system.
  • ⚠️The 'pdf_to_images' tool (via `pdf2image` library used in `word_to_images` or `fitz` in `convert_pdf_to_images`) may implicitly require Poppler PDF utilities (e.g., `pdftoppm`) on some systems, though PyMuPDF (`fitz`) has its own engine.
Verified SafeView Analysis
The server uses `subprocess.run` to invoke `soffice` (LibreOffice) for Word document conversions (`word_to_images`). While arguments are passed as a list, mitigating direct shell injection, relying on external binaries and passing user-controlled file paths introduces potential risks if the external tools have vulnerabilities or if malicious file paths are provided. The server also relies on `pptxtoimages` and `pdf2image` (which typically uses Poppler) for file conversions, further expanding the attack surface through external dependencies. However, there are no obvious hardcoded secrets or 'eval' calls. Input validation for image coordinates is present. The primary risk lies with the robustness of external document processing tools when given arbitrary user input.
Updated: 2026-01-11GitHub→
0
0
Low Cost
anjalbhattarai79 icon
Sec9

This project demonstrates how to create a minimal MCP server using the FastMCP library and expose a simple greeting tool.

Setup Requirements

  • ⚠️Requires Python 3.13+
  • ⚠️Installs `fastmcp` dependency
Verified SafeView Analysis
The server is minimal, exposing only one simple 'greet' tool. The f-string usage is safe in this context, as the input 'name' is merely inserted into the string without further interpretation or execution. No dynamic code execution, obfuscation, or hardcoded secrets were found in the provided source code. The project is a demo and would require further hardening for production use, especially regarding input validation if more complex tools were added.
Updated: 2025-11-25GitHub→
0
0
High Cost
samirsaci icon

mcp-webscraper

by samirsaci

Sec7

Enables Claude Desktop to perform advanced web scraping and crawling operations, extracting structured data and analyzing website architectures through natural language.

Setup Requirements

  • ⚠️Requires Python 3.10 or higher
  • ⚠️Requires `uv` package manager for dependency management
  • ⚠️Requires Playwright browser installation (`uv run playwright install chromium`) for dynamic content scraping
  • ⚠️Windows users require WSL2 with Ubuntu setup
Verified SafeView Analysis
The server can make arbitrary outbound network requests to user-defined URLs, which is inherent to its function. This poses a risk if controlled by a malicious prompt, potentially allowing for reconnaissance or denial-of-service attacks against internal or external targets. The code itself does not contain obvious vulnerabilities like 'eval' or hardcoded secrets. Basic rate-limiting (delay_seconds in crawl) is implemented, but user-controlled. Input URLs are validated with Pydantic's HttpUrl.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
appachhi icon
Sec8

The Bugasura MCP Server enables AI assistants to interact with Bugasura test management projects, managing test cases, issues, sprints, and requirements through natural language.

Setup Requirements

  • ⚠️Requires a Bugasura account and API Key.
  • ⚠️Requires Python 3.10 or higher.
  • ⚠️For remote deployment, an HTTPS-enabled reverse proxy (e.g., Nginx, Apache) is recommended for the SSE endpoint.
Verified SafeView Analysis
The server explicitly loads API keys from environment variables and does not hardcode them. It truncates API keys in logs for security. Input parameters are validated for type and content where appropriate (e.g., numeric IDs, string lengths, enum values). The system performs HTTP requests using Python's `requests` library, which generally protects against injection vulnerabilities. Destructive operations like deletion are clearly documented with warnings. Relying on a remote Bugasura API for core functionality means its security is also paramount. The smart resolution of user/team/project names could be a minor concern if ambiguous inputs lead to unintended selections, though the system attempts to mitigate this with prompts.
Updated: 2026-01-14GitHub→
0
0
Low Cost
Hari2352428 icon
Sec9

This server functions as a simple expense tracker, allowing users to add, list, and summarize their financial expenses.

Setup Requirements

  • ⚠️Requires Python 3.13 or higher.
  • ⚠️The SQLite database is created in a temporary directory, meaning all expense data will be lost when the server process terminates or the temporary directory is cleaned.
Verified SafeView Analysis
Uses parameterized queries for all database operations, effectively preventing SQL injection vulnerabilities. No 'eval' or direct 'os.system' calls are present. The database is stored in a temporary directory, which while potentially leading to data non-persistence, does not pose a direct code execution or critical security risk from the application's perspective.
Updated: 2025-12-05GitHub→
0
0
Low Cost
twoLoop-40 icon

HwpAutomation

by twoLoop-40

Sec8

Acts as an MCP (Multi-Modal Controller Protocol) server to enable Claude Desktop (or other agents) to automate tasks within the Hancom HWP word processor.

Setup Requirements

  • ⚠️Requires Hancom HWP word processor to be installed and accessible.
  • ⚠️Windows OS only (due to HWP COM API and pywinauto dependencies).
  • ⚠️Requires 'pywinauto' library (e.g., `pip install pywinauto`) for certain plugins like Latex2Hwp.
Verified SafeView Analysis
The MCP server uses standard I/O (stdio_server) for communication, which limits direct network exposure. HWP COM automation and pywinauto (via subprocess for Latex2Hwp) are utilized, which are standard for local desktop automation but could pose risks if the underlying HWP application or automation scripts were maliciously altered. No explicit hardcoded secrets or 'eval' calls were found in the provided code.
Updated: 2025-12-18GitHub→
0
0
Low Cost
manishmishra01 icon

mcp_server

by manishmishra01

Sec9

Serves simple functions as an API using the FastMCP framework.

Setup Requirements

  • ⚠️Requires Python >= 3.10.
  • ⚠️The icon path 'D://dsa_with_cpp//icons//images3.jpeg' is hardcoded and will likely cause issues if deployed on a different operating system or environment without that specific file path.
Verified SafeView Analysis
The server binds to 0.0.0.0, making it accessible from all network interfaces, which is standard but requires appropriate network security measures in production. No 'eval', obfuscation, hardcoded secrets, or malicious patterns were found in the provided code.
Updated: 2025-11-22GitHub→
0
0
Low Cost
muhammadjahanzaib789 icon

mcp-server

by muhammadjahanzaib789

Sec5

Provides server functionality, likely related to the Minecraft community or development (MCP).

Review RequiredView Analysis
Source code was not provided for analysis, making a comprehensive security audit impossible. No specific risks like 'eval', hardcoded secrets, or malicious patterns could be identified or ruled out.
Updated: 2025-11-27GitHub→
0
0
Medium Cost
cbxss icon

snusbase-mcp

by cbxss

Sec9

Integrates the Snusbase API for data breach searches, IP WHOIS lookups, and hash lookups into Model Context Protocol (MCP) clients.

Setup Requirements

  • ⚠️Requires a Snusbase API key (Snusbase is a paid service).
  • ⚠️If building from source, Rust 1.70 or later is required.
  • ⚠️Requires an MCP-compatible client (e.g., Claude Desktop) to be usable, as it communicates via stdin/stdout.
Verified SafeView Analysis
The server correctly loads API keys from environment variables or .env files, avoiding hardcoding. It handles rate limiting gracefully. The documentation explicitly warns against committing API keys to version control and cautions users about handling breach data which may contain unmodified HTML or exploits. The installation script downloads pre-built binaries, which implies trust in the maintainer's build process. No 'eval' or similar dangerous patterns are present in the provided Rust source code.
Updated: 2025-12-01GitHub→
0
0
Low Cost
concreteY icon

my-mcp-server

by concreteY

Sec8

Hosts a remote Model Context Protocol (MCP) server that exposes a simple 'add numbers' tool over HTTP and Server-Sent Events (SSE) for AI agents to interact with.

Setup Requirements

  • ⚠️Requires Node.js runtime
Verified SafeView Analysis
The server uses `cors` with `origin: '*'`, allowing requests from any domain, which is permissive but common for public tool endpoints. No direct 'eval' calls, obfuscation, or hardcoded sensitive secrets were found. Message handling is delegated to the `@modelcontextprotocol/sdk`, assuming the SDK itself is robust. The `sessionId` is retrieved from `req.query`, which the SDK is expected to manage securely.
Updated: 2025-12-08GitHub→
PreviousPage 650 of 713Next