Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(8554)

0
0
Medium Cost
ishumilin icon

schwaizer-bfs-mcp

by ishumilin

Sec8

Accessing, searching, and retrieving statistical data from the Swiss Federal Statistical Office (BFS) through various APIs.

Setup Requirements

  • ⚠️Requires Node.js 20.0.0 or higher.
  • ⚠️Initial setup requires running `npm install` to download dependencies.
  • ⚠️Rate limiting from the BFS PXWEB API can be encountered; consider setting `BFS_REQUEST_DELAY` or filtering queries.
Verified SafeView Analysis
The server uses Zod for robust input validation for all MCP tools, which significantly mitigates risks of malformed input or injection attacks. API base URLs are configurable via environment variables, preventing hardcoded secrets for external services. API clients (ky and fetch) include retry logic and timeouts for resilience. Logging is structured and directed to STDERR, keeping STDOUT clean for MCP communication. There are no obvious signs of 'eval', code obfuscation, or malicious patterns. Security relies on the integrity of the underlying BFS APIs.
Updated: 2025-11-20GitHub→
0
0
Low Cost
Ericwyn icon

cal-tool

by Ericwyn

Sec8

A command-line utility for evaluating mathematical expressions, supporting direct calculations and integration as an MCP server.

Setup Requirements

  • ⚠️Requires Go runtime for building the executable.
  • ⚠️Manual installation step (`mv cal ~/.local/bin/`) is needed for easy command-line access via 'cal'.
Verified SafeView Analysis
The core functionality relies on `github.com/dengsgo/math-engine` to parse and execute expressions. While it doesn't use a general-purpose 'eval', the security of the application is dependent on the robustness of the math-engine against potential expression injection or unexpected side effects. No other obvious network risks, hardcoded secrets, or malicious patterns were identified in the provided source.
Updated: 2025-11-26GitHub→
0
0
Medium Cost
ABaiMate icon
Sec3

This application integrates with the CSDN platform to publish articles programmatically, designed to be callable as a tool by an AI agent.

Setup Requirements

  • ⚠️Requires a valid CSDN API Cookie, which is a sensitive credential obtained from CSDN network requests, and the default in `application.yml` must be replaced.
  • ⚠️Requires Java (likely JDK 17+ for Jakarta EE compatibility) to build and run as a Spring Boot application.
  • ⚠️The hardcoded `x-ca-*` headers in `ICSDNService` might require specific CSDN API key registration or be specific to a certain CSDN API version/access.
Review RequiredView Analysis
CRITICAL RISK: The `application.yml` file contains a hardcoded default CSDN API cookie (`uuid_tt_dd=...; UserName=A_ABai; UserToken=...;`), which is a sensitive user session credential. Running this with the default could expose a specific CSDN account. Although it can be overridden by an environment variable, providing a functional default is a significant security vulnerability. Additionally, `x-ca-key`, `x-ca-nonce`, `x-ca-signature`, and `x-ca-signature-headers` are hardcoded in `ICSDNService.java`; if these are dynamic or user-specific, they also pose a risk.
Updated: 2025-12-02GitHub→
0
0
Medium Cost
akvo icon
Sec3

A FastAPI/FastMCP server for vector-based knowledge management, providing document storage, similarity search, and intelligent retrieval capabilities for LLM-powered agents.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid) for embeddings.
  • ⚠️Requires Docker and Docker Compose for all services (PostgreSQL, ChromaDB, MinIO, RabbitMQ, Celery).
  • ⚠️Manual generation of ADMIN_API_KEY is required for initial setup, as described in GENERATE_ADMIN_API_KEY.md.
Review RequiredView Analysis
1. **Publicly Accessible Documents**: The MinIO bucket is configured for public read access. This makes all uploaded documents directly accessible via URL without authentication, posing a significant risk if sensitive information is stored. 2. **Default Credentials/Keys**: The `.env.example` and `config.py` provide default MinIO credentials ('minioadmin') and a placeholder 'ADMIN_API_KEY' ('changeme' in `api_util.py`). These *must* be changed for any production deployment. 3. **Filename Sanitization Vulnerability (CRITICAL)**: The `DocumentService.upload_documents` method directly uses `file.filename` from user uploads to construct file paths in MinIO without sufficient sanitization. Although a `make_clean_filename` function exists, it is commented out and not used. This allows for potential path traversal attacks (e.g., using `../../../` in filenames) or other file system manipulation if an attacker can craft a malicious filename. This could lead to unauthorized file creation, overwriting, or access outside the intended directories in MinIO, making it a critical vulnerability. 4. **Celery `asyncio.run` in worker**: Using `asyncio.run` inside a synchronous Celery task can lead to unexpected behavior and resource exhaustion if not handled carefully.
Updated: 2025-12-09GitHub→
0
0
Medium Cost
Samvox1 icon
Sec4

This server provides grocery price comparison, shopping list optimization, budget tracking, and meal planning for Dutch supermarkets and drugstores via an MCP API.

Setup Requirements

  • ⚠️Requires Docker for an easy setup.
  • ⚠️Requires a PostgreSQL database to be running.
  • ⚠️Initial data synchronization (prices, promotions, recipes) takes a significant amount of time (approx. 5 minutes or more) during first run.
  • ⚠️Reliability depends on external data sources: Checkjebon.nl (prices), Folderz.nl (promotions), and TheMealDB (recipes).
Review RequiredView Analysis
The default database password 'supermarkt123' is hardcoded in `docker-compose.yml` and directly used in several sync scripts if environment variables are not explicitly set. This is a critical security vulnerability for any deployment. While `psycopg2` with parameterized queries is used to mitigate SQL injection risks, the `claude_desktop_config.json` snippet suggests `--allow-http` for connecting, indicating that secure communication (HTTPS) is not enforced by default, which can expose data to interception.
Updated: 2025-12-11GitHub→
0
0
Low Cost
anjalbhattarai79 icon

mcp-remote-server-test

by anjalbhattarai79

Sec9

This project demonstrates how to create a minimal MCP server using the FastMCP framework, exposing a single greeting tool.

Setup Requirements

  • ⚠️Requires Python 3.13 or higher.
  • ⚠️Requires 'fastmcp' library to be installed via pip.
Verified SafeView Analysis
The server exposes a single 'greet' function that performs basic string formatting with user input. There are no 'eval' statements, dynamic code execution, or obvious hardcoded secrets. It runs on HTTP, which is acceptable for a local demo but would require HTTPS for production. Overall, it appears safe for its stated purpose as a demonstration.
Updated: 2025-11-25GitHub→
0
0
Low Cost
freesrz93 icon

sb6657-mcp

by freesrz93

Sec9

This server acts as a proxy for the sb6657.cn meme API, providing structured access to meme-related data through FastMCP tools.

Setup Requirements

  • ⚠️Requires Python 3.12 or newer.
  • ⚠️Relies on an external API (hguofichp.cn:10086) for data.
  • ⚠️Requires `fastmcp` and `httpx` dependencies to be installed.
Verified SafeView Analysis
The code does not use `eval` or `exec`. It relies on the `httpx` library for network requests and does not appear to expose any immediate injection vulnerabilities or hardcoded secrets. The `siteToken` is randomly generated client-side for tracking. The primary external dependency is the `sb6657.cn` API itself; its reliability and content are outside the scope of this code's direct security.
Updated: 2025-12-14GitHub→
0
0
Low Cost
SaraHan774 icon
Sec8

This MCP server enables an AI agent (like Claude) to manage and interact with a technical glossary stored in an Obsidian vault.

Setup Requirements

  • ⚠️Requires Node.js and npm for building and running.
  • ⚠️Manual configuration of Claude Desktop/Code settings is needed to specify the server's executable path.
  • ⚠️Integration is specific to the Claude ecosystem (Claude Desktop/Code).
Verified SafeView Analysis
The server performs file system operations (read, append, mkdir) using user-provided `file_path` arguments. While `term` is sanitized for regular expressions, the `file_path` itself is used directly. This is generally acceptable for a local MCP server interacting with a user's own files, but it makes it crucial for the calling agent to provide trusted paths to prevent unintended file access or modification outside the Obsidian vault if the agent's input is compromised. No direct 'eval' or arbitrary command execution found.
Updated: 2025-12-01GitHub→
0
0
Low Cost
kennardpeters icon

rustmcp-template

by kennardpeters

Sec9

This MCP server provides additional context to an MCP client (e.g., an LLM or AI agent) via a `get_example_context` tool.

Setup Requirements

  • ⚠️Requires Rust toolchain installed to build and run.
  • ⚠️Requires compilation using `cargo build --release --bin mcp` before running.
  • ⚠️Requires an MCP client (e.g., 'Claude Desktop' as mentioned in the README) for meaningful interaction.
Verified SafeView Analysis
The server uses standard Rust libraries and communicates via stdin/stdout (IPC), which inherently limits network exposure. No 'eval' or similar dynamic code execution is present, and no hardcoded secrets or malicious patterns were identified. Relying on trusted `rmcp` crate and standard Rust practices contributes to a high security score.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
nechhuu icon

ward-mcp

by nechhuu

Sec9

AI-powered code quality analysis, detecting security issues, bugs, code smells, and performance problems.

Setup Requirements

  • ⚠️Requires Python 3.10+
  • ⚠️Requires 'semgrep' to be installed manually (e.g., 'pip install semgrep')
  • ⚠️LLM-powered features (explain_issue, suggest_fix) are not yet implemented.
  • ⚠️Cross-file taint analysis (analyze_cross_file) is not yet implemented.
Verified SafeView Analysis
The server's core functionality involves executing the `semgrep` static analysis tool via `subprocess.run`. The arguments to `semgrep` are controlled, and path handling (`safe_join`, `validate_absolute_path`) is implemented to prevent path traversal vulnerabilities when creating temporary files or processing local paths. There are no immediate signs of direct `eval`/`exec` of untrusted input within the server's own logic. Unimplemented LLM and graph analysis features remove potential risks associated with those components in the current version.
Updated: 2026-01-19GitHub→
0
0
Low Cost
rosseboe icon

opcua-mcp

by rosseboe

Sec5

This server provides an MCP interface for AI applications to monitor and control industrial processes via OPC UA.

Setup Requirements

  • ⚠️Requires Python 3.12+
  • ⚠️Requires an OPC UA server running (e.g., opc.tcp://localhost:4840) for functionality
  • ⚠️Requires `uv` for dependency installation or manual dependency management
Verified SafeView Analysis
The server allows direct interaction with OPC UA systems, including connecting to arbitrary URLs and reading/writing to arbitrary node IDs, based on client input. While the Python code itself does not contain obvious injection vulnerabilities like `eval`, the lack of input sanitization or access control policies within the server makes it a high-privilege gateway. A compromised MCP client could abuse these capabilities to interact with unauthorized or malicious OPC UA servers or perform unauthorized operations on a connected server. The duplicate call to `node.write_value()` without arguments in the `write_node` function is likely a minor bug but not a security vulnerability.
Updated: 2026-01-17GitHub→
0
0
Low Cost
mrozmen7 icon

mcp-python

by mrozmen7

Sec5

A Python-based server or library designed to interface with and control a Minecraft instance, likely for scripting automation or game modification.

Setup Requirements

  • ⚠️Requires Python (specific version unknown without source code)
  • ⚠️Likely requires a running Minecraft instance (e.g., Minecraft Pi or Java Edition server for remote interaction)
  • ⚠️Network port availability for server communication.
Review RequiredView Analysis
Source code was not provided for analysis. The repository name 'mcp-python' suggests a Python server for Minecraft. Such a server would typically involve network communication, which inherently carries security risks if not properly implemented (e.g., input validation, authentication, secure protocols). Without the actual code, it's impossible to check for specific vulnerabilities like 'eval' usage, hardcoded secrets, or malicious patterns.
Updated: 2025-12-01GitHub→
PreviousPage 704 of 713Next