Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

36
6
Medium Cost
Knuckles-Team icon

vector-mcp

by Knuckles-Team

Sec6

Provides a standardized API for AI agents to manage and interact with various vector database technologies for Retrieval Augmented Generation (RAG).

Setup Requirements

  • ⚠️Requires an LLM provider (e.g., local Ollama, or a commercial API like OpenAI/Anthropic/Google/HuggingFace with an API key and potential costs).
  • ⚠️Requires a configured vector database instance (e.g., ChromaDB locally, or a remote PGVector, MongoDB, Couchbase, or Qdrant instance).
  • ⚠️For production deployments, the `vector-mcp` server's default `AUTH_TYPE=none` must be explicitly configured to a more secure option.
Review RequiredView Analysis
The `vector-mcp` server defaults to `AUTH_TYPE=none`, which is a critical security risk for any production deployment, leaving the server unprotected. While robust authentication mechanisms (JWT, OAuth, OIDC) are supported and configurable via environment variables, the default insecure posture is a significant concern. Database credentials are passed via environment variables, which relies on the user's secure environment configuration. The server binds to `0.0.0.0`, requiring external network isolation.
Updated: 2026-01-19GitHub→
36
7
Medium Cost
rogervinas icon

spring-boot-ai

by rogervinas

Sec7

A Spring Boot application implementing a Model Context Protocol (MCP) server that provides a remote 'Booking Tool' for an AI agent.

Setup Requirements

  • ⚠️Requires Java 21+ and Kotlin 2.x+ runtime.
  • ⚠️Requires the 'chat-server' (or any MCP client) to be configured to connect to this MCP server (defaults to http://localhost:8081).
  • ⚠️For full project functionality (Chat Server + MCP Server), Docker with Ollama (llama3.1:8b and nomic-embed-text models) and PostgreSQL with pgvector are required.
Review RequiredView Analysis
The MCP server itself is straightforward and doesn't expose obvious security vulnerabilities. However, the broader project (which uses this MCP server) has hardcoded PostgreSQL credentials (`postgres`, `password`) in `chat-server/src/main/resources/application.yml` for local development. While acceptable for a demo, this is a significant security risk if deployed to any non-local or production environment without externalizing these secrets. There's no dynamic code execution or explicit obfuscation. The use of Spring AI's `@Tool` annotation is a controlled mechanism for tool invocation.
Updated: 2026-01-12GitHub→
36
4
Low Cost
Team-Off-course icon

MCP-Server-Vuln-Analysis

by Team-Off-course

Sec10

This project documents the analysis and discovery of severe vulnerabilities in Model Context Protocol (MCP) server implementations, including Server-Side Request Forgery (SSRF) and Path Traversal, and proposes responsible disclosure.

Verified SafeView Analysis
This repository is a security research project focused on documenting vulnerabilities found in other MCP server implementations. The provided 'source code' primarily consists of markdown files describing various CVEs. As such, it does not contain executable code that would exhibit direct security risks (like 'eval', obfuscation, network risks, or hardcoded secrets) within the repository itself. The severe vulnerabilities (SSRF, Path Traversal, Indirect Prompt Injection) described are present in the *target* MCP servers analyzed by this project, not in this analysis repository's own codebase.
Updated: 2026-01-11GitHub→
36
7
Medium Cost
anirbanbasu icon

pymcp

by anirbanbasu

Sec8

A template repository for developing Model Context Protocol (MCP) servers in Python, demonstrating various tools, resources, and prompts.

Setup Requirements

  • ⚠️Requires Python 3.12+.
  • ⚠️Installation requires `uv` and `just` as additional tools.
  • ⚠️Full functionality for 'pirate_summary' (LLM sampling) and 'vonmises_random' (elicitation) depends on client-side handlers, which may not be present in all FastMCP client setups.
Verified SafeView Analysis
The server's code is well-structured and uses FastMCP, which generally promotes secure practices. No 'eval' or obvious malicious patterns are present. It correctly handles input validation for tools like password generation and permutations. Network risks include the `text_web_search` tool making external requests via `ddgs`, and while it supports proxy configuration, reliance on external services always carries some inherent risk. A critical note is the default `ASGI_CORS_ALLOWED_ORIGINS` allowing all origins (`*`) when using HTTP transports; the README correctly advises overriding this in production for security, but it's a default configuration to be aware of. File I/O for logo resources is limited to specific, known files.
Updated: 2026-01-12GitHub→
36
5
Medium Cost
exjskdjsdfks icon

pentest-mcp-server

by exjskdjsdfks

Sec4

The Pentest MCP Server enables AI agents to perform autonomous penetration testing operations on remote Linux distributions by managing persistent tmux sessions via SSH.

Setup Requirements

  • ⚠️Requires a separate Linux pentesting distribution (e.g., Kali, Parrot OS) to act as the target system.
  • ⚠️The target Linux system must have SSH access configured (password or key-based) and 'tmux' installed.
  • ⚠️Requires Python 3.10+ on the client system where the MCP server runs.
Review RequiredView Analysis
The server's core functionality involves executing arbitrary commands on a remote system. It explicitly disables SSH host key checking (`known_hosts=None`), which is a critical security vulnerability for Man-in-the-Middle (MITM) attacks as it will connect to any server without verifying its authenticity. While it includes a blacklist for some dangerous commands (e.g., `rm -rf /`, fork bomb), this is not foolproof. Running this server requires careful deployment in isolated, controlled environments, and only on authorized target systems.
Updated: 2026-01-19GitHub→
36
7
High Cost
AndreaGriffiths11 icon

teamxray

by AndreaGriffiths11

Sec9

The Team X-Ray VS Code extension helps engineering teams discover human expertise, communication styles, and collaboration patterns within their codebase using Git history and AI analysis.

Setup Requirements

  • ⚠️Requires GitHub token with 'repo', 'read:user', and 'read:org' permissions for AI-powered insights (free during preview up to a credit limit, will incur costs later).
  • ⚠️VS Code 1.100.0+ is required.
  • ⚠️Git must be installed and the workspace must be a GitHub repository with commit history.
  • ⚠️Docker may be required for full GitHub Model Context Protocol (MCP) server integration, though the extension falls back to local Git analysis if unavailable.
Verified SafeView Analysis
The project demonstrates strong security awareness. It uses `vscode.SecretStorage` for token management, `child_process.execFile` for Git commands to prevent injection, and includes comprehensive input validation (`Validator` class). Webviews are protected with Content Security Policy (CSP). The `SECURITY.md` outlines a responsible disclosure policy and security best practices for users. The use of `evalite` for evaluations is confined to testing files, not runtime code. Potential minor risks could be from complex external AI model interactions (GitHub Models API) if not carefully constrained, but the prompt structure and token limits indicate an effort to mitigate this.
Updated: 2025-12-02GitHub→
36
7
Medium Cost
opensolon icon
Sec8

Provides examples of integrating AI functionalities (LLM interaction, RAG, Agent, and Model Context Protocol server/client) within various Java web frameworks.

Setup Requirements

  • ⚠️Requires a local LLM server (e.g., Ollama) running on `http://127.0.0.1:11434` for chat and embedding functionalities, as configured in `webapp.llm._Constants.java`.
  • ⚠️The provided `McpServerAuth` example needs to be replaced with a robust authentication/authorization solution for production deployments.
  • ⚠️The specific framework (e.g., Spring Boot, Solon, Quarkus, JFinal, Vert.x) for the desired example must be chosen, and its respective build/run commands followed.
Verified SafeView Analysis
The `McpServerAuth` filter provided in examples is a basic demonstration of authentication logic (`ctx.param("user") == "no"` check), not a production-ready solution. It also explicitly allows `/mcp/*/message` endpoints to bypass authentication. For production use, a robust authentication and authorization mechanism must be fully implemented. LLM API URLs are hardcoded to a local `ollama` instance (`http://127.0.0.1:11434`) by default; while not a direct security risk, this implies a reliance on local infrastructure for testing/development.
Updated: 2026-01-19GitHub→
36
37
Low Cost
fazer-ai icon

mcp-obsidian

by fazer-ai

Sec9

Enables LLMs (like Claude) to programmatically interact with an Obsidian vault through the Local REST API plugin.

Setup Requirements

  • ⚠️Requires Obsidian desktop application to be installed and running.
  • ⚠️Requires the 'Obsidian Local REST API' community plugin to be installed, enabled, and configured within Obsidian.
  • ⚠️An `OBSIDIAN_API_KEY` must be generated in Obsidian and provided to the server via environment variables.
Verified SafeView Analysis
The server acts as an intermediary, proxying requests to the Obsidian Local REST API plugin. Security primarily depends on the robustness of the Obsidian plugin and proper handling of the `OBSIDIAN_API_KEY` by the user (passed via environment variables, not hardcoded). Path sanitization is implemented for file-related operations (`sanitizeAndEncodePath`), mitigating some path traversal risks. Input validation is performed using Zod schemas for tool arguments. No direct code injection (e.g., `eval`) or malicious patterns were observed within the provided source code. Communication relies on standard HTTP/S requests.
Updated: 2026-01-03GitHub→
36
2
Medium Cost
jim-coyne icon

ACI_MCP

by jim-coyne

Sec6

A Node.js-based Model Context Protocol (MCP) server for managing and configuring Cisco ACI fabrics through its APIC REST API.

Setup Requirements

  • ⚠️Requires access to a Cisco APIC controller (a specialized network hardware/software component).
  • ⚠️Requires valid APIC credentials (username/password or certificate) to be configured.
  • ⚠️Default `ACI_VALIDATE_CERTS=false` disables SSL certificate validation, posing a significant security risk if not explicitly enabled for production deployments.
Verified SafeView Analysis
The server supports secure credential handling via environment variables or configuration files. However, by default, it disables SSL/TLS certificate validation (`ACI_VALIDATE_CERTS=false`), which is a critical security vulnerability for Man-in-the-Middle attacks in production environments. Users must explicitly enable certificate validation and provide trusted certificates for secure deployments.
Updated: 2025-11-21GitHub→
36
7
Low Cost
intbjw icon
Sec9

Provides a Model Control Protocol (MCP) server for querying FOFA API data, designed for integration with AI models.

Setup Requirements

  • ⚠️Requires Python >= 3.11
  • ⚠️Requires a valid FOFA API Key (FOFA is a paid service, usage consumes credits)
  • ⚠️The recommended setup involves 'cline' VSCode extension for configuration and integration with a large language model.
Verified SafeView Analysis
The code loads the FOFA API key from environment variables, preventing hardcoding. FOFA query parameters are base64 encoded before being sent to the external API. No direct use of 'eval' or other highly dangerous functions was observed. The main risk comes from reliance on the external FOFA API and potential misuse of the provided tool functions by an integrated AI model.
Updated: 2025-11-24GitHub→
36
7
Low Cost

filesystem-mcp

by SylphxAI

Sec9

Provides secure, efficient, and token-optimized filesystem operations for AI agents via the Model Context Protocol.

Setup Requirements

  • ⚠️The server's Current Working Directory (cwd) at launch determines its project root. The MCP host must launch the command with cwd set to the desired project root.
  • ⚠️When using Docker, the /path/to/your/project volume mount must be correctly configured to map your host project directory into the container's /app directory.
Verified SafeView Analysis
The server is designed with a strong emphasis on security, enforcing project root confinement, path traversal prevention, and using Zod for robust input validation. It directly accesses the filesystem without shell spawning, reducing external execution risks. While allowing an AI agent to modify local files always carries inherent risk, the server itself provides robust safeguards within its operational scope.
Updated: 2025-11-17GitHub→
36
8
Medium Cost
zheroz00 icon
Sec8

An MCP server for efficient codebase exploration, providing file tree visualization, symbol extraction, and dependency analysis in a single tool call.

Setup Requirements

  • ⚠️Requires Node.js v18 or higher.
  • ⚠️Requires `npm run build` to compile TypeScript to JavaScript before running (handled automatically by `npm start` or `start-server.sh`, but manual execution needs it).
  • ⚠️The 'show_git_status' feature requires Git to be installed and the target directory to be a Git repository.
  • ⚠️For MCP integration, an absolute path to `dist/index.js` is required in the Claude Desktop configuration.
Verified SafeView Analysis
The tool uses `child_process.exec` for Git commands, which is a common and generally safe pattern for CLI tools, with parsed output. Robust path validation (`validatePath`) prevents path traversal attacks and symlink escapes. An HTTP server mode is available, which by default binds to localhost, and the documentation explicitly warns that it's 'designed for local development only' and lacks authentication for production use, mitigating potential network risks if users adhere to the recommendations. No `eval`, obvious obfuscation, or hardcoded secrets were found.
Updated: 2026-01-17GitHub→
PreviousPage 129 of 760Next