Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

32
1
High Cost
sh1nj1 icon
Sec2

A Rails engine for building and managing LLM tools, unifying Sorbet-typed service classes into both RubyLLM and FastMCP tool definitions.

Setup Requirements

  • ⚠️Requires Ruby 3.4.4.
  • ⚠️Requires API keys for OpenAI, Google/Gemini, and/or Anthropic for LLM functionality (these are paid services).
  • ⚠️Claude Desktop MCP configuration requires an absolute path to the `test_app` directory, which can be a common setup friction.
  • ⚠️Using the remote SSE client with Claude Desktop requires `npx` (Node.js package runner) to be installed.
  • ⚠️The playground feature allows executing arbitrary Ruby code, posing a significant security risk if used with untrusted input or in a production environment.
Review RequiredView Analysis
CRITICAL: The application uses `Object.class_eval` to execute arbitrary Ruby code provided by the user in the playground (e.g., for registering new tools dynamically). This is explicitly noted in the README as a feature for trusted sources, but it presents a severe code execution vulnerability if exposed to untrusted input. Additionally, the FastMCP server is configured with `localhost_only: false`, allowing remote connections to the MCP endpoint, which could expose the `eval`-capable tools to network access.
Updated: 2025-12-04GitHub→
32
1
Low Cost
nicholasjconn icon

agent-layer

by nicholasjconn

Sec9

Agent Layer ensures consistency in AI-assisted development by generating client-specific configurations from a single, repo-local source of truth.

Setup Requirements

  • ⚠️Requires 'curl' for initial installation.
  • ⚠️Requires target AI client (e.g., Gemini CLI, Claude Code CLI, Codex CLI, VS Code) to be installed and on your PATH.
  • ⚠️Development setup (`./scripts/setup.sh`) requires Go 1.25.6+, Git, and Make.
Verified SafeView Analysis
The installation script fetches a binary from GitHub releases and verifies its SHA256SUM, which is standard practice but relies on the integrity of GitHub. Configuration explicitly guides users to place secrets in gitignored `.agent-layer/.env` files, preventing accidental exposure. The core functionality involves launching external CLI tools (e.g., Gemini, Claude, Codex) and an internal MCP server via stdio. An approval system (`commands.allow`, `approvals.mode`) is implemented to control auto-approved shell commands and MCP tool calls, which is a strong security feature. No 'eval' or obvious obfuscation patterns were found.
Updated: 2026-01-19GitHub→
32
2
High Cost
Hyperkorn icon
Sec9

A unified Model Context Protocol (MCP) server for agentic RAG, combining vector search, knowledge graphs, and web intelligence for AI assistant interactions.

Setup Requirements

  • ⚠️Requires Docker and Docker Compose for local development setup of Qdrant, Neo4j, and Redis databases.
  • ⚠️Requires an OpenAI API Key for GraphRAG functionalities (knowledge extraction, memory consolidation) and potentially for LLM-powered web extraction strategies, which can incur significant costs.
  • ⚠️The project explicitly uses 'uv' for dependency management, requiring users to install this specific package manager.
Verified SafeView Analysis
The server implements robust JWT-based authentication, API key validation with timing attack prevention (hmac.compare_digest), and role-based access control. Sensitive configurations are handled via Pydantic's `SecretStr`, and security headers (OWASP-compliant) are applied via middleware. Rate limiting and comprehensive logging are also in place. Development secrets are clearly marked in `docker-compose.yml` and platform secrets are used in cloud deployment configs. No direct 'eval' or obvious malicious patterns found.
Updated: 2026-01-19GitHub→
32
2
Low Cost
chrishayuk icon
Sec9

Provides a highly configurable, high-performance server for a wide range of mathematical computations via the Mathematical Computation Protocol (MCP).

Setup Requirements

  • ⚠️Requires Python 3.11+.
  • ⚠️For local Claude Desktop integration, absolute paths must be used in the configuration, not relative or `~` paths.
Verified SafeView Analysis
The server's core functionality involves exposing a controlled set of mathematical functions from the `chuk-mcp-math` library, which limits the risk of arbitrary code execution. Configuration is managed via Pydantic models, offering type-safe validation. The default host binding of '0.0.0.0' is noted with `nosec B104` (Bandit warning) but is a common and often necessary default for containerized services; it's explicitly documented. Default `enable_cors: true` is permissive but typical for an API. `rate_limit_enabled` defaults to `false`, which could be a concern in production without external rate limiting. There is no usage of `eval()` or similar dangerous functions on arbitrary user input. The dynamic tool registration is based on trusted function references, not arbitrary strings. Overall, the design prioritizes safety by filtering and exposing well-defined operations.
Updated: 2025-12-07GitHub→
32
2
Medium Cost

lokalise-mcp

by AbdallahAHO

Sec8

Connects AI assistants to Lokalise for managing translation projects and automating localization workflows through natural conversation.

Setup Requirements

  • ⚠️Requires a Lokalise API Key (a Lokalise account, potentially paid, is needed for full functionality).
  • ⚠️Requires Node.js 18+ for direct installation and execution, or a compatible environment for the Smithery CLI.
  • ⚠️This is an MCP server that needs to be actively running in your environment (e.g., via Docker or `npm run start`) to be accessible by your AI assistant.
Verified SafeView Analysis
The server interacts with the Lokalise API using credentials (API Key) and is designed to be accessible by AI assistants. The README mentions 'Enterprise Security' features like multi-layer auth, secure token handling, and rate limiting, which suggests a focus on security. As a server application handling sensitive API keys and making external network requests, standard server security practices are paramount. Without full code review, a high score is given based on stated security intentions and modern development practices (TypeScript, Node.js, Dockerfile).
Updated: 2025-11-17GitHub→
32
4
High Cost
timescale icon
Sec4

This server emulates Anthropic's skill format, enabling LLMs to utilize specialized knowledge and tools via the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires a GitHub Personal Access Token (`GITHUB_TOKEN`) with `repo`, `read:org`, `read:user`, `user:email` scopes to fetch GitHub-hosted skills.
  • ⚠️Access to external LLM APIs (e.g., Anthropic, OpenAI) is required, configured via environment variables (`LOW_TASK_MODEL`, `MEDIUM_TASK_MODEL`, `HIGH_TASK_MODEL`).
  • ⚠️Subagent functionality requires a `mcp.yaml` configuration file to specify additional external tools, which must be carefully vetted for security.
Review RequiredView Analysis
The server's architecture allows for loading skills from arbitrary GitHub repositories and integrating tools from external MCP servers via configuration files (e.g., `skills.yaml`, `mcp.yaml`). This design introduces a significant supply chain security risk: if configured to use untrusted skill sources or external MCPs, a malicious skill or external server could expose tools that enable arbitrary code execution or data exfiltration by the consuming agent. While no direct 'eval' or hardcoded secrets are present in the provided source, the system's security heavily relies on the operator's vigilance in vetting all configured external resources.
Updated: 2026-01-07GitHub→
32
2
High Cost
scrapfly icon

scrapfly-mcp

by scrapfly

Sec8

Connects AI assistants to live web data, enabling real-time web scraping, structured data extraction, anti-bot bypass, and screenshots from any website.

Setup Requirements

  • ⚠️Requires a Scrapfly API Key (a paid service) for core functionality like scraping and extraction.
  • ⚠️Requires a Go runtime or Docker for local/self-hosted deployment.
  • ⚠️If running the HTTP server without providing an API key via command-line (`-apikey`) or environment variable (`SCRAPFLY_API_KEY`), the API key must be supplied with each HTTP request (e.g., via `Authorization` header or `apiKey` query parameter).
Verified SafeView Analysis
The server securely proxies requests to the Scrapfly API, requiring an API key for authentication. It avoids hardcoded secrets for its own operation, relying on environment variables or request parameters for the API key. The `pkg/authenticableClient` package enforces API key validation for incoming HTTP requests to the MCP server endpoint, ensuring that only authenticated users can access the tools. The use of `unsafe` operations in `pkg/mcpex` and `internal/patcher` is noted but common in Go SDKs for interacting with external library internals (specifically, `modelcontextprotocol/go-sdk`), and does not present an immediate vulnerability in this context. User-provided JavaScript (`js`, `js_scenario` parameters) is explicitly designed to be executed on the *remote target website* via the Scrapfly service, not on the MCP server itself, thus mitigating direct server-side code injection risks from these inputs. The `npx mcp-remote` command mentioned in the README is a *client-side utility* to connect to a remote Scrapfly MCP server (or a local instance configured to use `stdio`), not a command to run *this* Go server application.
Updated: 2026-01-13GitHub→
32
2
Medium Cost
pingidentity icon

pingone-mcp-server

by pingidentity

Sec9

Enables AI assistants to review and manage PingOne tenants by integrating the PingOne management API into AI assistant conversations.

Setup Requirements

  • ⚠️Requires a licensed or trial PingOne cloud subscription.
  • ⚠️Requires an MCP-compatible client (e.g., VS Code Copilot Chat, Claude Desktop).
  • ⚠️Requires manual setup of a 'worker application' in your PingOne tenant with specific OAuth 2.0 configurations (e.g., Redirect URI, Grant Type, Roles).
Verified SafeView Analysis
The server uses secure OAuth 2.0 flows (PKCE, Device Code) and stores tokens in OS keychains (local) or ephemerally (Docker). It operates over stdin/stdout, minimizing network attack surface. Explicit 'Read Only' mode and 'Production Environment Write Protection' are implemented safeguards. No hardcoded secrets were found; sensitive configurations are sourced from environment variables. The project README provides comprehensive security notices and warnings regarding preview software and use with untrusted AI clients, demonstrating strong security awareness.
Updated: 2026-01-19GitHub→
32
1
Medium Cost
SirKanaad26 icon
Sec3

Integrates Google Gmail and Calendar APIs to enable an AI agent to read emails and manage calendar events with stateful authorization for event deletions.

Setup Requirements

  • ⚠️Requires Python 3.12+ (as per pyproject.toml)
  • ⚠️Requires a Google Cloud project with Gmail API and Google Calendar API enabled.
  • ⚠️Requires Google OAuth 2.0 Desktop Client credentials (`credentials.json`) from Google Cloud Console.
  • ⚠️Requires `uv` for dependency installation or `pip install -r requirements.txt`.
Review RequiredView Analysis
The server has a critical prompt injection vulnerability as explicitly stated in the README. Email content, fetched by the `read_emails` tool, is passed directly to the AI model without sanitization. This allows malicious instructions embedded in emails to manipulate the AI into performing unintended calendar actions (e.g., creating, updating, or deleting events). While a stateful authorization layer was added to prevent deletion of *external* calendar events, it does not mitigate the risk of: 1) creating new malicious events, 2) updating existing events (even external ones), or 3) deleting MCP-created events based on injected prompts. The AI model retains full `calendar` scope, allowing broad manipulation. The README advises against production use.
Updated: 2025-12-01GitHub→
32
1
Medium Cost
CyrilBaah icon

hn-mcp-server

by CyrilBaah

Sec9

Provides programmatic access to HackerNews content via the Model Context Protocol (MCP) for AI assistants and other clients to search, retrieve, and analyze stories, comments, and user profiles.

Setup Requirements

  • ⚠️Requires Python 3.11+
  • ⚠️HTTP/SSE transport mode requires additional dependencies (`starlette`, `uvicorn`, `sse-starlette`) installed via `pip install hn-mcp-server[http]`
Verified SafeView Analysis
The server uses Pydantic models extensively for input and output validation, significantly reducing common injection and data integrity risks. It leverages `httpx` for secure (HTTPS) external API communication. Environment variables are used for configuration, avoiding hardcoded secrets. A client-side rate limiter is implemented to prevent abuse of the upstream HackerNews Algolia API. No `eval` or `exec` calls are present. The HTTP transport relies on `uvicorn` and `starlette`, which are well-vetted libraries. One point is deducted as it exposes an HTTP/SSE endpoint, which inherently has a broader attack surface than stdio, although secured by standard practices.
Updated: 2026-01-16GitHub→
32
2
High Cost
SDSU-CompE-561-Fall-2025 icon

ai-tutor

by SDSU-CompE-561-Fall-2025

Sec4

AI Tutor is a comprehensive learning platform that helps students study smarter by interacting with an AI model, generating educational videos, and providing learning insights, integrating with Google Drive for document management.

Setup Requirements

  • ⚠️Requires OpenAI, ElevenLabs, and Google Gemini API keys (potentially paid services).
  • ⚠️Requires a Google Cloud Project setup for Google OAuth2 (CLIENT_ID, CLIENT_SECRET, REDIRECT_URI).
  • ⚠️Requires `uv` for Python package management and `Node.js` for the frontend if not using Docker.
  • ⚠️Docker is highly recommended for simplified setup, otherwise, multiple services need to be started manually.
Verified SafeView Analysis
CRITICAL: The `docker-compose.yml` and `settings.py` files contain default placeholder secrets (`SESSION_SECRET`, `fernet_key`, `secret_key`) that must be changed in production to prevent severe security vulnerabilities. CRITICAL: The CORS middleware in `app.main.py` is set to `allow_origins=["*"]` which is explicitly noted for testing only and must be restricted in production to prevent cross-site request forgery (CSRF) and other related attacks. Minor: Broad exception handling (`except Exception as e`) in `google_drive.py` and `mcp/server/main.py` could potentially mask errors or leak sensitive information if error messages are not sanitized. However, the system uses strong password hashing (argon2), JWT for authentication, and Fernet encryption for sensitive data like OAuth tokens and chat messages, which are good practices. Input validation is also extensively used via Pydantic schemas.
Updated: 2025-12-13GitHub→
32
1
Medium Cost
morrain icon

akMcpServer

by morrain

Sec3

This server provides real-time and historical stock market data to LLMs via the Model Context Protocol, including a Puppeteer-based fallback.

Setup Requirements

  • ⚠️Requires a separate AkShare API wrapper service to be running and accessible at `AKSHARE_API_BASE_URL`.
  • ⚠️Puppeteer's `--no-sandbox` argument significantly reduces security, which is a concern if the server is exposed to untrusted web content or running in a non-isolated environment.
  • ⚠️Node.js and pnpm must be installed to run directly (though `npx` abstracts `pnpm install`).
Review RequiredView Analysis
The Puppeteer setup disables sandboxing (`--no-sandbox`, `--disable-setuid-sandbox`), which is a critical security vulnerability if the scraped `eastmoney.com` content is malicious or compromised, potentially allowing code execution outside the browser environment. Additionally, the default `AKSHARE_API_BASE_URL` uses `http` instead of `https`, meaning communication with the AkShare API wrapper is unencrypted and vulnerable to eavesdropping and tampering if not hosted securely within a trusted network.
Updated: 2025-12-01GitHub→
PreviousPage 189 of 760Next