Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

30
1
Medium Cost

mcp-server-example

by garrardkitchen

Sec7

A C# .NET example server demonstrating a Multi-platform Client Protocol, likely involving resource generation and prompt processing.

Setup Requirements

  • ⚠️Requires .NET SDK (e.g., .NET 6 or 7+) to build and run.
  • ⚠️May require API keys or configuration in `appsettings.json` for external services, especially if 'Prompts' and 'ResourceGenerator' imply LLM or specific data sources.
Verified SafeView Analysis
As a standard C# .NET project, it's unlikely to contain 'eval' or obfuscation. Network risks are inherent to any server, but as an example, it's probably not production-hardened. Safe to run locally in a controlled environment.
Updated: 2025-11-18GitHub→
30
1
Medium Cost
nwthomas icon
Sec9

Integrate Oura Ring health data with LLMs via the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires manual OAuth2 setup with Oura Ring Developer Applications Dashboard to obtain CLIENT_ID, CLIENT_SECRET, and a one-time USER_CODE.
  • ⚠️Requires `uv` package manager and Python 3.14.0, which the setup recommends managing via `pyenv`.
  • ⚠️If the `tokens.json` file is deleted, the full manual OAuth2 setup must be repeated as Oura Ring user codes are single-use.
Verified SafeView Analysis
Secrets (client ID, client secret, user code) are loaded from environment variables using `python-dotenv`, preventing hardcoding. OAuth2 is implemented for authentication, including automatic token refresh, enhancing security over Personal Access Tokens. Access and refresh tokens are stored locally in `tokens.json`, which is explicitly git-ignored to prevent accidental exposure. No `eval` or obvious obfuscation is present. The server communicates via standard I/O (stdio), limiting direct network exposure for local LLM integration.
Updated: 2025-12-09GitHub→
30
1
Low Cost
teemow icon

inboxfewer

by teemow

Sec9

Provides AI assistants with programmatic access to Google productivity services (Gmail, Docs, Drive, Calendar, Meet, Tasks).

Setup Requirements

  • ⚠️Google OAuth Client ID & Secret: Critical for `streamable-http` transport (OAuth proxy mode). Must be obtained from Google Cloud Console and securely provided via Kubernetes secrets or environment variables.
  • ⚠️Public Base URL: For any deployed instance using HTTP transport, the `MCP_BASE_URL` environment variable (or `--base-url` flag) *must* be correctly configured to the publicly accessible URL of the server for OAuth callbacks.
  • ⚠️Persistent OAuth Token Storage: By default, OAuth tokens are ephemeral (lost on pod restart). For production, a `PersistentVolumeClaim` or a Valkey (Redis-compatible) instance is required for token persistence and horizontal scaling.
  • ⚠️"--yolo" Flag for Write Operations: The server defaults to a read-only "safety mode". Write operations (e.g., sending emails, deleting files) require explicitly enabling the `--yolo` flag.
Verified SafeView Analysis
The project demonstrates a strong security posture. It adheres to Kubernetes Pod Security Standards (Restricted), defaults to `runAsNonRoot`, drops all capabilities, and uses a read-only root filesystem. Secrets management emphasizes using Kubernetes Secrets or external managers, with explicit warnings against unsafe practices. The OAuth proxy architecture prevents AI assistants from directly handling sensitive tokens. Instrumentation features include security warnings for insecure OTLP endpoints. The `mcp-oauth` library implements robust OAuth 2.1 hardening (PKCE, refresh token rotation, authenticated client registration, rate limiting) with secure defaults and verbose logging for potential misconfigurations. Comprehensive security documentation is provided.
Updated: 2026-01-18GitHub→
30
1
Medium Cost
opencore-x icon

openotes

by opencore-x

Sec9

Provides Claude (or other AI agents) with tools to read, search, write, and organize markdown notes in a local vault.

Setup Requirements

  • ⚠️VAULT_PATH environment variable is required and must point to an accessible directory containing markdown files.
  • ⚠️Requires Node.js version 18.0.0 or higher.
  • ⚠️For remote access (e.g., Claude.ai web/mobile), Cloudflare Tunnel and Cloudflare Access setup is necessary, adding network configuration complexity.
Verified SafeView Analysis
The server implements robust path validation in `src/core/paths.ts` to prevent directory traversal, absolute path access, and symlink escapes, sandboxing all file operations to the configured `VAULT_PATH`. Null bytes in paths are also explicitly rejected. No 'eval' or obvious malicious patterns were found. The README recommends Cloudflare Tunnel and Cloudflare Access for secure remote access, acknowledging the need for careful network exposure, which is an appropriate security recommendation rather than a vulnerability of the server itself. Local operation binds to 127.0.0.1 by default.
Updated: 2026-01-19GitHub→
30
1
Low Cost
mohammadreza-mohammadi94 icon

Agentic-AI-LLM-Apps

by mohammadreza-mohammadi94

Sec1

A Retrieval-Augmented Generation (RAG) system for querying Alice's Adventures in Wonderland using LangChain and FAISS.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid)
  • ⚠️Python 3.8+ compatible (as per pyproject.toml)
  • ⚠️Text files must be placed in the `alice_rag/data` directory
Review RequiredView Analysis
Critical: A Cerebras API key is hardcoded in `projects/multi-agent/Cerebras-Debate-Orchestrator/src/llm_interface.py`. The `calculator_tool` in `projects/tools/Tool-Augmented Chain with Calculator/app.py` uses `eval`, which, despite attempts at sandboxing, is a high-risk function. Several email sending tools across different projects contain placeholder email addresses (`YOUR_EMAIL_ADDRESS`) that need to be replaced. External API calls (OpenAI, Tavily, Pushover, SendGrid, NewsAPI, Groq, Cerebras) are made across different projects, requiring careful management of API keys via environment variables.
Updated: 2025-12-01GitHub→
30
1
High Cost
ajacobm icon

codenav

by ajacobm

Sec2

Provides a comprehensive code analysis platform, extracting architectural insights, quality metrics, and enabling navigation for integration with AI/LLM agents or data science workflows.

Setup Requirements

  • ⚠️Docker Desktop or equivalent container runtime is required for full functionality (Redis, Memgraph).
  • ⚠️Requires a running Redis server for caching and Change Data Capture (CDC).
  • ⚠️Requires a running Memgraph graph database for advanced graph queries and persistent CDC sync.
  • ⚠️Requires `ast-grep-py` to be installed for multi-language parsing.
Review RequiredView Analysis
The server uses `CORSMiddleware` with `allow_origins=["*"]`, which is a critical security vulnerability for any publicly accessible API, enabling Cross-Site Scripting (XSS) attacks. The `RedisSerializer` has a fallback to `pickle.dumps`/`pickle.loads` if `msgpack` or `json` are not available. Unpickling untrusted data is a known remote code execution (RCE) vulnerability. While used internally, a compromise of Redis could lead to RCE. The HTTP server binds to `0.0.0.0` by default, exposing it to all network interfaces, which is dangerous in production without strict firewalling. The CDC manager publishes graph mutations to Redis Streams, which could be a data exfiltration risk if Redis is externally exposed without proper authentication/authorization. There's no explicit input sanitization on graph query parameters beyond FastAPI/Pydantic's basic validation, which could open doors to injection if not carefully implemented in the analysis engine.
Updated: 2026-01-19GitHub→
30
1
Low Cost
TomoTom0 icon

ygo-db-local-mcp

by TomoTom0

Sec8

Provides CLI tools and an MCP server for searching and managing a local Yu-Gi-Oh! card database.

Setup Requirements

  • ⚠️Requires downloading data files by running `bash scripts/setup/setup-data.sh`.
  • ⚠️Requires building the TypeScript project into JavaScript using `bun run build` (or `npm run build`) before execution.
  • ⚠️Requires Bun or Node.js runtime environment.
Verified SafeView Analysis
Primarily designed for local execution. Extensive use of `child_process.spawn` for internal CLI tools, with input passed as arguments. Input sanitization for `RegExp` is correctly implemented. File I/O operations (e.g., `outputPath`, `input`/`output` for `format-converter`) could pose a risk if the server were exposed to untrusted external input, allowing arbitrary file read/write within process permissions.
Updated: 2026-01-17GitHub→
30
1
Medium Cost
biothings icon

smartapi-mcp

by biothings

Sec7

Creates Model Context Protocol (MCP) servers for APIs registered in the SmartAPI registry, with a focus on bioinformatics and life sciences APIs.

Setup Requirements

  • ⚠️Requires Python 3.10 or higher.
  • ⚠️Requires network access to the SmartAPI registry (https://smart-api.info) for API discovery.
  • ⚠️Authentication (e.g., Bearer, Basic, API Key, Cognito) for integrated APIs must be configured via environment variables or CLI arguments.
Verified SafeView Analysis
The server relies on fetching OpenAPI specifications from the SmartAPI registry (smart-api.info) and making requests to base URLs defined within these specifications. A compromise of the SmartAPI registry or a registered API could potentially direct the MCP server to interact with malicious endpoints. Authentication credentials (tokens, API keys, etc.) are handled securely via environment variables or command-line arguments, which is good practice. The `publish.py` script uses `subprocess.run` which can execute arbitrary commands, but this is for development/publishing and not directly part of the server's runtime.
Updated: 2026-01-15GitHub→
30
1
Medium Cost
liuli-neko icon

coro-cpp-mcp

by liuli-neko

Sec7

A lightweight C++ server implementing the MCP (Model Context Protocol) via JSON-RPC over various transports (Stdio, SSE), designed to expose tool functions and resources to AI agents.

Setup Requirements

  • ⚠️Requires 'xmake' build system.
  • ⚠️Requires C++20 compatible compiler.
  • ⚠️Requires configuring console for UTF-8 on Windows for proper display of Unicode characters in stdio mode.
  • ⚠️SSE transport uses 'minihttp' and binds to a local TCP port (127.0.0.1:8848), which needs to be available.
Verified SafeView Analysis
The `registerLocalFileResource` function takes a `std::filesystem::path`, which could be susceptible to path traversal vulnerabilities if the `path` argument is derived from untrusted user input without sanitization. The `SseListener` exposes an HTTP/SSE endpoint, opening standard network attack surfaces (e.g., DoS, unauthenticated access) if not properly secured at a higher layer. No direct 'eval' or arbitrary code execution from user input is apparent. No hardcoded secrets were identified.
Updated: 2025-11-23GitHub→
30
1
Low Cost
shengshengshengbuxi icon

mysql_mcp_server

by shengshengshengbuxi

Sec4

This server provides a Model Context Protocol (MCP) interface to a MySQL database, enabling AI models to execute SQL queries and retrieve database schema information.

Setup Requirements

  • ⚠️Requires a running MySQL database instance.
  • ⚠️MySQL connection details (host, port, user, password, database) must be provided via environment variables.
  • ⚠️Requires Node.js and npm for setup and execution (npm install, npm run build).
Review RequiredView Analysis
The server's primary function is to execute arbitrary SQL queries provided as input via the MCP protocol. While the `mysql2` client supports parameterized queries (mitigating basic SQL injection within parameters), the `sql` string itself is passed directly from the tool's input without additional server-side validation. This means a malicious or compromised LLM (or any upstream caller) could instruct the server to execute destructive SQL commands (e.g., `DROP TABLE`, `DELETE FROM`) on the connected MySQL database. The system inherently trusts the `sql` input from the MCP caller. Additionally, the default `MYSQL_PASSWORD` '1234' for unconfigured environments is a minor security risk for local development setups.
Updated: 2025-12-01GitHub→
30
1
Medium Cost
grammy-jiang icon

RouterOS-MCP

by grammy-jiang

Sec7

A Model Context Protocol (MCP) service for managing multiple MikroTik RouterOS v7 devices, exposing safe and auditable network operations to AI tools with strong security guardrails, role-based authorization, and built-in approval workflows.

Setup Requirements

  • ⚠️Requires MikroTik RouterOS v7 device(s) with REST API enabled.
  • ⚠️Requires Python 3.11 or later.
  • ⚠️For production deployment with HTTP/SSE transport, PostgreSQL is recommended, and integration with an OIDC provider (Azure AD, Okta, Auth0) is necessary.
  • ⚠️A 32-byte base64-encoded encryption key for device credentials must be configured via environment variable (ROUTEROS_MCP_ENCRYPTION_KEY) in non-lab environments to avoid insecure defaults and warnings.
Verified SafeView Analysis
The project demonstrates a strong focus on security design, including server-side enforcement of authorization, encrypted credentials (Fernet), and a robust plan/apply approval framework with HMAC-signed tokens and automatic rollback. It also plans for OAuth 2.1/OIDC multi-user RBAC. However, the Bandit report highlights a `exec` call in `routeros_mcp/mcp_prompts/registry.py` for dynamic prompt handler creation and `autoescape=False` in Jinja2 environment in `routeros_mcp/mcp_prompts/renderer.py`. These are high-severity vulnerabilities if input is not strictly controlled or if rendered output is displayed in a browser context without additional sanitization. While likely used with trusted templates, they introduce a non-trivial risk if not managed with extreme care. Minor hardcoded password warnings from Bandit appear in redaction/placeholder contexts.
Updated: 2026-01-13GitHub→
30
1
Medium Cost

mssql-mcp

by Nirmal123K

Sec9

Enables AI assistants to interact with both local SQL Server and Azure SQL Database through natural language queries and commands.

Setup Requirements

  • ⚠️Requires Node.js 18+ installed and available.
  • ⚠️Requires a running SQL Server (local) or Azure SQL Database instance with appropriate network access and credentials configured.
  • ⚠️For Azure SQL Database, Azure AD authentication requires the 'az login' command to be run previously.
Verified SafeView Analysis
The project explicitly mentions SQL injection prevention, query validation and sanitization, required WHERE clauses for updates, and read-only mode support. It extends an Azure-Samples project, inheriting a foundational security architecture. The primary risk lies in granting an AI system access to a database, which this project aims to manage with stated safeguards.
Updated: 2025-11-17GitHub→
PreviousPage 210 of 760Next