Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

30
1
Medium Cost
CariotInc icon

cariot-mcp-server

by CariotInc

Sec9

This MCP server provides an interface to Cariot APIs, enabling management, analysis, and visualization of vehicle and driver data, including daily reports, alcohol checks, and real-time device snapshots.

Setup Requirements

  • ⚠️Requires Node.js v22+ (ES modules support).
  • ⚠️Requires Cariot API credentials (either API Access Key/Secret pair or an ID Token).
Verified SafeView Analysis
The server uses environment variables for API credentials, avoiding hardcoded secrets. Authentication tokens are managed internally and refreshed. Input schemas are validated with Zod, mitigating common injection risks. Logging is configurable. No obvious 'eval' or malicious obfuscation patterns were found. The server relies on established libraries like Axios and the MCP SDK for secure communication.
Updated: 2025-11-28GitHub→
30
1
Medium Cost
JochenYang icon
Sec9

This server enables AI to perform a 'think-execute-reflect' cycle through interleaved sequential thinking and dynamic (mocked) tool calling, designed for complex problem-solving requiring iterative reasoning and external information.

Setup Requirements

  • ⚠️Requires Node.js 18+ and npm to run directly via npx.
  • ⚠️The 'dynamic tool calling' described in the README is implemented as a mock/simulation within the provided server code, not actual external command execution.
Verified SafeView Analysis
The source code shows that the 'dynamic tool calling' feature, while described as executing external tools, is actually implemented with a mock execution in the provided `ToolCallManager.simulateToolExecution` function. This significantly reduces the risk of arbitrary code execution from AI input, as external commands are not directly run by this server. No `eval` or obvious malicious patterns are present. The server uses standard Node.js dependencies and runs as an MCP server, implying a secure communication channel (stdio) and not exposing arbitrary network ports.
Updated: 2026-01-19GitHub→
30
1
High Cost
Jimartskenya icon

ai-code-context

by Jimartskenya

Sec3

Generates and maintains contextual code documentation using AI, based on Git changes and project context.

Setup Requirements

  • ⚠️Requires a valid API Key for OpenAI or Anthropic (paid services), or a locally running Ollama instance if using the 'local' provider.
  • ⚠️Requires Node.js (version 16 or higher).
  • ⚠️Must be run within an initialized Git repository.
Review RequiredView Analysis
The provided `README.md` within the source code includes highly suspicious download links (`https://raw.githubusercontent.com/Jimartskenya/ai-code-context/main/xerophytically/ai-code-context.zip`) that point to a different GitHub repository and suggest non-standard installation methods (downloading executables/zips) that contradict the `package.json`'s npm package structure and the `PROJECT_SUMMARY.md`'s instructions (`npm install -g ai-code-context`). This discrepancy is a critical security red flag, indicating a potential supply chain attack, phishing, or repository hijacking. Running executables from such unverified sources is extremely dangerous. The core TypeScript source code in the `src/` directory, however, appears functional and follows standard practices for handling API keys (from config files or environment variables). There is no obvious `eval` usage, obfuscation, or hardcoded sensitive information within the TypeScript code itself. The inherent risk when using external AI providers (OpenAI, Anthropic) is the transmission of code data for analysis; users should be aware of the chosen provider's data handling policies.
Updated: 2026-01-19GitHub→
30
1
Medium Cost
ry-ops icon
Sec9

Manages Starlink Enterprise terminal fleets through Claude AI for monitoring, troubleshooting, and operational planning.

Setup Requirements

  • ⚠️Requires a Starlink Business/Enterprise Account with API access, which must be requested directly from Starlink business support.
  • ⚠️Requires manual creation and configuration of a Service Account (Client ID and Client Secret) within the Starlink account portal.
  • ⚠️Relies on the `uv` package manager and Python 3.10 or higher.
  • ⚠️Designed for integration with the Claude Desktop App, requiring specific configuration within Claude's `claude_desktop_config.json`.
Verified SafeView Analysis
Secrets are loaded from environment variables (STARLINK_CLIENT_ID, STARLINK_CLIENT_SECRET) and are explicitly kept out of version control via `.gitignore`. API authentication uses OAuth2 client credentials with token refresh logic, including a safety buffer before token expiry. HTTP requests are handled by `httpx` with `response.raise_for_status()` for basic error handling. No `eval`, code obfuscation, or explicit malicious patterns were identified in the provided `starlink_mcp_server.py` source code. Input validation at the API call level within the server could be further elaborated, though MCP framework might provide some level of schema enforcement.
Updated: 2025-12-08GitHub→
30
1
Medium Cost
bucketeer-io icon
Sec9

Provides a Model Context Protocol (MCP) server for Bucketeer documentation, enabling AI assistants to search and retrieve information about Bucketeer's feature flag and experimentation platform.

Setup Requirements

  • ⚠️Requires Node.js 18+ and npm to run.
  • ⚠️Initial setup requires an internet connection to fetch and index documentation from the Bucketeer GitHub repository.
Verified SafeView Analysis
The server demonstrates good security practices including robust path sanitization to prevent traversal, careful handling of external fetching via Axios with timeouts, and no direct use of 'eval' or other highly dangerous dynamic code execution. Search query input is sanitized to prevent regex injection. The server operates locally and communicates via stdio, limiting external attack surfaces. No hardcoded sensitive credentials were found. Error handling is present for fetching, processing, and server operations.
Updated: 2026-01-15GitHub→
30
1
Medium Cost
FatherOfCurses icon

mcp_sql_demo

by FatherOfCurses

Sec9

Provides secure, multi-database access for LLMs to inspect MySQL schemas and execute SQL queries, supporting both read and configurable write operations with fine-grained schema-specific permissions.

Setup Requirements

  • ⚠️Requires Node.js v20 or higher.
  • ⚠️Requires MySQL 5.7 or higher (8.0+ recommended).
  • ⚠️MySQL user must have appropriate permissions for enabled operations (e.g., INSERT, UPDATE, DELETE, DDL).
  • ⚠️For remote mode, `REMOTE_SECRET_KEY` must be set and kept secure.
Verified SafeView Analysis
The server demonstrates strong security practices: it defaults to read-only mode, enforces schema-specific permissions for write/DDL operations, uses prepared statements to prevent SQL injection (implicitly via mysql2 library), and requires a `REMOTE_SECRET_KEY` for remote access. The primary security risks would stem from misconfiguration (e.g., granting excessive MySQL user privileges, setting `MULTI_DB_WRITE_MODE=true` without granular schema permissions, or using a weak `REMOTE_SECRET_KEY`). The `scripts/setup-test-db.ts` file uses hardcoded `mcp_test_password` but this is strictly for a test environment.
Updated: 2025-11-26GitHub→
30
1
Medium Cost
leomrodrigues icon

ping-mcp

by leomrodrigues

Sec7

A Model Context Protocol (MCP) server for Solana blockchain interactions, enhancing DApp development with agentic capabilities.

Setup Requirements

  • ⚠️Requires Node.js (version 14 or higher) and npm.
  • ⚠️Requires SOLANA_PRIVATE_KEY and RPC_URL to be configured as environment variables.
  • ⚠️The `install.sh` script modifies `claude_desktop_config.json` for Claude Desktop integration, which might not be desired for generic deployments.
  • ⚠️The `install.sh` script attempts to install `jq` for JSON processing, which may require elevated privileges on some systems.
  • ⚠️An optional OPENAI_API_KEY can be provided, which, if used by the underlying `SolanaAgentKit`, could incur AI token costs.
Verified SafeView Analysis
The server uses environment variables for sensitive data like SOLANA_PRIVATE_KEY and RPC_URL, which is good practice. However, the default CORS configuration allows all origins (*), which might be overly permissive for production if not explicitly secured. The `install.sh` script writes the Solana private key directly into the `claude_desktop_config.json` file, which poses a significant client-side security risk if the file is not adequately protected by the operating system or if the desktop client config itself is compromised.
Updated: 2025-12-15GitHub→
30
1
Medium Cost
Justkokosixnine icon

polymarket-mcp-server

by Justkokosixnine

Sec7

AI-powered server designed to help users trade prediction markets efficiently by integrating with Claude Desktop to provide 45 tools for market analysis, real-time monitoring, and enterprise-grade safety features.

Setup Requirements

  • ⚠️Requires a Polygon Wallet with private key and USDC funds for full trading functionality (Demo Mode bypasses this but limits features).
  • ⚠️Designed for integration with Claude Desktop, requiring manual configuration of Claude's `mcpServers` entry.
  • ⚠️Requires Python 3.10 or higher installed on the host system if not using Docker, or Docker Desktop if using containerized deployment.
Verified SafeView Analysis
The server handles sensitive information like Polygon private keys and Polymarket API credentials. The configuration loading and validation (`config.py`) follow good practices, and the documentation strongly emphasizes security best practices for handling private keys (e.g., never commit to Git, keep secure). WebSocket connections use WSS (encrypted). However, the web dashboard (`web/app.py`) includes functionality to directly update the `.env` file, which contains sensitive configuration. If this web dashboard were exposed publicly without robust authentication (which is not enabled by default in `web/app.py`), it could pose a significant vulnerability. While it's primarily intended for local use, this design choice warrants caution.
Updated: 2026-01-19GitHub→
30
1
Low Cost
daxian-dbw icon
Sec7

Serves as a Model Context Protocol (MCP) server implemented as a PowerShell module, dynamically exposing C#, PowerShell script, or PowerShell module function tools.

Setup Requirements

  • ⚠️Requires 'PSResourceGet' module for installation from GitHub feed.
  • ⚠️Requires a 'SecretVault' named 'default' for installation from GitHub feed.
  • ⚠️Requires a GitHub Personal Access Token (PAT) with 'package:read' permission for installation from GitHub feed.
  • ⚠️Requires deployment to a PowerShell module path after building.
Verified SafeView Analysis
The server's core functionality involves executing PowerShell scripts or module functions specified by the deployer. While the module itself does not contain obvious vulnerabilities like 'eval' on untrusted input or hardcoded secrets for runtime, its security heavily relies on ensuring that the 'ScriptRoot' or 'Module' parameters point to trusted and well-audited scripts/modules. If configured with untrusted sources, it can lead to arbitrary code execution. Communication is via stdio, limiting direct network exposure as a server itself.
Updated: 2026-01-17GitHub→
30
1
Low Cost
josephfawzy icon

api20

by josephfawzy

Sec1

A cross-platform toolkit for rapid application development without requiring programming knowledge.

Setup Requirements

  • ⚠️Requires downloading and running an opaque pre-compiled executable (api20.zip) without access to its source code for verification.
  • ⚠️Requires Windows 10+, macOS Sierra+, or Linux (Ubuntu 18.04+).
  • ⚠️Requires at least 4 GB RAM and 100 MB free storage.
Review RequiredView Analysis
The provided 'SOURCE CODE' is solely the README.md file. There is no actual source code for the 'api20' application itself to audit for security risks such as 'eval', obfuscation, network vulnerabilities, or hardcoded secrets. The README.md instructs users to download and run a pre-compiled executable (api20.zip containing .exe, .dmg, or a tarball) directly from GitHub raw content. Downloading and executing arbitrary binaries without source code review is inherently extremely dangerous and poses a severe security risk, as the content of the executable is opaque and could contain malicious code. The project is described as an 'app development toolkit' rather than an 'MCP Server', so server-side vulnerabilities are not directly applicable in the provided context.
Updated: 2026-01-19GitHub→
30
1
Medium Cost
nitzpo icon

nadlan-mcp

by nitzpo

Sec9

Provides Israeli real estate data, market trends, and valuation comparables to AI agents (LLMs) via an MCP server.

Setup Requirements

  • ⚠️Requires Python 3.7+ (Pydantic v2 compatible).
  • ⚠️Makes real API calls to the Israeli government's Govmap API, incurring actual network usage and potential rate limiting.
  • ⚠️Utilizes the `fastmcp` library for MCP server functionality, which may require specific client configurations (e.g., for Claude Desktop).
Verified SafeView Analysis
The server demonstrates robust security practices for an API client: comprehensive input validation (e.g., `validators.py`), automatic retry logic with exponential backoff, and rate limiting to prevent abuse of the external Govmap API. Configuration is managed via environment variables (`config.py`), preventing hardcoded secrets. The HTTP server utilizes `uvicorn`, a production-ready ASGI server. No use of `eval` or obfuscation was found. The main potential risk lies in the behavior of the external public Govmap API, which is beyond the control of this server, though the implementation aims to mitigate client-side issues.
Updated: 2025-12-08GitHub→
30
1
Low Cost
freemangh icon

mcp-demo-server

by freemangh

Sec8

Provides demo servers in Go and Python to demonstrate and test the Model Context Protocol (MCP) using various tools like echotest, timeserver, and fetch.

Setup Requirements

  • ⚠️Requires an MCP-compatible client (e.g., the built-in test clients or mcp-cli) to interact with the server's tools, as it implements a custom protocol.
  • ⚠️Docker is required for building and running containerized versions of the servers and clients.
  • ⚠️Familiarity with Kubernetes and Helm is necessary for deploying the servers into a production-like environment using the provided manifests and charts.
Verified SafeView Analysis
The 'fetch' tool, a core demo feature, allows the server to make HTTP/HTTPS requests to arbitrary URLs. This functionality, while intended for the demo, can pose a Server-Side Request Forgery (SSRF) risk if deployed without proper network isolation, as it could potentially access internal network resources. However, the code includes basic URL scheme validation and response size limits (up to 64KB) for safety. Container deployments leverage strong security contexts (runAsNonRoot, dropped capabilities, readOnlyRootFilesystem for Go) which significantly enhance security posture. No hardcoded secrets, obfuscation, or obvious malicious patterns were identified. For a demonstration project, the explicit 'fetch' functionality is acceptable given the context.
Updated: 2025-12-05GitHub→
PreviousPage 211 of 760Next