Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

30
1
Low Cost

docker-mcp

by leejoker

Sec5

A Dockerized Ruby-based server for a custom protocol (likely 'MCP').

Setup Requirements

  • ⚠️Docker required
  • ⚠️Docker Compose required
Review RequiredView Analysis
Code content was not provided for analysis. Security assessment is based solely on file names and general project structure. Actual code content could reveal additional vulnerabilities.
Updated: 2025-11-18GitHub→
30
1
High Cost
studcroc icon
Sec8

This server integrates AI assistants and MCP clients with Atlassian Jira Cloud to retrieve issue attachment metadata and download attachment content.

Setup Requirements

  • ⚠️Requires a Jira Cloud account with API access enabled.
  • ⚠️Requires a Jira API Token to be generated and configured.
  • ⚠️Requires Node.js version 18.x or higher.
Verified SafeView Analysis
The server correctly utilizes environment variables for sensitive Jira credentials (JIRA_DOMAIN, JIRA_EMAIL, JIRA_API_TOKEN), preventing hardcoding. It uses axios for API calls, which is a standard and secure HTTP client. Error handling for API responses is implemented. A minor point is that `jira_get_attachment_image` currently hardcodes the `mimeType` to "image/png" in its response, which is a functional limitation (as noted in the source code TODO) rather than a direct security vulnerability, but it could lead to client-side misinterpretation if not handled carefully by the consuming AI. There are no obvious malicious patterns, use of `eval`, or obfuscation.
Updated: 2026-01-11GitHub→
30
1
Medium Cost

mcp

by NeglectApp

Sec1

Cannot determine due to missing repository content (README.md not found).

Review RequiredView Analysis
No content was provided for analysis (README.md was not found). Therefore, a security audit cannot be performed. It is unsafe to run unknown code without prior inspection.
Updated: 2025-11-18GitHub→
30
1
Low Cost
Knuckles-Team icon

fan-manager

by Knuckles-Team

Sec7

Manages Dell PowerEdge server fan speeds based on CPU temperature and provides an MCP server for integration with Agentic AI systems.

Setup Requirements

  • ⚠️Requires `ipmitool` and `sensors` Linux utilities, typically running in a Linux environment.
  • ⚠️Needs `privileged` access (e.g., Docker `privileged: true` and `/dev/ipmi0` volume mount) for IPMI communication.
  • ⚠️Primarily designed for Dell PowerEdge devices, though contributions for other hardware are sought.
Verified SafeView Analysis
The application requires 'privileged' access (e.g., in Docker) to interact with IPMI devices, which is a significant security consideration but inherent to its core functionality. It uses `os.system` and `os.popen` to execute `ipmitool` and `sensors` commands. While the parameters passed to `ipmitool` for fan control (`fan_level`) are sanitized (integer converted to hex), direct execution of system commands always carries a risk. The MCP server component offers robust authentication options (JWT, OAuth, OIDC, etc.) and middleware for security features like rate limiting, which is a strong positive. No 'eval' or malicious patterns were found.
Updated: 2026-01-19GitHub→
30
1
Low Cost
hidao80 icon

mcp-tutorial-1

by hidao80

Sec8

Provides a Model Context Protocol (MCP) server for local SQLite database operations, integrating with AI-enabled IDEs and tools like Cursor, VS Code, and Claude Desktop.

Setup Requirements

  • ⚠️Requires `uv` package manager to be installed for `uvx` execution.
  • ⚠️Node.js 18+ is required for building the Claude Desktop DXT package.
  • ⚠️An internet connection is required for `uvx` to download necessary packages on its first run.
  • ⚠️The SQLite database file (`database.db`) needs manual initialization or creation using `sqlite3` commands.
Verified SafeView Analysis
The server runs the `mcp-server-sqlite` Python package in an isolated environment using `uvx`, which minimizes system contamination. It operates on a SQLite database file whose path is specified by the user or client configuration. No direct malicious patterns, hardcoded secrets, or 'eval' usage were found in the provided source. The primary risks involve potential vulnerabilities within the external `mcp-server-sqlite` package or misuse by pointing the server to unintended or sensitive database files.
Updated: 2026-01-17GitHub→
30
1
Low Cost
my-mcp-hub icon

cat-mcp-server

by my-mcp-hub

Sec8

Provides an MCP server that generates customizable cat images via an external API, intended for use by LLM agents.

Setup Requirements

  • ⚠️Requires Node.js runtime to be installed.
  • ⚠️Relies on `npx` for convenient execution, which requires npm/Node.js to be in the system's PATH.
Verified SafeView Analysis
The server uses `express` and listens on a configurable port. It exposes an `/mcp` endpoint for tool calls. The `GenerateCatImage` tool makes external API calls to `https://cataas.com`. Inputs to this tool are validated with Zod, mitigating injection risks for the external API. Development scripts use `child_process.spawn` with `shell: true`, which carries inherent risks, but this pattern is not used with untrusted input in the main server runtime.
Updated: 2026-01-15GitHub→
30
1
Medium Cost
Qubinode icon
Sec7

Orchestrates infrastructure automation, deployment, and management using an AI-powered multi-agent system, offering validation, self-correction, and RAG-driven assistance.

Setup Requirements

  • ⚠️LLM API Key (e.g., GEMINI_API_KEY, OPENROUTER_API_KEY, ANTHROPIC_API_KEY, OPENAI_API_KEY, or OLLAMA_BASE_URL) is required for AI features.
  • ⚠️Podman or Docker is required for containerized services.
  • ⚠️Root privileges are required for initial system setup scripts.
  • ⚠️RHEL-based systems (RHEL 8/9/10, CentOS Stream 10) may require a Red Hat subscription for full functionality.
  • ⚠️Automated scripts modify firewall rules and network settings, which might interfere with existing configurations.
  • ⚠️Python 3.9+ is required, with older Python 3.6.8 environments automatically upgraded to 3.9.
Verified SafeView Analysis
Credentials (AWS, Airflow, Vault tokens) are managed securely through Ansible Vault (`ansiblesafe`) and HashiCorp Vault integration. Setup scripts require/manage root privileges and `sudoers` configurations, which is necessary but high privilege. Certain containers run as root (`user: "0:0"`) for `libvirt` socket access. Network configuration scripts modify firewall rules and network settings. The AI Assistant's FastAPI application uses `allow_origins=["*"]` for CORS by default, which is a critical security risk for production environments (though documentation advises proper configuration). The `eval $(ssh-agent)` command is used in a setup script, which, while common, is a known risk vector if inputs are untrusted.
Updated: 2026-01-19GitHub→
30
1
Low Cost

mcp400

by bashdi

Sec2

A Java-based server application, likely related to game development, specifically hinted as a Minecraft server.

Setup Requirements

  • ⚠️Requires Java Development Kit (JDK) installed
  • ⚠️Requires Apache Maven installed
Review RequiredView Analysis
Cannot perform a detailed security audit without access to source code or a README. As a server application, it inherently presents network risks. Lack of information prevents any assessment of known vulnerabilities, obfuscation, or use of dangerous functions like 'eval'.
Updated: 2025-11-18GitHub→
30
1
High Cost
Mizstik icon
Sec1

This MCP server retrieves transcripts/subtitles and titles from YouTube videos using yt-dlp.

Setup Requirements

  • ⚠️Requires manual download and placement of the `yt-dlp` executable into the project directory.
  • ⚠️Requires Deno installation (via `winget install deno` on Windows) for `yt-dlp` releases starting 2025-11-12.
Review RequiredView Analysis
CRITICAL: The server uses `child_process.exec` to run `yt-dlp` commands, directly embedding user-provided `video_id` and `lang` parameters into the shell command string without apparent sanitization. This creates a severe command injection vulnerability, allowing an attacker to execute arbitrary shell commands on the server.
Updated: 2025-11-24GitHub→
30
1
Low Cost
apollographql icon

mcp-server-template

by apollographql

Sec6

This template provides a starting point for deploying the Apollo MCP Server, enabling schema introspection and structured access to GraphQL operations for AI assistants and tools.

Setup Requirements

  • ⚠️Requires a GraphOS account with `APOLLO_KEY` and `APOLLO_GRAPH_REF`.
  • ⚠️Deployment to production requires reviewing and disabling/securing development-friendly introspection tools to prevent security risks.
  • ⚠️Local development with a local schema requires rebuilding the Docker image for changes to `tools` operations to take effect (no hot-reloading).
Verified SafeView Analysis
The template includes development-friendly defaults that are not production-ready, specifically with introspection tools (Introspect, Search, Validate, Execute) enabled by default. The 'Execute' tool allows arbitrary GraphQL operations against the backend, posing a significant security risk if deployed to production without proper authentication, authorization, and configuration changes. The README explicitly warns about this.
Updated: 2025-12-02GitHub→
30
1
Low Cost
Chisanan232 icon

slack-mcp-server

by Chisanan232

Sec9

Provides a robust Model Context Protocol (MCP) server for Slack integration, offering standardized access to Slack's API features through MCP tools and real-time webhook event processing for AI assistants and automation.

Setup Requirements

  • ⚠️Requires Python 3.12+ for optimal performance and modern language features.
  • ⚠️Requires a valid Slack Bot Token (`SLACK_BOT_TOKEN`) for Slack API interactions. A Slack Signing Secret (`SLACK_SIGNING_SECRET`) is mandatory for webhook verification.
  • ⚠️Using Redis or Kafka as a message queue backend (`QUEUE_BACKEND`) requires external Redis or Kafka instances to be set up and configured via `REDIS_URL` or `KAFKA_BOOTSTRAP`.
Verified SafeView Analysis
The project uses Slack's `SignatureVerifier` with `SLACK_SIGNING_SECRET` for webhook request validation, which is a strong security practice. Environment variables are used for sensitive information like Slack tokens, with clear handling via `os.getenv` and `.env` file loading. No instances of `eval`, `exec`, or `subprocess.run(shell=True)` were found. The server can bind to `0.0.0.0` by default for HTTP transports, which is common in Docker but should be secured with appropriate network configurations (e.g., firewall rules, restricted CORS origins) in production environments.
Updated: 2026-01-14GitHub→
30
1
Medium Cost
fabric-testbed icon

fabric_mcp

by fabric-testbed

Sec9

Provides a Model Context Protocol (MCP) server to expose FABRIC Testbed API and inventory queries to LLM clients.

Setup Requirements

  • ⚠️Requires a valid FABRIC ID Token (obtained from FABRIC Portal) for all authenticated calls.
  • ⚠️Requires user-provided SSL certificates (fullchain.pem, privkey.pem) for the NGINX reverse proxy for secure HTTPS access.
  • ⚠️Docker and Docker Compose are the recommended deployment method, though a local Python run is possible.
Verified SafeView Analysis
The server uses token-based authentication (Bearer FABRIC ID token) passed via HTTP headers and explicitly states it does not store user credentials. Sensitive configurations like API hosts are loaded from environment variables. Logging explicitly redacts tokens and recommends terminating TLS at the NGINX reverse proxy. No 'eval' or obvious malicious patterns were found. Relies on external SSL certificate provisioning for NGINX.
Updated: 2025-12-11GitHub→
PreviousPage 220 of 760Next