Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

30
1
Medium Cost
hyperpolymath icon

poly-ssg-mcp

by hyperpolymath

Sec3

Unified server for managing and interacting with various static site generators written in diverse programming languages, designed for integration with AI agents.

Setup Requirements

  • ⚠️Requires Deno runtime environment.
  • ⚠️Each supported Static Site Generator (SSG) binary (e.g., `zola`, `stack`, `julia`, `sbcl`, `mix`) must be individually installed and available in the system's PATH for its adapter to connect and function.
  • ⚠️Requires `rescript` to be installed and accessible via Deno's npm compatibility layer for local development and build processes (`deno run -A npm:rescript build`).
Review RequiredView Analysis
The server uses `Deno.Command.run` to execute external SSG binaries. Critical command injection vulnerabilities exist in adapters like `Franklin`, `Documenter`, `StaticWebPages`, and `Coleslaw` where user-provided input (`path`, `template`, `title`) is directly interpolated into shell commands for `julia -e` or `sbcl --eval`. While `Executor.res.js` contains a `sanitizeArg` function, it is not consistently applied in all adapter execution functions, leaving multiple paths for arbitrary command execution. This is a severe risk.
Updated: 2026-01-18GitHub→
30
1
Medium Cost
Doist icon

twist-ai

by Doist

Sec9

Enables AI agents to access and interact with a Twist workspace, providing tools for managing threads, conversations, and user information.

Setup Requirements

  • ⚠️Requires `TWIST_API_KEY` environment variable to be set.
  • ⚠️`@modelcontextprotocol/sdk` is a peer dependency and must be explicitly installed by the user.
  • ⚠️Requires Node.js 18 or higher.
Verified SafeView Analysis
The server uses `process.env.TWIST_API_KEY` for API authentication, avoiding hardcoded secrets. Input validation is performed using Zod schemas. It relies on the official `@doist/twist-sdk` and `@modelcontextprotocol/sdk`. No 'eval' or obvious obfuscation found. Standard API interactions mean data is transmitted over the network, which is expected for its functionality.
Updated: 2026-01-19GitHub→
30
1
Medium Cost
neverinfamous icon

db-mcp

by neverinfamous

Sec9

An enterprise-grade Model Context Protocol (MCP) server providing advanced database operations, AI-native functionalities like vector search, and OAuth 2.1 authentication for SQLite databases.

Setup Requirements

  • ⚠️Requires Node.js 24+ (LTS).
  • ⚠️Docker is recommended for deployment and required for the `--sqlite-native` backend in certain IDEs or environments.
  • ⚠️Enabling OAuth 2.1 requires a separate Authorization Server (e.g., Keycloak) to be set up and configured, involving several manual steps.
  • ⚠️The `--sqlite-native` backend, offering more tools including transactions and window functions, relies on the `better-sqlite3` optional dependency, which may require specific build environments or manual installation.
Verified SafeView Analysis
The project demonstrates a strong commitment to security, including explicit SQL injection prevention via parameter binding, OAuth 2.1 compliance (RFC 9728/8414), strict TypeScript usage to prevent common bugs, and secure handling of sensitive configurations (e.g., environment variables for secrets, redaction in logs). CORS defaults to restrictive `origin: false`. CodeQL static analysis is integrated. No 'eval' or malicious patterns were found in the provided source code.
Updated: 2026-01-19GitHub→
30
1
Low Cost
Imashanilupul icon
Sec8

Provides open-source intelligence (OSINT) reconnaissance capabilities as a Model Context Protocol (MCP) server for integration with AI agents.

Setup Requirements

  • ⚠️Requires Python 3.12 or higher (as per pyproject.toml).
  • ⚠️Requires a Wigle API account and API keys (WIGLE_API_NAME, WIGLE_API_TOKEN) for BSSID lookups.
  • ⚠️Requires creating a `.env` file for API keys in the project root.
Verified SafeView Analysis
The server's core functionality involves direct network connections and external API calls, which are inherent to OSINT tools. API keys are handled securely via environment variables using pydantic-settings and dotenv. Broad `except` blocks in tool functions could mask errors, but no 'eval' or other severe vulnerabilities like code injection were found. It is safe to run when used responsibly and ethically, understanding its purpose as a reconnaissance tool.
Updated: 2025-11-24GitHub→
30
1
Medium Cost
gesslar icon

fluffos-mcp

by gesslar

Sec8

An MCP server that enables AI assistants to perform driver-level validation, debugging, and documentation lookup for LPC code using FluffOS CLI tools.

Setup Requirements

  • ⚠️Requires FluffOS installed with `symbol` and `lpcc` binaries available.
  • ⚠️Requires Node.js v22 or higher.
  • ⚠️Requires environment variables FLUFFOS_BIN_DIR, MUD_RUNTIME_CONFIG_FILE, and optionally FLUFFOS_DOCS_DIR to be set with absolute paths.
Verified SafeView Analysis
The server leverages Node.js `child_process.spawn` to execute external FluffOS CLI tools (`symbol`, `lpcc`, and a `search_docs.sh` script). Arguments to these tools, including file paths and search queries, are passed from AI input. While the Node.js code itself uses array arguments for `spawn` (mitigating shell injection in the initial call) and the shell script explicitly double-quotes its `$QUERY` argument for `grep`/`rg`, the overall security relies heavily on the trustworthiness of the configured FluffOS binaries and documentation directory, as well as the robustness of the underlying FluffOS CLI tools when processing potentially untrusted or malformed file paths.
Updated: 2026-01-18GitHub→
30
17
Medium Cost
mcp-use icon
Sec4

This server provides interactive tools and React widgets for exploring and querying your Supabase database and viewing its service status.

Setup Requirements

  • ⚠️Requires Node.js 18+ and yarn.
  • ⚠️Requires an active Supabase project.
  • ⚠️Requires a Supabase Personal Access Token (which can incur costs depending on usage).
Review RequiredView Analysis
The server uses `process.env.ACCESS_TOKEN` for Supabase authentication, which is good practice. However, the `SupabaseStatusWidget` uses `dangerouslySetInnerHTML` to render descriptions from an external RSS feed (`https://status.supabase.com/history.rss`). This is a critical Cross-Site Scripting (XSS) vulnerability if the RSS feed content can be manipulated by an attacker, potentially allowing arbitrary script execution within the widget. While `CSP_URLS` is configured for widget loading, `dangerouslySetInnerHTML` needs explicit sanitization of the content itself to prevent injection risks.
Updated: 2025-12-18GitHub→
30
1
High Cost
ltsch icon
Sec10

A specialized MCP server for Cursor IDE that automatically creates and manages project-specific rule directories with automatic file watching and AI-powered rule management tools.

Setup Requirements

  • ⚠️Requires Node.js 18+ (automated by 'install.sh' script).
  • ⚠️Requires Cursor IDE to be installed and configured for MCP.
  • ⚠️When using 'generate-config.js' for new projects, paths in the generated '.cursor/mcp.json' output may require manual adjustment to match the actual server repository location.
Verified SafeView Analysis
The server is explicitly designed for local-first operation with zero network connectivity. It communicates solely via stdio (standard input/output) with Cursor IDE, eliminating network attack surfaces. It does not use 'eval', and there are no apparent hardcoded secrets. AI-powered features leverage Cursor IDE's existing LLM integration rather than initiating external network calls directly from the server process. File system operations are confined to project-specific '.cursor/rules' directories.
Updated: 2025-11-28GitHub→
30
1
Medium Cost
findmine icon

findmine-mcp

by findmine

Sec9

An MCP server that provides product styling, outfitting recommendations, visually similar product suggestions, and fashion advice by integrating with the FindMine API for LLM-powered shopping stylists.

Setup Requirements

  • ⚠️Requires a FindMine Application ID (`FINDMINE_APP_ID`) for non-demo usage, which must be obtained from FindMine.
  • ⚠️User interaction tracking (`track_interaction` tool) and item detail updates (`update_item_details` tool) are disabled by default and require explicit environment variables (`FINDMINE_ENABLE_TRACKING=true`, `FINDMINE_ENABLE_ITEM_UPDATES=true`) to be enabled.
  • ⚠️Requires an MCP-compatible client (e.g., Claude Desktop) to connect and interact with the server after installation.
Verified SafeView Analysis
The server demonstrates good security practices including input validation via Zod schemas for all tool arguments, use of environment variables for API keys and configurations (with safe defaults), and logging to stderr to avoid interfering with the MCP protocol. The API client handles network requests with retries and basic error handling, constructing URLs and JSON bodies appropriately to prevent common injection vectors. Potentially sensitive features like tracking and item updates are opt-in via environment variables. No 'eval' or malicious obfuscation patterns were found. The primary risk would be in the security of the upstream FindMine API or misconfiguration of environment variables.
Updated: 2025-12-03GitHub→
30
1
Medium Cost
keith-hung icon

WeDaka-MCP

by keith-hung

Sec3

This MCP server provides an interface for an AI agent to interact with an employee time-tracking and clock-in/out system (WeDaka).

Setup Requirements

  • ⚠️Requires Node.js 20.0.0+.
  • ⚠️Requires an external 'WeDaka' server instance to connect to, configured via WEDAKA_API_URL.
  • ⚠️Requires specific environment variables (WEDAKA_API_URL, WEDAKA_USERNAME, WEDAKA_DEVICE_ID, WEDAKA_EMP_NO) for authentication and API communication.
Review RequiredView Analysis
CRITICAL RISK: The `WedakaApiClient` explicitly disables SSL certificate validation (`rejectUnauthorized: false`) when making HTTPS requests. This makes all communications with the `WEDAKA_API_URL` vulnerable to Man-in-the-Middle (MITM) attacks, allowing attackers to intercept, read, or alter sensitive employee data. While noted 'as per API spec', this is a severe security flaw in either the API design or its integration. The server relies heavily on environment variables for authentication (`WEDAKA_USERNAME`, `WEDAKA_DEVICE_ID`, `WEDAKA_EMP_NO`), which is a standard practice but requires secure handling of these variables in the deployment environment. The `DEBUG_API` flag can expose raw API responses if enabled in production, which is a minor concern.
Updated: 2025-11-27GitHub→
30
1
Medium Cost
ada333 icon
Sec8

Manages AI/ML development environments (workbenches, images, hardware profiles) on Red Hat OpenShift AI (RHOAI) via an AI agent.

Setup Requirements

  • ⚠️Requires Go runtime and compiler to build the binary (`go build`).
  • ⚠️Requires a configured `~/.kube/config` file with access to the target OpenShift/Kubernetes cluster.
  • ⚠️The user running the server must be logged into the OpenShift cluster with sufficient permissions for the operations requested by the tools.
Verified SafeView Analysis
The server uses `client-go` to interact with a Kubernetes/OpenShift cluster, requiring `~/.kube/config` to be present and configured with appropriate access permissions. Communication with the AI agent is via standard I/O, not external network ports. No explicit hardcoded secrets, obfuscation, or malicious patterns were found in the provided code. Security primarily depends on the RBAC permissions granted to the server's underlying service account/kubeconfig.
Updated: 2026-01-12GitHub→
30
1
Low Cost
kgain21 icon

voicepeak-mcp

by kgain21

Sec10

Provides a reusable Flutter widget for cycling through a list of other widgets with transition animations.

Setup Requirements

  • ⚠️Requires Flutter SDK to build and run
  • ⚠️Requires Xcode for iOS development
  • ⚠️Requires Android SDK/Studio for Android development
Verified SafeView Analysis
Based on the provided truncated source code, which primarily consists of standard Flutter project boilerplate and asset configuration, there are no apparent security risks such as 'eval' usage, code obfuscation, network risks, hardcoded secrets, or malicious patterns.
Updated: 2026-01-19GitHub→
30
1
Medium Cost
saygex9965 icon
Sec3

Converts any Model Context Protocol (MCP) server into a Claude Skill to enable dynamic tool invocation and achieve significant context savings.

Setup Requirements

  • ⚠️Requires the `mcp` Python package (`pip install mcp`).
  • ⚠️The input MCP server configuration (`mcp-config.json`) may contain sensitive information (e.g., API tokens) that will be copied to the generated skill directory.
  • ⚠️The target MCP server might have its own external dependencies (e.g., Node.js/npm for `npx` commands) that must be installed on the system where the skill executor runs.
Review RequiredView Analysis
The `mcp_to_skill.py` script generates an `executor.py` script and `mcp-config.json` based on a user-provided MCP configuration. The `mcp-config.json` specifies a `command` field which the generated `executor.py` will run via `subprocess`. If the initial `mcp-config.json` is sourced from an untrusted party, it can lead to arbitrary code execution on the system running the converter or the generated skill. Additionally, sensitive environment variables like `GITHUB_TOKEN` are stored directly within the generated `mcp-config.json` file, posing a risk if the file's permissions are not properly managed.
Updated: 2026-01-19GitHub→
PreviousPage 234 of 760Next