Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost

MCP-Server

by AshtonWard

Sec5

To host a custom server application, likely Minecraft-related, within a homelab environment.

Setup Requirements

  • ⚠️Requires Node.js and npm/yarn installed to run the server and manage dependencies.
  • ⚠️Dependencies must be installed via 'npm install' or 'yarn install' before first run.
  • ⚠️Potential for port conflicts if other services are already using the server's default port in the homelab environment.
Review RequiredView Analysis
Cannot perform a complete security audit without access to the actual code files. Server operations inherently involve network exposure, making proper input validation, authentication, and secure communication paramount. 'eval' usage, code obfuscation, and specific network vulnerabilities cannot be checked without code content. A thorough code review is essential before deployment.
Updated: 2025-11-17GitHub→
0
0
Low Cost
lady-logic icon

mmi-analyzer

by lady-logic

Sec7

Analyzes C# project architecture quality based on Carola Lilienthal's MMI framework, providing reports and visualizations for layering, encapsulation, abstraction levels, and circular dependencies.

Setup Requirements

  • ⚠️Requires Node.js 18 or higher
  • ⚠️Requires Cursor IDE for usage and configuration
  • ⚠️Manual configuration of absolute path in Cursor MCP settings
Verified SafeView Analysis
The server performs extensive file system operations (reading C# source files, writing cache/history) based on a `projectPath` provided by the user via the Cursor IDE. While `validateProjectPath` checks if the path exists and the analysis functions explicitly ignore `bin`, `obj`, `node_modules` directories, there's an inherent risk if the `projectPath` were to come from an untrusted source or if path traversal (e.g., `../../../`) were exploited to access files outside the intended project directory. However, given its intended use as a local MCP server integrated with Cursor IDE, the `projectPath` is presumed to be provided by a trusted UI, mitigating direct user injection risks. No `eval` or obvious command injection vulnerabilities were found. History and cache files (`.mmi-cache.json`, `monitoring-history.json`) are stored locally, requiring write access to the server's working directory, which could be a concern if the server environment were compromised.
Updated: 2025-12-27GitHub→
0
0
Low Cost
varun-dev-tech icon

mcp_client

by varun-dev-tech

Sec3

To connect to an MCP server.

Setup Requirements

  • ⚠️Requires an MCP server to connect to.
Review RequiredView Analysis
No executable source code was provided for security analysis; only the `README.md` file was available. Therefore, a comprehensive security audit could not be performed, and the safety of running any client code cannot be guaranteed.
Updated: 2025-12-05GitHub→
0
0
Low Cost
starfoxbeta icon

astrology-mcp

by starfoxbeta

Sec8

Provides astrological natal chart calculations by integrating with an external API.

Setup Requirements

  • ⚠️Requires Node.js 18+ to run.
  • ⚠️Requires an external astrology API for real calculations; otherwise, it returns mock data. (ASTROLOGY_API_URL, ASTROLOGY_API_KEY)
Verified SafeView Analysis
The server uses environment variables for API keys (`ASTROLOGY_API_KEY`), which is good practice. Input parameters are validated using `zod`. No `eval` or obvious malicious patterns were found in the provided source code. The primary security consideration is the reliability and trustworthiness of the external astrology API it connects to, which is configurable by the user.
Updated: 2026-01-16GitHub→
0
0
Medium Cost
mhumphrey17 icon
Sec3

Deploys an unauthenticated remote Model Context Protocol (MCP) server on Cloudflare Workers, providing real-time UK train information via six specialized tools.

Setup Requirements

  • ⚠️Requires active (likely paid) Realtime Trains API credentials.
  • ⚠️Requires a Cloudflare Workers environment for deployment.
  • ⚠️The server is explicitly 'authless' for client connections, meaning no authentication is required to access its tools once deployed.
Review RequiredView Analysis
CRITICAL: The Realtime Trains API username and password (`API_USERNAME`, `API_PASSWORD`) are hardcoded directly in `src/index.ts`. This means that if the server is deployed, these credentials will be publicly exposed in the source code visible via the worker's URL or potentially through other means. This presents a severe security vulnerability, as anyone could extract and misuse these API keys.
Updated: 2025-12-04GitHub→
0
0
Medium Cost

golang-chart

by transform-ia

Sec7

This is a Helm chart designed for deploying a Go application to a Kubernetes cluster.

Setup Requirements

  • ⚠️Requires an existing Kubernetes cluster.
  • ⚠️Requires Helm CLI installed to deploy the chart.
  • ⚠️Relies on a pre-built Go application Docker image (details within 'values.yaml' and 'templates'), which must be accessible.
Verified SafeView Analysis
The repository contains a Helm chart for deploying a Go application. Without access to the actual Go application code, 'templates/', or 'values.yaml' contents, a comprehensive security audit for 'eval', obfuscation, or specific network risks of the deployed application is not possible. The chart itself is a configuration wrapper. Potential risks lie in misconfigurations within the chart (e.g., insecure defaults) or vulnerabilities in the Go application container image it deploys.
Updated: 2025-11-18GitHub→
0
0
Low Cost

mcp-server

by spectreNN

Sec5

A test server for learning and experimenting with Minecraft-related protocols or custom game server development, likely involving network communication and basic cryptographic operations.

Setup Requirements

  • ⚠️Requires a Python environment and installation of dependencies (e.g., via `pip`).
  • ⚠️Requires specific configuration for server parameters (e.g., port, IP address) and potentially cryptographic keys or certificates.
Review RequiredView Analysis
The presence of `crypto.py` indicates cryptographic operations, but its implementation is unknown. As a 'test server' built from 'Udemy examples', it may prioritize simplicity over robust security, potentially containing default credentials, insecure configurations, or weak cryptographic practices suitable for learning but not production. Without full code, specific risks like 'eval', obfuscation, or network vulnerabilities cannot be definitively ruled out.
Updated: 2025-11-17GitHub→
0
0
Medium Cost

iracing-mcp-server

by consolecowboy0

Sec8

An MCP (Model Context Protocol) server for collecting iRacing telemetry data and integrating it with AI agents like ElevenLabs.

Setup Requirements

  • ⚠️Requires iRacing simulator to be running and active in a session.
  • ⚠️Requires Windows OS due to iRacing and pyirsdk dependencies.
  • ⚠️Requires ELEVENLABS_API_KEY and ELEVENLABS_AGENT_ID for ElevenLabs integration.
  • ⚠️Python 3.10 or higher is required.
Verified SafeView Analysis
The server binds to 0.0.0.0, making it accessible on the local network. When exposed via Cloudflare Tunnel, it becomes publicly accessible over HTTPS, requiring standard operational security practices. It also uses a pre-downloaded `cloudflared.exe` which should be verified for integrity.
Updated: 2025-11-17GitHub→
0
0
Low Cost
DoubtfulTurnip icon

portainer-mcp-server

by DoubtfulTurnip

Sec7

This server acts as an API proxy or gateway, enabling multi-cluster management by routing requests to different target URLs based on dynamic configuration.

Setup Requirements

  • ⚠️Requires `API_KEY` environment variable for authentication and secure operation.
  • ⚠️Requires a Node.js runtime environment.
  • ⚠️The process needs write access to the `configs/` directory to manage configurations.
Verified SafeView Analysis
The server's core functionality is an API proxy, which inherently carries risks like SSRF if not properly secured. It employs a global API key authentication middleware (`x-api-key`), which is crucial for protecting both configuration management and the proxy itself. No 'eval' or obfuscation found. Hardcoded secrets are avoided by using environment variables (e.g., API_KEY). The main security consideration is the strength of the API key itself and the trust placed in authenticated users, as they can direct the proxy to arbitrary target URLs. Robust input validation for target URLs is essential.
Updated: 2025-11-24GitHub→
0
0
Low Cost
ameympatil icon

Simple-MCP

by ameympatil

Sec9

Demonstrates building and exposing simple tools (dice rolling, arithmetic) via the Model Context Protocol (MCP) using Python and fastmcp for AI clients like Claude Desktop.

Setup Requirements

  • ⚠️Requires Python 3.13+
  • ⚠️Requires `uv` package manager
Verified SafeView Analysis
The server exposes basic arithmetic and dice rolling tools. No `eval()` or `exec()` is used, and no hardcoded secrets are present in the provided source code. The default `0.0.0.0:8000` binding (when run directly via `main.py`) is standard for local development but would require proper network isolation if deployed in a production environment. The `fastmcp` framework itself would handle the underlying protocol security.
Updated: 2025-12-24GitHub→
0
0
Low Cost
coldtatooine icon

mcp-server-ux-writing

by coldtatooine

Sec9

This server provides a RESTful API and real-time updates for managing UX content (text, status, versions) across different projects, with authentication and persistence in MongoDB.

Setup Requirements

  • ⚠️Requires a running MongoDB instance accessible via MONGO_URI.
  • ⚠️Requires environment variables MONGO_URI and JWT_SECRET to be set.
Verified SafeView Analysis
The project uses `dotenv` for environment variables, preventing hardcoded secrets. It implements `helmet` for common web vulnerabilities and `cors` for controlled access. Authentication relies on JWTs with `bcrypt` for password hashing, indicating good security practices. No `eval` or obvious malicious patterns were detected, and standard libraries are used. Proper error handling and logging (Winston) are present.
Updated: 2025-11-23GitHub→
0
0
Medium Cost
thebadpete icon
Sec5

A server-side application primarily for development and experimentation purposes.

Review RequiredView Analysis
Source code was not provided in the prompt, therefore a comprehensive security audit could not be performed for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns. The score reflects an unknown security posture.
Updated: 2025-11-20GitHub→
PreviousPage 284 of 760Next