Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
dominiquekossi icon
Sec8

Tracks and manages LLM API costs across multiple providers, offering budget alerts, detailed analytics, and an optional REST API microservice.

Setup Requirements

  • ⚠️For production use, 'InMemoryStorage' should be replaced with a persistent storage provider (e.g., JSON, SQLite, Redis, etc.) as data is lost on server restart.
  • ⚠️The /budget.status endpoint currently returns the overall budget status, not a namespace-specific one, even if a namespace query parameter is passed.
Verified SafeView Analysis
The server includes input validation for most API endpoints, which is a good practice. Generic error responses (`details: err.message`) could potentially expose sensitive internal error details in a production environment, requiring careful handling or a more abstract error message layer. The BudgetManager's 'getStatus' endpoint currently does not support namespace filtering even when a namespace query parameter is provided to the MCPServer, which is a functional limitation that could lead to data interpretation issues in a multi-tenant setup, but not a direct security flaw.
Updated: 2025-11-20GitHub→
0
0
Low Cost
sadjad-chrono icon

mcp-learning

by sadjad-chrono

Sec7

This MCP server provides a simple arithmetic 'add' tool for AI assistants like Claude, enabling them to perform basic addition operations locally.

Setup Requirements

  • ⚠️Requires Node.js 18 or higher.
  • ⚠️Requires manual modification of the Claude Desktop configuration file (`claude_desktop_config.json`).
  • ⚠️Local usage via built package requires specifying an absolute path to the `dist/mcpserver/index.js` file.
Verified SafeView Analysis
The core functionality in `src/mcpserver/index.ts` (the 'add' tool) is simple and appears safe, using Zod for input validation and not involving file system access or dynamic code evaluation. However, the `package.json` includes `puppeteer` and `robotjs` as dependencies. These are powerful libraries capable of browser automation and desktop control (mouse, keyboard). While they are not currently utilized in the provided `index.ts`, their presence in a project described as providing 'arithmetic tools' introduces a potential risk for future, unaudited tool implementations or if a vulnerability were found that could leverage these high-privilege dependencies.
Updated: 2025-12-01GitHub→
0
0
Low Cost
cocolizh icon

mcp-demo-repo

by cocolizh

Sec1

The specific use case cannot be determined as no source code was provided for analysis.

Review RequiredView Analysis
CRITICAL: No source code was provided for analysis, making a security audit impossible. Therefore, a security score of 1 is assigned as safety cannot be verified.
Updated: 2025-11-20GitHub→
0
0
Low Cost
freakynit icon

snippets-mcp

by freakynit

Sec8

An MCP server for storing, searching, and managing code snippets using AI-powered semantic search and traditional keyword matching.

Setup Requirements

  • ⚠️Requires Node.js and npm installed to run via npx.
  • ⚠️First run will download a ~80MB AI model (`all-MiniLM-L6-v2`) locally, requiring internet access and disk space.
Verified SafeView Analysis
The server stores data in a local JSON file (configurable path), limiting external database exposure. It uses `@xenova/transformers` for local AI model inference, avoiding external AI API calls. No obvious hardcoded secrets or direct 'eval' usage were found. The primary risks involve the permissions granted to the MCP server process (as it has file system write access) and the integrity of the downloaded AI models and npm packages. The input validation using Zod helps prevent malformed inputs.
Updated: 2025-12-01GitHub→
0
0
Medium Cost
tingyiy icon
Sec9

Enables LLM agents to automate tasks and interact with Atlassian Jira and Confluence Cloud.

Setup Requirements

  • ⚠️Requires an Atlassian account with an API Token.
  • ⚠️Requires Python 3.10 or higher.
  • ⚠️The JIRA_URL environment variable must specifically point to the Jira Cloud REST API v3 endpoint (e.g., `https://your-domain.atlassian.net/rest/api/3`).
  • ⚠️All required environment variables (ATLASSIAN_USERNAME, ATLASSIAN_API_KEY, JIRA_URL, CONFLUENCE_URL) must be configured in a `.env` file or passed to the server process.
Verified SafeView Analysis
Uses environment variables for sensitive credentials (ATLASSIAN_USERNAME, ATLASSIAN_API_KEY) and httpx for secure asynchronous HTTP requests over HTTPS. No direct use of 'eval', 'exec', or system shell commands (e.g., 'subprocess') was identified in the provided source code. JQL/CQL queries are passed directly to Atlassian APIs; therefore, the security of these queries relies on the Atlassian API's validation and the LLM agent's adherence to safe query construction, rather than server-side sanitization. Attachment downloads fetch content from URLs provided by the respective Atlassian APIs, mitigating direct URL injection risks.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
dalianuyou icon

remote-mcpserver

by dalianuyou

Sec6

An AI chatbot application that utilizes the Model Context Protocol (MCP) to interact with multiple external services (MCP servers), specifically for retrieving and managing research paper information from arXiv and potentially accessing a filesystem and other web resources.

Setup Requirements

  • ⚠️Requires ANTHROPIC_API_KEY (Paid service) to be set in a .env file.
  • ⚠️Requires Node.js and npm/npx installed for the 'filesystem' MCP server.
  • ⚠️Requires 'uv' (Python package installer/runner) installed globally or in path to run Python components and other MCP servers.
Review RequiredView Analysis
The primary `Research_MCPServer.py` code is reasonably secure, avoiding direct code injection vulnerabilities. However, the client (`Chatbot_MultiMCPClient.py`) launches other MCP servers specified in `server_config.json` using `npx` and `uvx`. This means the overall security is dependent on the trustworthiness and security of these external packages (`@modelcontextprotocol/server-filesystem`, `mcp-server-fetch`). The `filesystem` server, in particular, could expose broad filesystem access to the LLM (via tool calls) if not carefully contained, posing a risk of unauthorized file operations or data leakage in sensitive directories. The `search_papers` tool creates directories and writes JSON files based on LLM-provided topics, which could lead to excessive disk usage or unintended file creation if the LLM is jailbroken, though the path sanitization helps prevent directory traversal.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
Sec8

Demonstrates how to build Model Context Protocol (MCP) servers using `fastmcp` and `fastapi_mcp` libraries through various examples.

Setup Requirements

  • ⚠️Requires a Python environment with dependencies managed by `uv` (indicated by `uv.lock` and `pyproject.toml`).
  • ⚠️External API keys (e.g., for `weather.py`) may be required to run certain examples, depending on the specific API chosen for the example and how it's configured.
Verified SafeView Analysis
The repository provides sample projects for demonstrating MCP server creation. While generally safe for demonstration, examples involving external API integrations (e.g., `weather.py`, `GoogleFeedParser.py`) inherently involve network requests and potential data parsing risks, typical for applications interacting with external services. No immediate 'eval' or direct system-level security flaws are apparent from the provided information, but production deployments would require thorough security hardening.
Updated: 2025-11-17GitHub→
0
0
High Cost

Folder-Cleaner-MCP

by Sashreek007

Sec9

This MCP server enables LLMs like Claude to intelligently manage a user's file system through natural language, performing tasks like cleaning, organizing, and duplicate detection.

Setup Requirements

  • ⚠️Requires Python 3.11 or higher.
  • ⚠️Requires the `uv` package manager for installation.
  • ⚠️Requires read/write access to target directories for full functionality.
Verified SafeView Analysis
The project explicitly emphasizes multiple safety features: all destructive operations move files to trash (not permanent deletion), require explicit confirmation and preview, and include robust input validation and path security to prevent traversal attacks. It claims 'No remote code execution possible' and uses a local HTTP server for the MCP interface, reducing network exposure.
Updated: 2025-11-17GitHub→
0
0
High Cost
jatingodnani icon

mcp-server

by jatingodnani

Sec3

Provides browser automation capabilities for AI agents using Playwright for tasks like navigation, data extraction, interaction, and custom JavaScript execution.

Setup Requirements

  • ⚠️Requires Playwright Chromium browser to be installed separately via `npx playwright install chromium` after `npm install`.
  • ⚠️The server must be configured with an absolute path to its `dist/index.js` file when integrating with an MCP client (e.g., Claude).
Review RequiredView Analysis
The `evaluate` tool allows arbitrary JavaScript code to be executed via `eval()` in the browser context. This is a significant security risk, as a malicious prompt could trick the AI agent into executing harmful code on the currently navigated website, potentially leading to cross-site scripting (XSS), data exfiltration, or other browser-based attacks. While intended for AI agents, direct `eval` makes it highly vulnerable to prompt injection or compromised AI logic.
Updated: 2025-11-22GitHub→
0
0
Medium Cost
markusleucht icon

perplexity-mcp

by markusleucht

Sec9

An MCP server leveraging Perplexity AI for deep and social-focused search, designed for Claude Code integration, with specialized capabilities for German pharmaceutical market research.

Setup Requirements

  • ⚠️Requires Perplexity API Key (Paid)
  • ⚠️Perplexity Pro tier required for API access
  • ⚠️Requires Python 3.10+ (despite outdated setup scripts suggesting 3.8+)
Verified SafeView Analysis
The server correctly loads the PERPLEXITY_API_KEY from an environment variable. The `save_report` function, used for saving research reports, constructs file paths safely within a dedicated `docs/reports/{date}_{name}/` directory, preventing path traversal vulnerabilities. No obvious malicious code patterns or obfuscation were found.
Updated: 2025-12-11GitHub→
0
0
Low Cost
fifthseason-ai icon

time-mcp

by fifthseason-ai

Sec9

Provides timezone-aware time operations, including natural language parsing, calculations, and conversions, as a Model Context Protocol server.

Setup Requirements

  • ⚠️Requires Node.js (>=14.0.0)
  • ⚠️Server runs via HTTP if `PORT` env var is set, otherwise as a Stdio server, which might require specific client integration.
Verified SafeView Analysis
The server uses `express` and `cors`, standard for HTTP services. It does not appear to use `eval` or dynamic code execution. Dependencies are commonly used and generally secure. Input parsing is handled by `chrono-node` and `moment-timezone`, which are focused on date/time logic and not general code execution. Error handling is present, preventing unhandled exceptions. Default environment variables are provided, reducing the risk of misconfiguration. No hardcoded secrets are visible. Overall, it appears robust for its stated purpose.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
Digital-Defiance icon

ai-capability-suite

by Digital-Defiance

Sec9

Provides a comprehensive debugging interface and system control capabilities for AI agents to interact with the development environment.

Setup Requirements

  • ⚠️Requires Node.js 18.0.0+ and NPM 8.0.0+ (for NPM installation)
  • ⚠️Requires Docker 20.10+ (for Docker installation)
  • ⚠️Platform-specific build tools might be required for native dependencies (e.g., Python3-setuptools and build-essential for Linux, Xcode Command Line Tools for macOS, Visual Studio Build Tools for Windows).
  • ⚠️The 'mcp-process' server currently requires a configuration file (`mcp-process-config.json`) specifying allowed executables for security, which needs manual creation and management.
Verified SafeView Analysis
The suite demonstrates a strong focus on security, especially for the 'Process' and 'Filesystem' modules, with features like executable allowlists, argument validation, environment sanitization, resource limits, privilege prevention, PII masking, 10-layer path validation, and comprehensive audit logging. The core 'MCP ACS Debugger' is also described with 'Enterprise security (authentication, rate limiting, PII masking, audit logging)'. While some installation methods involve direct execution of remote scripts (curl | bash), this is typical for convenience, and the server itself includes robust security layers for its runtime operations.
Updated: 2026-01-17GitHub→
PreviousPage 298 of 760Next