Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
frankpunx icon
Sec4

Provides AI-powered search capabilities for a Minecraft Proxy/Server, enabling natural language queries within the Minecraft environment.

Setup Requirements

  • ⚠️Requires an AI API Key (e.g., OpenAI, Google Gemini, Anthropic), which may incur costs.
  • ⚠️Requires a running Minecraft Proxy/Server (MCP) instance to connect to.
  • ⚠️Specific AI model (e.g., OpenAI GPT-3.5/4, custom embedding model) and its dependencies will be required, but are unspecified.
Review RequiredView Analysis
No source code or detailed README was provided for analysis. As a server application, it inherently faces network security risks. Without code review, critical aspects such as input validation, authentication, authorization, and the presence of hardcoded secrets or dangerous patterns (`eval`, obfuscation) cannot be verified. Running any server application without a thorough code audit is inherently risky.
Updated: 2025-12-16GitHub→
0
0
Low Cost
William-Ger icon
Sec8

Provides comprehensive Bible study tools, verse lookup, search, chapter reading, and devotional content generation capabilities for AI assistants.

Setup Requirements

  • ⚠️Requires a deployed instance of the FastMCP server, accessible via a public SSE URL (e.g., on Railway), as indicated by the usage example.
  • ⚠️Requires Node.js and `npx` for the `mcp-remote` client to connect the server to Claude Desktop.
  • ⚠️The server itself requires Python 3.x and the `requests` library (`pip install requests`) if run locally rather than deployed.
Verified SafeView Analysis
The server uses the `requests` library to interact with `https://bible-api.com/`. No 'eval' or obvious code injection vulnerabilities are present in the provided source code. Input parameters are passed to the external API, and standard URL encoding by the `requests` library mitigates common injection risks on the server side. The primary security consideration would be the reliability and security of the `bible-api.com` itself, which is outside the scope of this server's code. No hardcoded secrets or sensitive credentials were found.
Updated: 2026-01-17GitHub→
0
0
Low Cost
jeffaf icon
Sec8

The server provides a Model Context Protocol (MCP) interface for basic calculator tools, deployable on Cloudflare Workers without authentication for AI agents.

Setup Requirements

  • ⚠️Requires a Cloudflare account for deployment.
  • ⚠️The server is 'authless' by design; deployers must implement external authentication (e.g., Cloudflare Access) if private access is needed.
  • ⚠️Local development with client applications like Cloudflare AI Playground or Claude Desktop requires specific configuration to point to 'localhost:8787/sse' or a deployed URL.
Verified SafeView Analysis
The source code itself (src/index.ts) is simple, implementing basic arithmetic operations without direct user input execution (e.g., no 'eval'). It uses Zod for input schema validation, enhancing input safety. The core functionality relies on `@modelcontextprotocol/sdk`, a standard library for MCP. The 'authless' nature is explicitly stated in the README, indicating a design choice for public accessibility (e.g., Cloudflare AI Playground). This means the server does not enforce authentication by default, requiring the deployer to understand its implications or implement authentication upstream if a private server is desired. No hardcoded secrets were found in the provided code.
Updated: 2025-11-29GitHub→
0
0
Medium Cost
Left-Coast-Tech icon

espn-mcp

by Left-Coast-Tech

Sec9

This MCP server provides real-time access to ESPN's public API for live sports data for NFL, NHL, and NBA leagues, serving information like standings, scores, team stats, schedules, and playoff details.

Setup Requirements

  • ⚠️Node.js environment (version 18.0.0 or higher) required
  • ⚠️npm package manager required
  • ⚠️Requires configuration in Claude Desktop or Claude Code's .mcp.json file for usage
Verified SafeView Analysis
The server appears well-structured, using predefined ESPN API endpoints and performing validation on input parameters like 'league' and resolving 'team' names against a known list. There are no obvious signs of 'eval' or direct arbitrary code execution. Data fetching is done via standard 'fetch' to hardcoded ESPN domains. No sensitive API keys or credentials are hardcoded or expected via environment variables for ESPN's public API, reducing direct secret exposure risk. The main security considerations would be the inherent risks of interacting with an external public API and ensuring proper sanitization of all user-provided arguments, although the existing validation helps mitigate this.
Updated: 2025-12-01GitHub→
0
0
Medium Cost
9506hqwy icon
Sec8

Provides a Model Context Protocol (MCP) server to expose Redmine functionalities as tools for AI agents or other MCP-compatible clients.

Setup Requirements

  • ⚠️Requires an existing Redmine server instance to connect to.
  • ⚠️Authentication to Redmine requires either an API Key or username/password.
  • ⚠️If connecting to a non-localhost Redmine instance, ensure Redmine is configured for HTTPS to prevent credentials from being sent in plain text, as the default `--url` is HTTP.
  • ⚠️Some tool names might exceed 46 characters, which could lead to truncation in certain client environments like VS Code's Copilot Chat panel, as noted in the source code comments.
Verified SafeView Analysis
The server uses standard API key or basic authentication for connecting to the Redmine instance, passed via environment variables or CLI flags (not hardcoded). It runs via standard I/O (stdio) and does not directly expose network ports, limiting its direct network attack surface. By default, the server operates in a read-only mode, disabling destructive API calls. A notable point is that the default Redmine server URL is HTTP (http://127.0.0.1:3000), which means credentials would be sent in plain text if Redmine itself is not configured for HTTPS, posing a risk for non-local or insecure Redmine deployments. The 'X-Redmine-Switch-User' header, if used with an administrator account, allows impersonation, which is a powerful feature of Redmine's API that the MCP server exposes; its misuse depends on the Redmine account's privileges and the security of the MCP server's deployment.
Updated: 2025-12-09GitHub→
0
0
Low Cost
AbhishekRP2002 icon

mcp-atlas

by AbhishekRP2002

Sec9

A Python library for indexing, organizing, and discovering tools across multiple MCP servers.

Setup Requirements

  • ⚠️Requires Python 3.11 or higher.
  • ⚠️Uses PDM (Python Development Master) as the build backend, which might require users to install PDM.
Verified SafeView Analysis
The provided source code is extremely minimal, consisting mainly of project metadata. There are no obvious security risks like 'eval', obfuscation, hardcoded secrets, or direct network operations visible in this snippet. The project setup in pyproject.toml appears standard. A higher score is given due to the lack of visible attack surface in the provided code, but this assumes the full implementation would also follow best practices.
Updated: 2025-11-27GitHub→
0
0
Low Cost
y-yfan icon

mcp-server

by y-yfan

Sec1

A simple server implementation likely for a specific protocol, potentially related to Minecraft Coder Pack (MCP).

Review RequiredView Analysis
No executable source code was provided for analysis beyond the README.md. Therefore, a meaningful security audit for 'eval', obfuscation, hardcoded secrets, network risks, or malicious patterns is impossible. The low score reflects the inability to verify the safety of running unknown code.
Updated: 2026-01-19GitHub→
0
0
Low Cost
ursweiss icon
Sec7

An AI-powered development monitoring and debugging server for FastAPI applications, providing real-time insights into application health, logs, errors, and performance metrics to AI assistants like GitHub Copilot.

Setup Requirements

  • ⚠️Python 3.11+ required
  • ⚠️Docker and Docker Compose (for containerized deployment)
  • ⚠️VS Code with GitHub Copilot (MCP support) for full AI integration
Verified SafeView Analysis
The server is explicitly designed for development and includes features like `SECRET_KEY` validation for production. It uses file-based IPC (`.dev/` directory) and `os.kill` for application control, which are privileged operations. While these could be risks in a production context, the project clearly states it's for development only and is excluded from Docker builds. Potential risks include malicious regex patterns via AI-provided input to log search tools, or PID manipulation for `restart_app` if the `.dev/state.json` file could be tampered with. However, these are mitigated by its confined development-only scope.
Updated: 2025-11-29GitHub→
0
0
Low Cost
worklocalinc icon

eminem-bio

by worklocalinc

Sec5

Serves a static biography website for Eminem.

Setup Requirements

  • ⚠️Requires an operational MCP Server environment for deployment.
Review RequiredView Analysis
Cannot perform a comprehensive security audit as only the README.md file was provided. No actual server or application code was available for analysis of patterns like 'eval', obfuscation, network risks, or hardcoded secrets.
Updated: 2025-11-26GitHub→
0
0
Low Cost
hemandhran icon

appium_mcp_server

by hemandhran

Sec2

Provides a server with tools to control and interact with Appium, Android emulators, and iOS simulators for mobile test automation.

Setup Requirements

  • ⚠️Requires extensive mobile development environment setup: Python, Node.js, npm, Appium (globally installed), Android SDK, and for iOS, Xcode with Command Line Tools and a configured WebDriverAgent (macOS only).
  • ⚠️The `ANDROID_HOME` or `ANDROID_SDK_ROOT` environment variable must be correctly set and accessible to the server process.
  • ⚠️All iOS-related features, including simulator/device management and Xcode project building, are only available on macOS.
Review RequiredView Analysis
CRITICAL: The `run_parallel_tests` function uses `subprocess.Popen` with `shell=True` and a user-provided `test_command_pattern` which includes a placeholder (`{udid}`). This design allows for arbitrary command injection by an attacker controlling the `test_command_pattern` input, leading to potential remote code execution on the host machine where the server is running. The `start_appium_server` tool enables `--allow-cors` for the Appium server, which, while typically a local instance, could pose a risk if the MCP server or Appium server itself were made accessible beyond localhost without proper authentication.
Updated: 2025-12-15GitHub→
0
0
Low Cost
cyberpapiii icon

imessage-max

by cyberpapiii

Sec9

Enables AI assistants to securely read, search, and send iMessages on macOS with proper contact resolution and media enrichment.

Setup Requirements

  • ⚠️Requires Full Disk Access for the Python interpreter/uvx to read ~/Library/Messages/chat.db.
  • ⚠️Requires Contacts access for the Python interpreter/uvx to resolve phone numbers to contact names.
  • ⚠️Requires Automation permission for Messages.app (when prompted) for the 'send' tool to function.
Verified SafeView Analysis
The server explicitly uses read-only access for the iMessage database and leverages macOS's Contacts framework for contact resolution, respecting system permissions. The 'send' functionality, which interacts with Messages.app via AppleScript, includes input sanitization to prevent injection attacks. External network calls for link enrichment are handled with timeouts. Clear instructions for granting required macOS permissions (Full Disk Access, Contacts, Automation) are provided, ensuring transparency and user control. No obvious 'eval' or obfuscation is present.
Updated: 2026-01-19GitHub→
0
0
Low Cost
RobThePCGuy icon

Claude-Patent-Creator

by RobThePCGuy

Sec8

A USPTO patent creation and analysis system with dual-mode architecture, providing programmatic access via an MCP server and interactive workflows as a Claude Code plugin.

Setup Requirements

  • ⚠️Requires Google Cloud Project with billing enabled and 'gcloud' authentication for BigQuery patent search.
  • ⚠️Requires NumPy version pinned to '<2.0.0' due to FAISS compatibility issues.
  • ⚠️Requires system-wide Graphviz installation for diagram generation (e.g., 'sudo apt install graphviz' on Linux).
Verified SafeView Analysis
The project adheres to good security practices by explicitly using environment variables for API keys (Google Cloud, Anthropic, OpenAI, USPTO). It also uses trusted open-source models (BGE-base-en-v1.5, MS-MARCO MiniLM-L-6-v2) and standard cloud services (BigQuery). Network operations are primarily for downloading public data and interacting with well-known APIs. The primary security considerations involve proper management of user-provided API keys and Google Cloud credentials.
Updated: 2025-12-02GitHub→
PreviousPage 308 of 760Next