Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
0xKaveman icon
Sec5

Enables AI agents to query Ethereum balances and execute token swaps via a Model Context Protocol (MCP) server in Rust.

Review RequiredView Analysis
A comprehensive security audit is impossible as the source code provided was limited to only the README.md. Therefore, checks for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns could not be performed. Given it's a server for financial trading on Ethereum, security is paramount and would require a full code review.
Updated: 2025-11-26GitHub→
0
0
Low Cost

md-skills-mcp

by NickRimmer

Sec3

Provides a server that exposes local scripts defined in Markdown, PowerShell, or TypeScript as MCP tools to an MCP-capable client.

Setup Requirements

  • ⚠️Requires Node.js and npm to run the server via `npx`.
  • ⚠️Requires `pwsh` (PowerShell) to be available on the system PATH for PowerShell tools to function.
  • ⚠️Tool changes (additions/modifications) require the MCP server to be restarted as there is no hot-reload.
  • ⚠️TypeScript tools' external dependencies must be installed (e.g., via npm) in a location resolvable by the tool files.
Review RequiredView Analysis
The server executes arbitrary PowerShell and TypeScript files from the specified tools folder. PowerShell scripts are run with `-ExecutionPolicy Bypass`, which allows any script to execute, posing a significant security risk if tool files are untrusted or sourced externally. TypeScript files are transpiled and executed at load time, also allowing arbitrary code execution. Running this server with untrusted tool files could lead to system compromise.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
sriniketh icon
Sec9

Integrates MediaWiki content with Model Context Protocol (MCP) compatible systems (e.g., LLMs) to provide grounded information retrieval from wiki-based websites.

Setup Requirements

  • ⚠️Requires Docker to build and run.
  • ⚠️Requires an MCP-compatible client (e.g., Claude, LM Studio) to interact with the server.
  • ⚠️Requires environment variables WIKI_NAME and WIKI_API_URL to be set.
Verified SafeView Analysis
The server uses Ktor for HTTP requests and Jsoup for HTML cleaning, both standard and generally secure libraries. Environment variables are used for configuration, preventing hardcoded secrets. Error handling for API calls is present. The `cleanHtmlContent` function uses Jsoup to strip HTML, which helps mitigate XSS risks in content returned to a consuming model. No 'eval' or similar dangerous patterns were found. The primary security consideration outside the server's code itself would be ensuring the integrity and trustworthiness of the upstream MediaWiki API it connects to.
Updated: 2026-01-17GitHub→
0
0
High Cost
BooboNikita icon

mcp-server-demo

by BooboNikita

Sec4

An example project demonstrating how to build an MCP server and an intelligent client capable of automatic tool calling and multi-agent orchestration for compliance risk assessment, sales, and technical support.

Setup Requirements

  • ⚠️Requires Python 3.13+.
  • ⚠️Requires Kimi (Moonshot AI) API Key and API URL for LLM functionality (a paid service).
  • ⚠️To enable full client functionality, multiple local services (MCP servers, embedding service) must be run concurrently on specific ports, e.g., `python database.py` (port 8000), `python src/compliance_warning/server.py` (port 8001), and `python src/embedding_service.py` (port 8003). There are also `a2a` agents with their own port configurations, potentially conflicting if run simultaneously with other components.
Review RequiredView Analysis
The `database.py` file hardcodes MySQL root user credentials ('root', '123456') for a local database connection. This is a critical security vulnerability for anything beyond an isolated, ephemeral demo. The `subprocess.Popen` calls in `src/a2a/manager.py` are used for internal agent orchestration with fixed module names, posing a low risk of arbitrary command execution. Inter-service communication relies on fixed `localhost` ports without explicit authentication, which could be a risk if `localhost` network access is compromised. The `src/compliance_warning/service.py` attempts to 'auto-fix' LLM-generated JSON by replacing escaped quotes, which could lead to unexpected parsing or resource exhaustion if presented with a maliciously crafted payload.
Updated: 2026-01-19GitHub→
0
0
Low Cost
swapnildagade1213 icon

MCP_Server_Demo

by swapnildagade1213

Sec9

Provides a Python template for building Model Context Protocol (MCP) servers to integrate AI assistants with custom tools and resources.

Setup Requirements

  • ⚠️Requires `uv` package manager
  • ⚠️Requires Python 3.13 or higher
Verified SafeView Analysis
The provided `mcp_demo.py` file is simple and does not contain obvious security vulnerabilities like `eval`, `exec`, or direct shell commands. It loads environment variables via `dotenv`, which is good practice. The tools return hardcoded values. Any future additions of tools or resources, especially those interacting with external APIs or file systems, would require careful implementation to avoid introducing risks.
Updated: 2025-12-29GitHub→
0
0
Medium Cost
commercelayer icon

mcp-server-metrics

by commercelayer

Sec9

This MCP server provides a local implementation with a suite of metrics tools for Commerce Layer data analysis, enabling extraction of data from order, return, or cart history.

Setup Requirements

  • ⚠️Requires Commerce Layer API client_id and client_secret to be set as environment variables (CL_CLIENT_ID, CL_CLIENT_SECRET).
  • ⚠️Requires Node.js version 22 or higher.
  • ⚠️Uses pnpm for package management; ensure pnpm is installed or adapt to npm/yarn if preferred.
Verified SafeView Analysis
The server handles API credentials (client_id, client_secret) securely by requiring them as environment variables, preventing hardcoding. Network requests are made using standard 'fetch' to the Commerce Layer API. Local file system access is limited to reading static documentation files within the project, posing minimal risk. No 'eval' or direct 'child_process' execution is observed. Authentication tokens are verified with `jwtVerify`.
Updated: 2026-01-03GitHub→
0
0
Low Cost
NPham1402 icon

MCP-Server-Hono

by NPham1402

Sec1

Provides a lightweight web server and API platform built with the Hono framework, likely designed for applications related to Minecraft (MCP).

Setup Requirements

  • ⚠️Requires Node.js runtime (version not specified, but typically >=16)
  • ⚠️Requires 'npm' or 'yarn' for dependency management
  • ⚠️May require a build step (e.g., TypeScript compilation) before running
Review RequiredView Analysis
No source code was provided for analysis. Therefore, it is impossible to audit for security risks such as 'eval', obfuscation, hardcoded secrets, network vulnerabilities, or malicious patterns. The score reflects the inability to perform any security review.
Updated: 2025-11-26GitHub→
0
0
Medium Cost
rios0rios0 icon
Sec9

Manages Home Assistant automations by exposing them as tools via the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires an existing Home Assistant instance with its REST API enabled.
  • ⚠️Requires a long-lived access token from Home Assistant for authentication.
  • ⚠️Requires an MCP-compatible client (e.g., Cursor IDE) to interact with the server's exposed tools.
  • ⚠️Standalone setup requires Python 3.10+ and PDM for dependency management.
Verified SafeView Analysis
The server uses `yaml.safe_load` for parsing YAML, which mitigates YAML deserialization vulnerabilities. Secrets (HA_TOKEN) are expected via environment variables, which is a good practice. The primary security consideration is ensuring the configured `HA_URL` is trusted and the `HA_TOKEN` has appropriate permissions, as the server acts as an interface to Home Assistant.
Updated: 2025-12-17GitHub→
0
0
Low Cost
Traia-IO icon
Sec8

An MCP server for the Nikola TEST MCP API, enabling AI agents and LLMs to interact with its functionalities through standardized tools.

Setup Requirements

  • ⚠️Docker required for recommended setup (or uv for manual)
  • ⚠️Python 3.12+ required
  • ⚠️Requires specific environment variables for D402 payment protocol (SERVER_ADDRESS, MCP_OPERATOR_PRIVATE_KEY, D402_FACILITATOR_URL or D402_TESTING_MODE=true)
  • ⚠️Custom 'traia-iatp' dependency, complex local handling in dev setup script
Verified SafeView Analysis
The server uses standard practices and well-known libraries like FastMCP and Starlette. The `run_local_docker.sh` script performs complex environment setup for local development, including temporary file modifications and generating Ethereum accounts (SERVER_ADDRESS, MCP_OPERATOR_PRIVATE_KEY) using `web3` if not already set. While this is a convenience for local dev, the management of these sensitive keys is critical for production deployments and is explicitly flagged as a workaround. No `eval` or direct malicious patterns were found. Network risks are inherent to any server, but the implementation itself does not introduce obvious vulnerabilities beyond general server hardening best practices.
Updated: 2025-11-28GitHub→
0
0
Low Cost
consigcody94 icon

metasploit-mcp-server

by consigcody94

Sec9

Provides AI agents with secure, controlled access to Metasploit Framework for authorized penetration testing, security research, and CTF challenges.

Setup Requirements

  • ⚠️Requires Metasploit Framework with RPC enabled (msfrpcd) to be running.
  • ⚠️Python 3.10 or higher is required.
  • ⚠️Metasploit RPC password must be provided via environment variable or CLI prompt.
  • ⚠️SSL certificate verification for Metasploit RPC is disabled by default (msf_ssl_verify=False), which might require careful consideration in production environments.
Verified SafeView Analysis
The server is built with a strong emphasis on security. It uses pydantic's SecretStr for sensitive credentials, includes dry-run mode, module whitelisting/blacklisting, rate limiting, and comprehensive audit logging. SSL/TLS is supported for RPC communication. The default setting for `msf_ssl_verify=False` is noted as a potential risk for MITM if not explicitly set to `True` with trusted CAs, though it's typical for lab environments with self-signed certificates.
Updated: 2025-12-01GitHub→
0
0
High Cost
Gafoor2005 icon

LAM-mcp

by Gafoor2005

Sec6

Browser automation and intelligent web interaction for AI agents using a Model Context Protocol (MCP) server with session-based context analysis.

Setup Requirements

  • ⚠️Requires Python 3.10+.
  • ⚠️Requires `uv` (recommended) or `pip` for dependency management.
  • ⚠️Requires a locally installed browser (Chrome, Firefox, or Edge) for Selenium to control.
Review RequiredView Analysis
The server exposes powerful tools like `execute_javascript` and `set_cookie` which allow arbitrary code execution in the browser and cookie manipulation respectively. If the MCP client (AI agent) is compromised or misconfigured, these tools could be used for malicious purposes. The `BROWSER_DOWNLOAD_DIR` is configurable but defaults to `/tmp/downloads`, which needs careful management in a production environment to prevent uncontrolled file system writes. While the server itself doesn't contain obvious hardcoded secrets or malicious patterns, the inherent capabilities provided require the calling agent and the execution environment to be highly secure and sandboxed.
Updated: 2025-12-31GitHub→
0
0
Medium Cost
Nabin68 icon
Sec5

Demonstrates building a conversational AI agent using LangGraph that integrates external Model Context Protocol (MCP) servers for specialized functionalities like expense tracking and arithmetic calculations, featuring multi-turn conversations and persistent memory.

Setup Requirements

  • ⚠️Requires Cohere API Key (Paid) for the ChatCohere LLM.
  • ⚠️The Alpha Vantage API key is hardcoded in the source code; it should be moved to an environment variable for security.
  • ⚠️Relies on local Python processes for MCP servers (calculator_mcp_server.py and expenses_tracker_MCP_server.py), which are automatically launched by the LangGraph backend.
Verified SafeView Analysis
The `get_stock_price` tool within `langgraph_mcp_backend.py` contains a hardcoded Alpha Vantage API key (`apikey=19W1GEHJXPPUTKR2`). This is a critical security vulnerability as it exposes a sensitive credential directly in the source code. For production use, this key must be moved to an environment variable. SQL queries in `expenses_tracker_MCP_server.py` use parameterized inputs, which correctly mitigates SQL injection risks. Communication with MCP servers uses standard I/O ('stdio' transport), which is generally safe for local process interaction.
Updated: 2025-12-14GitHub→
PreviousPage 310 of 760Next