Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
AhmedAbdelmaksood65 icon

MonkeyApp

by AhmedAbdelmaksood65

Sec6

An MCP server core implementation for managing player connections, world generation, chat, and game logic in a Minecraft-like environment.

Setup Requirements

  • ⚠️Requires a `config.json` file to be manually created and configured for server settings (e.g., port, max players, world name).
  • ⚠️Requires Python 3.x and dependencies listed in `requirements.txt` to be installed (`pynbt`, `pyglet`, `websockets`). The `pyglet` library may necessitate specific system-level graphics libraries (e.g., OpenGL) depending on the operating system.
Review RequiredView Analysis
The server handles external input via network packets and in-game commands. The summaries for `NetworkManager.py`, `PacketHandler.py`, and especially `CommandManager.py` do not detail input sanitization, validation, or sandboxing mechanisms. Lack of robust handling in these areas could lead to vulnerabilities like command injection or malformed packet exploits. No explicit 'eval', obfuscation, or hardcoded secrets were mentioned in the provided summary, which is a positive, but the inherent risks of a server handling untrusted external input remain significant without further detail.
Updated: 2025-11-20GitHub→
0
0
Low Cost
jurgen178 icon

esp32-mcp

by jurgen178

Sec8

Enables AI assistants to control physical hardware devices via the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires Arduino Nano ESP32 hardware.
  • ⚠️Requires Arduino IDE or PlatformIO for compilation and flashing to the ESP32 board.
  • ⚠️WiFi network name and password must be configured in `arduino_secrets.h`.
Verified SafeView Analysis
The server runs on an embedded device (ESP32) and exposes HTTP endpoints (/mcp and /sse) over WiFi, which is standard for IoT but implies network accessibility. WiFi credentials (`SECRET_SSID`, `SECRET_PASS`) are defined directly in `arduino_secrets.h`, which is a common practice for Arduino projects but requires careful handling to prevent exposure if the file is shared or committed to public repositories. The project claims 'memory-safe execution' and uses standard protocols (JSON-RPC 2.0, MCP). No 'eval' or malicious patterns are evident in the provided code snippets.
Updated: 2025-12-16GitHub→
0
0
Low Cost
stigenai icon

mcp-servers

by stigenai

Sec9

This repository provides standardized Docker images for various Model Context Protocol (MCP) servers, enabling their seamless deployment on orchestrator platforms like Stigen.io.

Setup Requirements

  • ⚠️Docker must be installed and running
Verified SafeView Analysis
The repository demonstrates a strong commitment to security, as evidenced by the `SECURITY.md` file which outlines best practices such as non-root execution, minimal base images, automated vulnerability scanning (Trivy), and regular dependency updates (Dependabot). No 'eval', obfuscation, hardcoded secrets, or overtly malicious patterns were found in the provided code snippets. Environment variables are used for configuration, and server images are tagged with specific versions and Git commits for traceability. The primary inherent risk comes from the capabilities of certain servers (e.g., Playwright's browser automation) if misused by the end-user or deployed without proper network policies, which the `SECURITY.md` also advises against.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
CyprianFusi icon
Sec8

Provides intelligent research data management using vector embeddings and semantic search via a Model Context Protocol (MCP) server.

Setup Requirements

  • ⚠️Requires `OPENAI_API_KEY` (paid API usage for embeddings).
  • ⚠️Requires Python 3.13 or higher.
  • ⚠️Requires `RESEARCH_DB_PATH` environment variable for local ChromaDB storage.
Verified SafeView Analysis
The server requires `RESEARCH_DB_PATH` to be configured as an environment variable. If an attacker can control this variable, they could potentially direct the server to write or delete files in arbitrary locations outside the intended database directory. However, the code itself does not contain `eval`, hardcoded secrets, or obvious direct command injection vulnerabilities. Topic names are normalized to prevent path traversal within the designated database root. Proper configuration of `RESEARCH_DB_PATH` to an isolated directory is crucial for security.
Updated: 2025-12-14GitHub→
0
0
Low Cost
PaulGG-Code icon

kali_mcp-mcp-server

by PaulGG-Code

Sec7

A Model Context Protocol (MCP) server that exposes common pentest tools as FastMCP tools for educational and internal testing purposes.

Setup Requirements

  • ⚠️Requires Docker for a reproducible environment (as implied by README)
  • ⚠️Requires S3/MinIO for artifact storage (defaults to MinIO) or a local path to be mounted/available.
  • ⚠️Default API keys and MinIO credentials are insecure and must be changed for production or any non-isolated testing environment.
Review RequiredView Analysis
The server uses `subprocess.run` with argument lists, mitigating shell injection risks. Input sanitization is mentioned and observed in command construction. However, it ships with insecure default API keys ('changeme_admin_key', 'changeme_operator_key') and MinIO credentials ('minioadmin'). The README explicitly warns against exposing the server publicly without proper network controls and advises rotating API keys. Artifacts containing sensitive information are stored and require proper retention policies. The tools themselves (nmap, sqlmap, etc.) are powerful and inherently risky if misused or pointed at unintended targets. The `binwalk_extract` and `apk_static` tools process files by path inside the container, requiring careful management of container mounts.
Updated: 2025-11-30GitHub→
0
0
Low Cost
DeepthiR2405 icon

mcp-weather-server

by DeepthiR2405

Sec4

Provides a simple FastAPI server for querying current weather information for a specified city.

Setup Requirements

  • ⚠️Requires an OpenWeatherMap API Key (free tier available, but registration is needed).
  • ⚠️The 'API_KEY' must be replaced with a valid key; it is currently hardcoded as a placeholder.
  • ⚠️Implicitly requires `uvicorn` and `requests` libraries (likely specified in a `requirements.txt` file not provided).
Verified SafeView Analysis
The OpenWeatherMap API key is hardcoded as 'YOUR_API_KEY_HERE' in `app.py`. This is a critical security vulnerability; secrets should always be stored in environment variables, not directly in the source code.
Updated: 2025-12-03GitHub→
0
0
Medium Cost
CWACoderWithAttitude icon

rmv-mcp-server

by CWACoderWithAttitude

Sec9

An MCP (Model Context Protocol) server connecting LLMs to Germany's RMV public transport data (stations, connections, departures) via its API for natural language queries.

Setup Requirements

  • ⚠️Requires Python 3.13+
  • ⚠️Requires UV 0.8.13+ (package installer)
  • ⚠️Requires a free RMV API Key from the RMV Open Data Portal
Verified SafeView Analysis
The server uses `os.getenv` for API key retrieval, preventing hardcoding. External API calls are made using `httpx` with basic error handling. No `eval` or `exec` calls were found. User inputs are passed as parameters to the external RMV API, which is a standard practice and generally safe, as the RMV API itself would be responsible for parsing its parameters securely.
Updated: 2025-12-11GitHub→
0
0
High Cost
yixianfan icon

mcp-geo-database

by yixianfan

Sec8

Accessing NCBI Gene Expression Omnibus (GEO) database for searching, downloading, parsing, and analyzing gene expression and genomics data.

Setup Requirements

  • ⚠️Requires Python 3.10+.
  • ⚠️Requires installation of several Python packages: 'mcp', 'GEOparse', 'biopython', 'pandas', 'scipy'.
  • ⚠️The NCBI Entrez.email is hardcoded within the `geo_server.py` and `geo_database_server.py` files. While functional, it's generally better practice to make this configurable.
Verified SafeView Analysis
The server primarily interacts with external NCBI services (Entrez E-utilities, FTP) for data. File system operations for downloading are constrained to a user-defined or default directory ('./data') using `os.makedirs(destdir, exist_ok=True)` and `os.path.join` to prevent path traversal. The `parse_soft_file` function reads the content of a specified file, which could potentially expose local files if the `filepath` argument is maliciously crafted to point outside the intended data directory. However, it only reads and prints content, not executes it. There is no usage of `eval`, `exec`, or direct shell command execution. The `Entrez.email` is hardcoded, which is a minor configuration concern but not a direct security vulnerability.
Updated: 2026-01-17GitHub→
0
0
Low Cost
pks1116 icon
Sec9

Provides a Micro-Copilot (MCP) server for accessing Chess.com public player profiles and statistics.

Setup Requirements

  • ⚠️Requires Python 3.11 or newer.
  • ⚠️Relies on `uvx` (part of the `uv` package manager) for installation and execution, meaning `uv` needs to be installed first (e.g., `pip install uv`).
Verified SafeView Analysis
The server utilizes the `requests` library to interact with a public, unauthenticated Chess.com API. It correctly uses `response.raise_for_status()` to handle HTTP errors. There are no indications of malicious patterns, `eval` usage, code obfuscation, or hardcoded sensitive secrets within the provided source. The included `User-Agent` is standard. The primary security consideration is the reliability of the external Chess.com API itself.
Updated: 2025-11-26GitHub→
0
0
Low Cost
joelverhagen icon
Sec7

Demonstrates and provides a template for creating Model Context Protocol (MCP) servers using C# and NuGet packages, specifically showcasing a simple tool for generating random numbers.

Setup Requirements

  • ⚠️Requires installation of a compatible .NET SDK (specifically a prerelease version, '10.0.100-rc.2.25502.107' as per global.json, or a newer compatible version).
  • ⚠️Requires VS Code with Copilot Chat enabled for the described integration.
Verified SafeView Analysis
Actual server logic (C# source code) is not provided, limiting a full security audit of the implementation. Based on the provided `global.json` and `README.md` (which covers configuration and setup), no 'eval', obfuscation, hardcoded secrets, or direct network risks (beyond standard stdio communication) are apparent in the configuration or setup instructions. The `WEATHER_CHOICES` environment variable is shown in configuration examples, but its usage and validation within the unseen server logic are unknown.
Updated: 2025-12-19GitHub→
0
0
Medium Cost
Sec8

Automates fetching GitLab issues, generating summaries and solution suggestions with AI, and saving the analysis to Notion.

Setup Requirements

  • ⚠️Requires a GitLab Personal Access Token with at least `read_api` scope.
  • ⚠️Requires a Notion Integration Key and a specific Notion parent page ID.
  • ⚠️The MCP server command in Cursor/Claude needs to be configured with the correct absolute path to the cloned repository (`/path/to/gitLab-issue-analyzer`).
Verified SafeView Analysis
The server interacts with GitLab and Notion APIs, requiring API tokens. While the README specifies 'read_api' scope for GitLab (lower risk), the overall security relies on securely managing these tokens (e.g., via .env file as instructed) and assuming no malicious code within 'gitlab_integration.py' or 'main.py'. A full code audit is necessary for a definitive security assessment, but the described functionality is not inherently risky.
Updated: 2025-11-17GitHub→
0
0
Low Cost
TakuyaSuenaga icon

claude-mcp-server

by TakuyaSuenaga

Sec9

A sample MCP server demonstrating tools for echoing text and listing AWS S3 buckets, integrated with Claude Code CLI and GitHub Actions.

Setup Requirements

  • ⚠️Requires an Anthropic API Key (Paid).
  • ⚠️Complex AWS IAM and OIDC configuration for GitHub Actions.
  • ⚠️Requires `uv` and `mcp` CLI for local development.
Verified SafeView Analysis
The project demonstrates good security practices by leveraging GitHub Actions OIDC for AWS authentication, avoiding hardcoded secrets, and explicitly stating API keys should be stored as GitHub Secrets. The tools are simple (echo, S3 list buckets) and do not suggest inherent vulnerabilities. A full code review of `server.py` would confirm, but based on provided information, it's robust.
Updated: 2025-11-23GitHub→
PreviousPage 319 of 760Next