Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
seo-jinseok icon

korean-law-mcp

by seo-jinseok

Sec9

Provides a comprehensive toolset for searching, retrieving, and analyzing Korean legal information from the National Law Information Center (law.go.kr).

Setup Requirements

  • ⚠️Requires a free API ID from law.go.kr (National Law Information Center) to be set as OPEN_LAW_ID.
  • ⚠️Requires an active internet connection to communicate with the law.go.kr Open API.
  • ⚠️Requires Python 3.10 or higher.
Verified SafeView Analysis
The server uses standard `requests` and `xmltodict` libraries for API communication and XML parsing. It correctly loads the `OPEN_LAW_ID` from environment variables, preventing hardcoding of secrets. No `eval` or `exec` functions are used in the core server logic. Development scripts use `subprocess.run` but are not part of the deployed server.
Updated: 2025-12-26GitHub→
0
0
Medium Cost
gauravkheterpal icon

copado_mcp

by gauravkheterpal

Sec9

Exposes Copado DevOps capabilities to LLMs for managing user stories, promotions, and deployments.

Setup Requirements

  • ⚠️Requires a Salesforce instance with Copado installed for real API mode.
  • ⚠️Requires Salesforce access token and instance URL for real API mode, provided via environment variables (SALESFORCE_INSTANCE_URL, SALESFORCE_ACCESS_TOKEN).
  • ⚠️Requires the Python 'requests' library for interacting with the Salesforce API.
Verified SafeView Analysis
The server uses environment variables for Salesforce API credentials, which is a secure practice. It runs over stdio, limiting direct network exposure. Reliance on Salesforce REST API security and permissions is external to this server's code but critical for overall security. No 'eval' or obvious malicious patterns found.
Updated: 2025-11-26GitHub→
0
0
Medium Cost
arielolin icon

apiiro-mongo-mcp

by arielolin

Sec3

This MCP server allows users to query and manage MongoDB deployments running in Kubernetes, handling gcloud authentication, permission escalation, and Kubernetes context/namespace selection.

Setup Requirements

  • ⚠️Requires `kubectl` and `gcloud` CLIs to be pre-installed and configured with appropriate access to Kubernetes clusters.
  • ⚠️Requires a MongoDB deployment named `lim-mongo` to exist in the target Kubernetes namespace.
  • ⚠️Requires manual initial `gcloud auth login` and `gcloud container clusters get-credentials` to set up Kubernetes contexts for GKE, as detailed in the README.
Review RequiredView Analysis
The server uses `child_process.exec` to run `kubectl` and `gcloud` commands. It constructs shell commands by interpolating user-provided values for Kubernetes context, namespace, MongoDB credentials (`mongoAuth`), and MongoDB queries (`query`/`expression`). Although there's an attempt to escape double quotes and dollar signs in the MongoDB query, this is insufficient for comprehensive shell injection prevention. Specifically, user-provided `context` and `namespace` are not escaped when used in `kubectl` commands, and user-provided `mongoAuth` (username/password) are interpolated into `mongosh` command-line arguments using simple double quotes, which are vulnerable if the credentials themselves contain malicious characters (e.g., `"$(evil_command)"`). This allows for potential arbitrary command execution on the host where the MCP server runs, or within the target MongoDB pod.
Updated: 2025-11-26GitHub→
0
0
Medium Cost
jhonny028966 icon

pg-aiguide

by jhonny028966

Sec9

An MCP server and Claude plugin designed to enhance AI coding tools by providing specialized PostgreSQL and TimescaleDB documentation, semantic search capabilities, and curated best practice skills.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid)
  • ⚠️Requires PostgreSQL database with `pgvector` extension enabled
  • ⚠️Local documentation ingestion (optional) requires Docbook Toolsets and `uv` (Python package manager)
Verified SafeView Analysis
The server employs standard security practices such as loading sensitive database credentials and API keys from environment variables, preventing hardcoding. SQL queries are parameterized to mitigate SQL injection risks. There is no usage of 'eval' or other obfuscation techniques. Network interactions are primarily with a PostgreSQL database and OpenAI for embedding generation, which are standard for its functionality. Overall, the codebase appears robust regarding common web application security concerns.
Updated: 2026-01-19GitHub→
0
0
Medium Cost

MCP-Server

by skytronex

Sec1

Provides a standardized interface for connecting AI applications with external tools and data, facilitating AI prompt engineering and a development approach called 'vibe coding'.

Setup Requirements

  • ⚠️Requires access to an external AI model API (e.g., OpenAI, Anthropic) or a locally running LLM.
Review RequiredView Analysis
Insufficient source code provided for a meaningful security audit. Only README and LICENSE files were available; no executable code was present to analyze for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns. Cannot confirm safety.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
mikesmallhelp icon

chatbot-and-mcp-servers

by mikesmallhelp

Sec6

A chatbot application that integrates with Model Context Protocol (MCP) servers, allowing AI assistants to use external tools for task execution and augmented capabilities.

Setup Requirements

  • ⚠️Requires `AI_GATEWAY_API_KEY` for Vercel AI Gateway, which is typically a paid service.
  • ⚠️External MCP servers (e.g., Playwright, Filesystem) must be installed and properly configured in `chatbot-and-mcp-servers-config.json`. The example `/path/to/folder` for the `filesystem` server needs to be replaced with a valid local directory.
  • ⚠️The `AI_GATEWAY_MODEL` environment variable must be set to a valid model identifier compatible with Vercel AI Gateway.
Verified SafeView Analysis
The application spawns external processes via `StdioClientTransport` by executing commands defined in `chatbot-and-mcp-servers-config.json`. While these commands are configured by the developer and not directly from user input in the chat, a compromised configuration file could lead to arbitrary command execution on the host system. Environment variables from `process.env` are merged with `serverConfig.env`, which could expose sensitive data if `serverConfig.env` is not carefully managed. No 'eval' or obvious obfuscation found. Hardcoded secrets are avoided by using environment variables.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
kukapay icon
Sec10

Access aggregated crypto news, market insights, and sentiment analysis.

Setup Requirements

  • ⚠️Requires a client (e.g., Claude Desktop, Cursor, Windsurf) that supports the MCP specification and `streamable_http` transport.
Verified SafeView Analysis
The provided source code is only a README.md file, describing how to connect to a publicly hosted server. There is no executable code in this repository to audit for local security risks, 'eval', obfuscation, hardcoded secrets, or malicious patterns. Security concerns would be related to the remote server itself, which is outside the scope of analyzing this repository's source code.
Updated: 2025-11-29GitHub→
0
0
Low Cost
glandua icon

regen-mcps

by glandua

Sec8

Centralized management and configuration of Regen Network Model Context Protocol (MCP) servers for integration with Claude Code.

Setup Requirements

  • ⚠️Requires Node.js and npm
  • ⚠️Requires `uv` Python dependency manager
  • ⚠️Relies on Git submodules
Verified SafeView Analysis
The `update-mcps.sh` script executes standard `git pull`, `npm install`, `npm run build`, and `uv sync` commands. It does not contain 'eval', obfuscation, or hardcoded secrets. The primary security consideration is the implicit trust in the external submodule repositories (regen-network/mcp, gaiaaiagent/regen-koi-mcp, gaiaaiagent/regen-python-mcp) which are fetched and built. No direct vulnerabilities in this project's own logic are identified from the provided source.
Updated: 2025-12-10GitHub→
0
0
Medium Cost
YuweiXiao icon
Sec8

Integrates Zed's Model Context Protocol with RelytONE's MCP server, providing AI-powered coding assistance by sending code context to RelytONE.

Setup Requirements

  • ⚠️Requires a RelytONE bearer token, obtained from relytone.data.cloud.
  • ⚠️Requires Node.js to be installed on the system for the underlying MCP server.
Verified SafeView Analysis
The extension uses standard Zed API calls for package management (npm_install_package) and executing Node.js processes. The RelytONE bearer token is securely passed as an environment variable (RELYTONE_BEARER_TOKEN) to the child process, avoiding hardcoding or command-line exposure. The primary security consideration is the trust in the `@relyt/mcp-server-relytone` npm package itself, as the extension automatically installs and updates it to the latest version. No 'eval' or obvious obfuscation was found.
Updated: 2025-11-20GitHub→
0
0
Low Cost
sohaib-sharih icon

github_mcp_server_text

by sohaib-sharih

Sec10

This project modifies a CSV file to update the 'Sale price' column to a fixed value.

Setup Requirements

  • ⚠️Requires 'pandas' library to be installed (e.g., `pip install pandas`).
  • ⚠️The input file 'white heaven.csv' must exist in the same directory as the script.
Verified SafeView Analysis
The script is simple, uses the well-known Pandas library for local file operations, and does not contain 'eval', obfuscation, network calls, or hardcoded secrets. It performs no malicious patterns.
Updated: 2026-01-19GitHub→
0
0
Low Cost
suissa icon
Sec9

Acts as a Model Context Protocol (MCP) server enabling AI models to interact with the Magalu Marketplace API for managing products, orders, customer service, questions, and chat.

Setup Requirements

  • ⚠️Requires a Magalu Marketplace Seller Account with an API Key and Seller ID.
  • ⚠️Requires Node.js (version 18 or higher, as implied by @modelcontextprotocol/sdk dependency requirements).
Verified SafeView Analysis
The server correctly uses environment variables for sensitive API keys (MAGALU_API_KEY, MAGALU_SELLER_ID), preventing hardcoded secrets. It implements semantic types (e.g., MagaluSkuId, MagaluPage) with basic validation (length, regex, range) for many inputs, enhancing data integrity. There is no usage of 'eval' or obvious obfuscation. Network calls are made to defined Magalu API endpoints. A minor area for potential improvement could be more explicit and comprehensive JSON schema validation for complex input objects (e.g., 'sku', 'price', 'delivery' objects) within the MCP tool definitions or the MagaluClient, beyond basic type checks, to ensure all fields conform to expected structures before forwarding to the external API.
Updated: 2025-11-25GitHub→
0
0
Medium Cost
9Mercury icon
Sec9

Automated discovery and data extraction of LinkedIn profiles for purposes such as recruitment, lead generation, market research, and competitive intelligence.

Setup Requirements

  • ⚠️Requires RapidAPI Account and API Key (paid for higher usage tiers)
  • ⚠️Requires Serper API Key (paid for higher usage tiers, free tier has limits)
  • ⚠️Python 3.8 or higher is required
Verified SafeView Analysis
API keys (RapidAPI and Serper) are correctly loaded from environment variables using `python-dotenv`, preventing hardcoding and enhancing security. The system utilizes `httpx` for external API calls with timeouts, contributing to network stability. No direct use of `eval` or `exec`, and no malicious code patterns were identified. The primary security and legal considerations revolve around the ethical use of scraped data and adherence to LinkedIn's Terms of Service and data protection regulations, which the README extensively addresses.
Updated: 2025-12-02GitHub→
PreviousPage 322 of 760Next