Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
rustomjdee icon
Sec7

To deploy a scalable and monitored personal website using AWS services and Infrastructure as Code (Terraform).

Setup Requirements

  • ⚠️Requires an AWS Account (paid services likely involved)
  • ⚠️Requires Terraform CLI to manage infrastructure
  • ⚠️Requires integration with PagerDuty, Slack, and Jira accounts
Review RequiredView Analysis
The provided 'SOURCE CODE' is limited to the `README.md` file. A comprehensive security audit for an MCP server would require access to the actual application code and infrastructure-as-code (Terraform files). Based solely on the README, no direct executable security risks (like 'eval', obfuscation, or malicious patterns) can be identified within the document itself. However, the README mentions external services (PagerDuty, Slack, Jira) which imply potential for credential management issues in the actual project implementation.
Updated: 2025-11-25GitHub→
0
0
High Cost
KNU-team-kim icon
Sec8

The server acts as a Multi-Channel Platform (MCP) server for a barrier-free kiosk, facilitating civic services such as move-in registration and resident registration document issuance through an AI-guided conversational flow.

Setup Requirements

  • ⚠️Requires a paid OpenAI API Key.
  • ⚠️Requires the `uv` tool for dependency management and execution.
  • ⚠️Requires Python 3.10 or newer.
  • ⚠️Depends on an external Kiosk application backend available at `KIOSK_APP_URL`.
Verified SafeView Analysis
Environment variables are correctly used for API keys and external service URLs, avoiding hardcoded secrets. No 'eval' or obvious obfuscation techniques are present. The system's overall security heavily depends on the trustworthiness and security of the `KIOSK_APP_URL` and `OPENAI_API_URL` endpoints it interacts with.
Updated: 2025-11-29GitHub→
0
0
Low Cost
Nicolas-Gong icon

redis-crud-mcp-server

by Nicolas-Gong

Sec9

This MCP server provides comprehensive CRUD (Create, Read, Update, Delete) operations for a Redis database.

Setup Requirements

  • ⚠️Requires an accessible Redis server instance.
  • ⚠️REDIS_PASSWORD environment variable is mandatory for server startup.
  • ⚠️Manual configuration in `cline_mcp_settings.json` is needed, including the absolute path to the built server file.
Verified SafeView Analysis
The server correctly retrieves Redis connection credentials (host, port, password) from environment variables, avoiding hardcoded secrets in the main application logic. It uses the standard 'redis' client library for operations, which handles data serialization and command execution securely. Input validation in `validateRedisArgs` checks parameter types, and while it doesn't perform deep content validation for malicious strings, Redis commands themselves typically treat values as literals, mitigating common injection risks. The `test.js` file, however, hardcodes a Redis password ('123456') for its internal testing purposes, which is a minor oversight in a test script.
Updated: 2025-12-11GitHub→
0
0
High Cost
VMRam95 icon

mcp-video

by VMRam95

Sec7

Enables LLMs to analyze video content by extracting frames as images and, in the future, transcribing audio to text.

Setup Requirements

  • ⚠️Requires Node.js >= 18 to be installed.
  • ⚠️Requires `ffmpeg` and `ffprobe` to be installed system-wide and accessible in PATH.
  • ⚠️Requires manual configuration in Claude Code's MCP settings file (`~/.claude/mcp_servers/mcp-video.json`) with the correct path to the compiled `index.js` file.
Verified SafeView Analysis
The server relies heavily on `ffmpeg` and `ffprobe` binaries, invoked via `child_process.spawn`. While path validation (`normalizePath`, `validateVideoPath`) is implemented to mitigate directory traversal in tool inputs, the inherent risk of spawning external processes exists. The web server's file upload (`src/web/server.ts`, `parseMultipart`) lacks explicit size limits, posing a potential denial-of-service vulnerability by allowing large file uploads to fill disk space. No apparent hardcoded secrets or obfuscation were found. The `OPENAI_API_KEY` is expected to be an environment variable for future transcription features.
Updated: 2025-12-03GitHub→
0
0
Medium Cost
dgilperez icon

mcp-toggle

by dgilperez

Sec8

Manages, discovers, and toggles Model Context Protocol (MCP) servers to enhance performance and configurability for AI development tools like Claude.

Setup Requirements

  • ⚠️Requires Node.js and npm for installation and managing MCP server packages.
  • ⚠️Requires `jq` for JSON processing, which is critical for configuration management and cache generation.
  • ⚠️Requires `envsubst` for multi-editor configuration synchronization, especially for variable substitution in config files.
  • ⚠️Most useful MCP servers require specific API keys (e.g., `BRAVE_API_KEY`, `GH_TOKEN`) to be set as environment variables in the user's shell configuration (e.g., `~/.zshrc`).
Verified SafeView Analysis
The project uses shell scripts which inherently carry some risk if inputs are untrusted. Specifically, `mcp-auto-update.sh` uses `source` to load an internal update file (`~/.cache/mcp/.mcp-update`). While the script controls the content of this file, the `EXIT_STATUS` variable within that file is not quoted during writing, creating a theoretical, albeit low, risk of command injection if external input could manipulate the exit status of the `update.sh` script in a malicious way. However, the project explicitly follows good security practices by warning against hardcoding secrets, using environment variables for sensitive data, and leveraging `jq` for robust JSON parsing, which mitigates many common shell script vulnerabilities. A security audit is also mentioned in the README.
Updated: 2025-12-24GitHub→
0
0
Medium Cost
Use-Tusk icon

drift-mcp

by Use-Tusk

Sec9

This MCP server enables AI assistants to search, analyze, and debug API traffic data captured by Tusk Drift, including HTTP requests, database queries, and distributed traces.

Setup Requirements

  • ⚠️Requires TUSK_API_KEY environment variable to be set.
  • ⚠️Node.js version 22 or higher is required.
  • ⚠️If multiple Tusk services are discovered in the workspace or default is not set, `observableServiceId` must be specified in tool calls to prevent ambiguity.
Verified SafeView Analysis
The server uses Zod for robust input validation on all tool arguments, significantly reducing injection risks. API keys are handled via environment variables, which is a good practice. Network communication is explicitly to the Tusk Drift API over HTTPS. File system interaction is limited to discovering `.tusk/config.yaml` files within specified or current directories, using safe parsing via regex rather than a full YAML parser, and resolving paths with `fs.realpathSync`. No 'eval' or direct shell execution of user-controlled input is observed. The HTTP transport relies on the `@modelcontextprotocol/sdk` which is assumed to be secure.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
HypaSMarty icon

SUMO-MCP-Server

by HypaSMarty

Sec7

Middleware to connect Large Language Models (LLMs) with Eclipse SUMO traffic simulations, enabling AI agents to automate traffic simulation workflows.

Setup Requirements

  • ⚠️Requires SUMO (Simulation of Urban MObility) to be installed and its binaries (`sumo`, `netgenerate`, etc.) accessible via PATH or `SUMO_HOME` environment variable.
  • ⚠️Requires Python dependencies (`mcp`, `sumolib`, `traci`, `sumo-rl`, `pandas`, `requests`) to be installed in the Python environment used to run the server.
  • ⚠️Internet connection is required for features like downloading OpenStreetMap data via `osmGet.py`.
Verified SafeView Analysis
The server design involves executing external SUMO command-line tools via `subprocess.run`. Parameters like `options` are directly passed from the LLM invocation to these underlying tools without explicit sanitization by the server. This introduces a potential command injection risk if the calling AI agent or its inputs are untrusted. However, the server does not contain hardcoded secrets or 'eval' statements and implements measures like `subprocess.DEVNULL` for stdout to protect the MCP protocol. File operations are generally limited to specified output directories.
Updated: 2026-01-19GitHub→
0
0
Medium Cost

mcp-server

by prosaichq

Sec8

Enables AI assistants like Claude Desktop and Perplexity AI to interact with a user's Prosaic account through a local Model Context Protocol (MCP) server, translating natural language requests into Prosaic API calls.

Setup Requirements

  • ⚠️Requires a Prosaic API key from beta.prosaic.works, implying an account and potential associated costs/terms with the Prosaic API.
  • ⚠️Manual configuration of AI client JSON files with absolute paths to the Python interpreter and server script is required and prone to user error.
  • ⚠️Strict Python version requirement of 3.10+ (3.12 recommended).
Verified SafeView Analysis
The server runs locally and uses an API key via environment variables, which is generally good practice. The primary security considerations involve safeguarding the sensitive 'PROSAIC_API_KEY' and trusting the 'server.py' implementation from the official repository, which dynamically converts a remote OpenAPI spec into MCP tools. There is no indication of 'eval' or obfuscation from the provided README. Network risks are confined to local server-to-AI client and local server-to-Prosaic API communication.
Updated: 2025-11-18GitHub→
0
0
Low Cost

typescript-image

by transform-ia

Sec5

A Dockerized TypeScript application or base image for a server component, likely part of a larger system.

Setup Requirements

  • ⚠️Docker required
Review RequiredView Analysis
Cannot perform a detailed security audit as no code content (beyond filenames) or `Dockerfile` content was provided. Assessed based solely on filenames. The presence of a `Dockerfile` implies potential risks from container configuration (e.g., running as root, exposed sensitive ports, unpatched base images) which could not be evaluated.
Updated: 2025-11-18GitHub→
0
0
Low Cost
abinasha123 icon
Sec9

Manages and tracks personal or business expenses via an API, including adding, listing, and summarizing entries.

Setup Requirements

  • ⚠️Requires Python 3.14 or higher (unreleased at time of analysis), which may make it difficult to run currently.
  • ⚠️All expense data is stored in a temporary SQLite database (expenses.db) within the system's temporary directory. This means data will be lost upon server restart or system cleanup.
Verified SafeView Analysis
The server uses parameterized SQL queries, which effectively prevents SQL injection vulnerabilities. No 'eval' or other dynamic code execution is present. The database is stored in a temporary directory, which enhances isolation for each run but means data is not persistent. Error messages could be more generic for public APIs but are acceptable for internal or agent-based use cases.
Updated: 2025-11-20GitHub→
0
0
Low Cost

grokipedia

by benoute

Sec5

A Go-based server likely designed for managing and serving information, functioning as a knowledge base or data API, given its name 'grokipedia'.

Setup Requirements

  • ⚠️Requires Go runtime (version specified in go.mod)
  • ⚠️Requires 'make' utility for build/run automation
Review RequiredView Analysis
Cannot perform a detailed security audit without access to the source code. General network risks exist as it's a server application. No 'eval' or obfuscation can be confirmed or denied without code inspection.
Updated: 2025-11-18GitHub→
0
0
Medium Cost
mcuellar icon

tuneit-mcp

by mcuellar

Sec8

Automate resume tailoring and job description formatting using AI-powered tools.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid Service)
  • ⚠️Requires Python 3.10 or higher
  • ⚠️The 'save_tailored_resume_as_pdf' tool requires the 'pandoc' executable to be installed on the system (in addition to the 'pypandoc' Python library).
Verified SafeView Analysis
The server loads OpenAI API key from environment variables, preventing hardcoded secrets. Filename sanitization is implemented to mitigate directory traversal risks for saved files. The output directories are fixed relative to `OUTPUT_DIR`. The `save_tailored_resume_as_pdf` function uses `pypandoc`, which relies on an external `pandoc` executable. While `pypandoc` is designed for safe usage, any external process invocation introduces a dependency on the security of that external tool and the system environment, though the arguments passed are static and content is AI-generated, reducing direct injection risk. No 'eval' or direct shell command execution from user input is observed.
Updated: 2025-12-08GitHub→
PreviousPage 326 of 760Next