Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
danngalann icon

zoho-sprints-mcp

by danngalann

Sec9

Provides programmatic access to Zoho Sprints project management functionality, enabling automation via integration tools like Claude.

Setup Requirements

  • ⚠️Requires Python 3.12+.
  • ⚠️Requires a Zoho Sprints account with API access and Zoho OAuth credentials.
  • ⚠️Initial Zoho OAuth refresh token setup is a multi-step manual process involving a browser interaction and copying/pasting URLs.
  • ⚠️The `ZOHO_TEAM_ID` environment variable is practically required for most API operations, despite being listed as optional in documentation.
Verified SafeView Analysis
The project uses Pydantic for environment variable management, ensuring credentials are loaded from a .env file and not hardcoded. OAuth 2.0 with automatic token refresh is implemented securely. The `get_refresh_token.py` script guides a manual but standard OAuth flow. No 'eval', 'exec', or direct `subprocess` calls were found. The server binds to '0.0.0.0' which is standard but requires proper firewalling if exposed externally.
Updated: 2025-12-02GitHub→
0
0
Low Cost
areeba-awan icon

mcp-server-prac

by areeba-awan

Sec1

A practice server designed for learning or developing applications that interact with the Minecraft Protocol.

Setup Requirements

  • ⚠️Requires Java Runtime Environment (JRE)
  • ⚠️May require specific Minecraft client version to connect
Review RequiredView Analysis
No source code was provided for analysis. Therefore, a comprehensive security audit is impossible. Without visibility into the codebase, potential risks such as 'eval' usage, obfuscation, network vulnerabilities, hardcoded secrets, or malicious patterns cannot be identified. Defaulting to the lowest score due to critical lack of information.
Updated: 2025-12-03GitHub→
0
0
Medium Cost
pjordan icon

claude-toolkit

by pjordan

Sec6

Enables AI agents to interact with and query various databases by exposing database operations as tools.

Setup Requirements

  • ⚠️Requires database connection details (e.g., `DB_HOST`, `DB_PORT`, `DB_USER`, `DB_PASSWORD`, `DB_NAME`), typically provided via environment variables.
  • ⚠️A functional database server (e.g., PostgreSQL, MySQL) must be accessible from the server's environment.
  • ⚠️Requires Python 3.10+ and specific Python libraries for database connectivity (e.g., `psycopg2`, `SQLAlchemy`), which need to be installed via `pip install -r requirements.txt`.
Review RequiredView Analysis
The database-connector MCP server inherently carries significant security risks due to its direct interaction with a critical resource. Without access to the specific `list_tools` and `call_tool` implementations, a full security audit is impossible. Primary concerns include SQL injection vulnerabilities if AI-provided input is not rigorously validated and sanitized, unauthorized data access or modification if permissions are not strictly enforced, and potential for data exfiltration. While the project's validation scripts check for dangerous patterns like `eval` and hardcoded secrets, the robustness of runtime input validation and least-privilege enforcement in the actual tool functions is unknown. Therefore, robust implementation of database interaction logic and strong access controls are critical.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
mobatusi icon
Sec3

This server facilitates agentic workflows using CrewAI and GitHub tools, likely for automating tasks or interactions within a GitHub repository.

Setup Requirements

  • ⚠️Requires an LLM API Key (e.g., OPENAI_API_KEY) which may incur costs.
  • ⚠️Requires a GitHub Personal Access Token (GITHUB_TOKEN) with appropriate permissions.
  • ⚠️Python environment setup and dependency management (e.g., using pip or poetry) will be necessary.
Review RequiredView Analysis
A comprehensive security audit cannot be performed as no source code was provided. However, any server interacting with GitHub and potentially LLM APIs requires careful attention to secure API key management, input validation to prevent injection attacks (especially in agentic contexts), and robust authentication/authorization. Without source code, it's impossible to verify the absence of 'eval', hardcoded secrets, or malicious patterns. General risks for a server application include network vulnerabilities, unhandled exceptions, and dependency vulnerabilities.
Updated: 2026-01-16GitHub→
0
0
Low Cost
az9713 icon

ACI

by az9713

Sec6

A headless MCP (Model Context Protocol) server that enables AI agents like Claude to read, write, and reason over a knowledge graph of scientific propositions.

Setup Requirements

  • ⚠️Requires Python 3.10 or higher.
  • ⚠️Requires 'uv' (Python package manager).
  • ⚠️Requires an OpenAI API Key (Paid service, usage costs apply).
  • ⚠️Requires Claude Code or Claude Desktop for interaction.
Verified SafeView Analysis
The system explicitly states 'No authentication - Designed for local/personal use'. This means anyone with local access can perform all operations, including deletion. There is a potential for injection vulnerabilities in LanceDB's `where` and `delete` clauses (e.g., `table.search().where(f"id = '{unit_id}'")`) if `unit_id` can be controlled by a malicious input and is not strictly validated (e.g., as a UUID format). While `unit_id` is often internally generated, the `get_unit` and `delete_unit` tools accept arbitrary strings as `unit_id` without explicit UUID format validation before constructing the f-string query. This could be exploited by a sophisticated or compromised agent. The `delete_unit` tool has a `confirm` flag, but a malicious agent could bypass this by providing `confirm=True`.
Updated: 2026-01-17GitHub→
0
0
Medium Cost
nohuiam icon

tenets-server

by nohuiam

Sec8

Ethical decision evaluation and remediation guidance against 25 Gospel tenets for cognitive systems.

Setup Requirements

  • ⚠️The `TENETS_API_KEY` environment variable MUST be set in production to enable HTTP API authentication, otherwise, it is disabled.
  • ⚠️For persistent storage, the `TENETS_DB_PATH` environment variable needs to be set to a file path, as it defaults to an in-memory SQLite database.
  • ⚠️`better-sqlite3` is a native Node.js module that might require system-level build tools (e.g., node-gyp, C++ compiler, Python) to compile if prebuilt binaries are unavailable or incompatible with the deployment environment.
Verified SafeView Analysis
HTTP API (Port 8027) uses `Access-Control-Allow-Origin: '*'`, which is a security risk in production; it should be restricted. HTTP API authentication is optional by default if `TENETS_API_KEY` is not set, creating a vulnerability if deployed without configuration. However, `zod` schemas are used for robust input validation, and `better-sqlite3` uses prepared statements to prevent SQL injection. Sensitive information like file paths and stack traces are redacted from error messages before network transmission. The UDP InterLock mesh includes a robust `Tumbler` with a whitelist and circuit breaker features (hop count, TTL, deduplication) for enhanced network security and stability.
Updated: 2026-01-17GitHub→
0
0
Medium Cost
cbxss icon

findmy-mcp

by cbxss

Sec9

Fast, concurrent Model Context Protocol (MCP) server discovery and analysis tool for security research.

Setup Requirements

  • ⚠️Requires Python 3.12+.
  • ⚠️uv is recommended for dependency management.
  • ⚠️Requires a Shodan API Key (can incur costs depending on usage and subscription).
Verified SafeView Analysis
The project is explicitly designed for security research, involving network scanning and interaction with external services (Shodan API, discovered MCP servers). It uses Pydantic for robust data validation, `httpx` for secure HTTP requests with configurable SSL verification, and `asyncio` with semaphores for controlled concurrency. Shodan API keys are properly managed via environment variables or `.env` files, preventing hardcoding. File operations for saving results use `pathlib.Path` which helps mitigate simple path traversal. No `eval` or similar dangerous patterns were found. The project clearly states ethical usage guidelines. The main 'risk' is inherent to its function as a scanning tool, which is properly mitigated by design choices and ethical disclaimers.
Updated: 2025-12-01GitHub→
0
0
Low Cost
Sec6

A backend service providing an API for managing or interacting with data stored in MongoDB.

Setup Requirements

  • ⚠️Requires a running MongoDB instance accessible from the server.
  • ⚠️Install Python dependencies: `pip install -r requirements.txt` (Python 3.x required).
  • ⚠️The `run_command` assumes a standard FastAPI/Uvicorn setup where an `app` object is defined in `main.py`. If a different framework or server setup is used, the command may vary (e.g., `python main.py` for a simpler server).
Verified SafeView Analysis
No explicit security features (e.g., authentication, authorization) are evident from the file names. Potential risks include API exposure without proper access control, insecure handling of MongoDB connection credentials (if hardcoded), and typical web application vulnerabilities like injection if input is not properly sanitized. Code review is essential before deployment, especially in production environments.
Updated: 2025-11-18GitHub→
0
0
Low Cost
chrisjeane icon

Log4MCP

by chrisjeane

Sec4

A high-performance, thread-safe logging server for distributed, multi-tenant applications, and integrating logging capabilities into AI contexts using MCP over JSON-RPC 2.0.

Setup Requirements

  • ⚠️Requires Swift 6.2+
  • ⚠️Requires local clone of MCPServer repository due to local package dependency path.
  • ⚠️Full Xcode installation required for running tests on macOS, Command Line Tools are insufficient.
Verified SafeView Analysis
The server explicitly states it has no built-in authentication or authorization, binding by default to '0.0.0.0' (external-facing). It's suitable for trusted environments only. Production use requires external authentication (OAuth2, mTLS), rate limiting, input validation, and log sanitization/redaction as recommended by the developers. No 'eval' or obvious malicious patterns found, but the lack of fundamental security features makes it unsafe for untrusted networks.
Updated: 2025-11-27GitHub→
0
0
Low Cost
toomy1992 icon

wealthfolio-mcp

by toomy1992

Sec8

An MCP server that integrates with Wealthfolio to provide portfolio data, valuations, and analytics to OpenWebUI and other MCP-compatible applications.

Setup Requirements

  • ⚠️Requires a Wealthfolio API Key
  • ⚠️Requires Python 3.10+
Verified SafeView Analysis
The server uses `pydantic_settings` to load API keys and base URLs from environment variables or a `.env` file, which is a good practice for secret management. No `eval` or `exec` functions were found. The `httpx` client handles HTTP errors appropriately with `raise_for_status`. FastAPI provides a robust framework with input validation (explicitly enhanced in custom OpenAPI schema for UUID formats). Error handling uses `HTTPException` for server-side issues. The `Dockerfile` uses a minimal Python base image. The project actively documents security best practices in `AGENTS.md`. Potential improvements could include explicit server-side UUID validation beyond OpenAPI hints, and implementing authentication/rate limiting as mentioned for future enhancements, but for its current scope, it is well-secured.
Updated: 2026-01-13GitHub→
0
0
Medium Cost
PasanIS icon

mcp-server

by PasanIS

Sec8

This server acts as a Model Context Protocol (MCP) intermediary, enabling a chatbot (e.g., Claude) to interact with a Restaurant FastAPI backend for menu, order, customer, and analytics management.

Setup Requirements

  • ⚠️Requires a separate FastAPI backend server to be running and accessible.
  • ⚠️Requires Python 3.12 or newer.
  • ⚠️The BASE_URL for the FastAPI backend must be configured via a BASE_URL environment variable or by editing 'src/backend_mcp/server.py'.
Verified SafeView Analysis
The server uses httpx for making requests and pydantic-settings for configuration, allowing sensitive data like API keys to be loaded from environment variables or .env files, avoiding hardcoding. It acts as a proxy, so the ultimate security depends on the FastAPI backend it connects to. No 'eval' or other direct code execution vulnerabilities were found. Basic error handling is present for HTTP requests. Authentication details for customer/staff login are forwarded to the backend API.
Updated: 2026-01-19GitHub→
0
0
Low Cost
Ethan-sonic icon

Data-store-engine

by Ethan-sonic

Sec8

A local, embedded key-value storage solution providing efficient data storage and retrieval with features like caching, data compaction, and probabilistic data structures.

Setup Requirements

  • ⚠️Requires a Go development environment (SDK) to build and run from source.
  • ⚠️The `main.go` imports `NASP_projekat/Engine`, implying a specific Go module path or directory structure must be set up correctly (e.g., in GOPATH or using `go.mod`).
Verified SafeView Analysis
The file permissions (0777) used for creating data files (`os.OpenFile`) are very permissive. While common for local data files, it might be a concern in multi-user environments. No other obvious critical security risks like network exposure, 'eval' usage, or hardcoded credentials were found in the provided source code.
Updated: 2026-01-19GitHub→
PreviousPage 335 of 760Next