Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
High Cost
burnworks icon
Sec9

A local Model Context Protocol (MCP) server designed to assist users learning web accessibility by acting as a guide, providing curated official WCAG/W3C resources and learning paths through a chatbot interface.

Setup Requirements

  • ⚠️Requires Node.js version 20 or higher to run.
  • ⚠️Requires manual configuration within Claude Desktop's 'claude_desktop_config.json' file, specifying the full path to the compiled 'dist/index.js'.
  • ⚠️Knowledge base (topic mappings and supplements) must be maintained via local YAML and Markdown files in the 'mappings/' directory.
Verified SafeView Analysis
The server explicitly whitelists allowed URL prefixes for all external references (W3C/WAIC domains), preventing calls to untrusted external sources. It loads configuration and knowledge from local YAML and Markdown files, which is appropriate for its intended local operation. No dynamic code execution (e.g., 'eval') or hardcoded secrets were found in the provided source code. The primary security considerations revolve around ensuring the integrity of the local mapping files, which is outside the application's direct control.
Updated: 2025-11-28GitHub→
0
0
Low Cost

jaeger-mcp-chart

by transform-ia

Sec9

Deploys a server that exposes Jaeger tracing data through the Model Context Protocol (MCP) for AI assistants and other tools.

Setup Requirements

  • ⚠️Requires an existing Jaeger deployment with a Query service accessible by the MCP server.
  • ⚠️Network connectivity between the MCP server and the Jaeger Query service must be ensured, potentially requiring adjustments to network policies or service configurations.
  • ⚠️The chart deploys a Kubernetes Helm chart, requiring Helm and a Kubernetes cluster for installation.
Verified SafeView Analysis
The chart promotes security best practices by configuring containers to run as non-root users, with read-only filesystems, and dropped capabilities. Network policies are also implemented to restrict ingress and egress traffic. No obvious 'eval' or malicious patterns found. The main risk would be misconfiguration of network policies or insecure Jaeger backend.
Updated: 2025-11-22GitHub→
0
0
Medium Cost
alanflanders icon

gemini-grounded-mcp

by alanflanders

Sec9

An MCP server that provides a 'grounded_answer' tool, leveraging Google's Gemini API with Google Search grounding to answer factual questions and provide source citations.

Setup Requirements

  • ⚠️Requires GEMINI_API_KEY for Google Gemini API access (paid API usage applies).
  • ⚠️Requires Node.js (version 18.0.0 or higher is recommended by package.json dependencies).
Verified SafeView Analysis
The server demonstrates good security practices: GEMINI_API_KEY is loaded from environment variables or a .env file, preventing hardcoding. All console.log output is redirected to stderr to prevent stdout corruption, which is critical for JSON-RPC. Uncaught exceptions and unhandled promise rejections are handled and logged. Communication occurs over standard I/O (stdio), limiting network exposure to the expected Gemini API calls. No dangerous functions like 'eval' or unsanitized shell executions are present. The 'debug-server.js' included in the repo also follows similar safe practices.
Updated: 2025-12-13GitHub→
0
0
Medium Cost
caioldcarvalho icon

whmcs-mcp

by caioldcarvalho

Sec9

Integrate WHMCS API for managing clients, tickets, orders, invoices, and services via an MCP client.

Setup Requirements

  • ⚠️Requires Node.js version 18 or higher.
  • ⚠️Requires an active WHMCS instance with API access enabled, including an API Identifier, Secret, and the MCP server's IP whitelisted in WHMCS.
  • ⚠️WHMCS API credentials (WHMCS_IDENTIFIER, WHMCS_SECRET, WHMCS_API_URL) must be configured in a local .env file.
Verified SafeView Analysis
The server uses environment variables for API credentials (WHMCS_IDENTIFIER, WHMCS_SECRET, WHMCS_API_URL), preventing hardcoding. It communicates via standard I/O (StdioServerTransport), which is generally more secure for local tools than exposing network ports. Input validation is rigorously performed using Zod schemas for all tool arguments, significantly reducing the risk of injection or malformed request vulnerabilities. Error handling prevents raw stack traces from being exposed. The primary outbound network risk is inherent to Axios calls to the configured WHMCS API endpoint, which should be secured with HTTPS and IP whitelisting on the WHMCS side.
Updated: 2026-01-16GitHub→
0
0
Medium Cost
maxamillion icon

rhoai-mcp-prototype

by maxamillion

Sec8

Enables AI agents to programmatically interact with Red Hat OpenShift AI (RHOAI) environments, replicating dashboard capabilities for ML lifecycle management.

Setup Requirements

  • ⚠️Requires access to a Red Hat OpenShift AI Kubernetes cluster.
  • ⚠️Proper Kubernetes authentication (in-cluster service account, kubeconfig file, or API server URL and token) must be configured.
  • ⚠️Requires Python 3.10 or newer.
Verified SafeView Analysis
The server directly interacts with the Kubernetes API. Its security depends on the permissions of the Kubernetes service account or kubeconfig it uses. It includes safety features like explicit confirmation for 'delete' operations and a 'read-only' mode, which are good practices. No 'eval' or obvious obfuscation detected. Hardcoded secrets are not present; S3 credentials for data connections are passed to tools and stored as Kubernetes secrets. The primary risk is granting the server (and thus, an AI agent interacting with it) excessive permissions to the underlying OpenShift AI cluster.
Updated: 2026-01-19GitHub→
0
0
Medium Cost

Uniswap_Docs_MCP

by aravind33b

Sec7

Provides a ModelContextProtocol server for local semantic search and access to Uniswap v4 documentation, integrable with any LLM.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid)
  • ⚠️Mac/Linux environment recommended (potential compatibility issues on Windows)
  • ⚠️Requires Node.js >= 18 and npm >= 8
Verified SafeView Analysis
The server requires an OpenAI API key, which could incur costs if exposed or compromised. It downloads external data during setup, posing a potential risk if the source is compromised. The local API server should be secured if exposed beyond local development.
Updated: 2025-11-17GitHub→
0
0
Low Cost
BradWebb101 icon

mcp-as-a-resume

by BradWebb101

Sec4

Transforms a static resume into a living, queryable API using the Model Context Protocol (MCP) for AI agents and applications, enabling programmatic access to professional information.

Setup Requirements

  • ⚠️Requires AWS Account with configured credentials, Node.js, npm, Docker, and AWS CDK CLI.
  • ⚠️The provided CDK stack only deploys the Lambda and DynamoDB. CloudFront and Route53 (mentioned in the README as part of the architecture) are not provisioned by this stack, requiring manual setup or an external CDK stack to utilize a custom domain and add a security layer.
  • ⚠️Amazon SES sender and recipient emails must be verified in the AWS region specified (eu-west-1 in the provided code) before emails can be sent.
Verified SafeView Analysis
The Lambda Function URL is configured with 'NONE' authentication, directly exposing the Lambda endpoint to the public internet without inherent AWS IAM protection. While the README mentions CloudFront for HTTPS and global distribution, the provided AWS CDK code (`lib/resume-mcp-stack.ts`) does not provision a CloudFront distribution, implying it must be manually configured or handled by an external stack to add essential security layers (e.g., WAF, rate limiting, DDoS protection) in front of the Lambda. There is no explicit input validation (e.g., length, format) for parameters like `sender_email` or `message` in the `send_email_to_brad` function, which could lead to abuse (e.g., very large messages or malformed emails). Error responses return `str(e)`, which may leak sensitive stack trace information in case of unhandled exceptions.
Updated: 2025-11-23GitHub→
0
0
Medium Cost
onoeserika007 icon

Local-Notes-MCP-Server

by onoeserika007

Sec6

An AI-powered personal knowledge base and note management system with Obsidian integration, supporting full-text and semantic search.

Setup Requirements

  • ⚠️Requires a Tongyi Qianwen (Qwen) API Key for AI features (paid service).
  • ⚠️Requires Python 3.11+ and Node.js 18+.
  • ⚠️Frontend uses pnpm for package management, not npm.
  • ⚠️Obsidian integration requires `OBSIDIAN_VAULT_PATH` environment variable to be configured for file syncing and display.
Verified SafeView Analysis
The default `SECRET_KEY` in `backend/app/core/config.py` is a placeholder and poses a significant security risk if not changed in production. The system relies on a Qwen API Key for AI features, which must be secured. CORS settings are appropriate for local development but need careful review for production. SQL injection is mitigated by SQLAlchemy, and path traversal is handled using `pathlib` for Obsidian integration. Markdown rendering on the frontend relies on `ReactMarkdown`, which generally sanitizes against XSS, but custom rendering could introduce risks.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
nobiehl icon

codeweaver-mcp

by nobiehl

Sec6

A multi-language code intelligence system providing token-efficient analysis and refactoring capabilities via an MCP server and CLI, with features like semantic search, static analysis, symbol extraction, and Git integration.

Setup Requirements

  • ⚠️Requires Node.js 20.0.0+.
  • ⚠️Semantic search downloads a ~90MB AI embedding model on first use.
  • ⚠️Python analysis features require Python 3.8+ to be installed locally.
  • ⚠️Static analysis tools (SpotBugs, Checkstyle) require their respective command-line tools or Gradle/Maven plugins to be installed and configured locally.
Verified SafeView Analysis
The server executes external commands (e.g., Git, Gradle, Checkstyle, SpotBugs) using `execSync` and `spawnSync`. While some user-provided inputs like file paths and branch names are quoted to prevent basic command injection, there's a potential risk if configuration files for static analysis tools are provided by an untrusted source, as these tools might allow arbitrary code execution through their configurations. Always ensure inputs to external command execution are thoroughly validated and sanitized, especially for `configFile` options.
Updated: 2025-11-25GitHub→
0
0
Low Cost
bhakti259 icon
Sec9

This server allows users to track and manage personal expenses through natural language interactions, storing records in a local SQLite database and providing tools for adding, listing, updating, deleting, and summarizing expenses.

Setup Requirements

  • ⚠️Requires Claude Desktop for primary interaction
  • ⚠️Python 3.12 or higher (as per pyproject.toml)
  • ⚠️Installation may require absolute paths in Claude Desktop config
Verified SafeView Analysis
The server uses parameterized SQLite queries, effectively preventing SQL injection. File paths for the database and categories are local and relative to the script, limiting arbitrary file access. There are no indications of 'eval', obfuscation, hardcoded secrets, or direct external network risks within the provided source code. The date parsing is handled by `python-dateutil`, which is generally robust. The primary risk would be potential data loss or corruption if the local `expenses.db` file is manually tampered with or accidentally deleted.
Updated: 2025-11-27GitHub→
0
0
Low Cost
BlockRunAI icon

awesome-finance-mcp

by BlockRunAI

Sec9

This repository serves as a curated directory of Model Context Protocol (MCP) servers and AI skills relevant to finance, trading, and cryptocurrency agents.

Verified SafeView Analysis
This repository itself is a static collection of Markdown files listing other MCP servers and AI skills; it is not an executable server. Therefore, common code-based security risks like 'eval', obfuscation, or hardcoded secrets are not applicable to this repository directly. The CONTRIBUTING.md outlines quality guidelines for submissions, aiming to ensure listed MCPs are functional and safe, but users should still exercise caution when interacting with external servers linked in the list.
Updated: 2026-01-18GitHub→
0
0
Low Cost
aphoticshaman icon

securescan

by aphoticshaman

Sec8

AI-powered security vulnerability scanner for static code analysis and dependency scanning.

Setup Requirements

  • ⚠️The 'AI-powered' claim is not directly supported by the provided Python scanning logic, which uses regex patterns.
  • ⚠️Conflicting product descriptions and pricing models are present between `README.md` (web-based static site with Stripe payment) and `app.py` (CLI tool with SaaS pricing tiers).
Verified SafeView Analysis
The `app.py` script is a local CLI tool designed to detect vulnerabilities in user-provided code using regex patterns; it does not expose a network interface for its scanning logic. The `serve.py` runs a basic static file server on localhost to host the web interface. Neither component introduces significant server-side security risks. The `eval` patterns and hardcoded secrets identified in the `SAMPLE_CODE` are vulnerabilities that the scanner *detects*, not issues within the scanner's own execution. The 'AI-powered' claim is not demonstrably supported by the provided `app.py` code, which relies on regex for detection.
Updated: 2026-01-19GitHub→
PreviousPage 348 of 760Next