Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
offerland-cc icon
Sec7

Deploys an unauthenticated Model Context Protocol (MCP) server on Cloudflare Workers, primarily demonstrating calculator tools for AI agents and LLM clients.

Setup Requirements

  • ⚠️Requires a Cloudflare Workers environment for deployment and local development using Wrangler.
  • ⚠️No authentication is configured for the MCP server endpoints (`/sse`, `/mcp`), making it publicly accessible.
Verified SafeView Analysis
The server is explicitly designed as 'authless', meaning it performs no authentication for incoming requests. While this is intentional for its demo purpose (simple calculator tools), it would be a critical security vulnerability if deployed in a production environment handling sensitive data or operations. The code itself does not contain obvious malicious patterns, hardcoded secrets, or `eval` calls.
Updated: 2025-12-05GitHub→
0
0
Medium Cost
dmitry-melnishin icon

mcp-client-and-server

by dmitry-melnishin

Sec8

An MCP server that provides AI-agent callable tools and resources for managing guitar product inventory and customer orders, integrated with a product catalog and fulfillment API.

Setup Requirements

  • ⚠️Requires multiple services (products-api, fulfillment-api, mcp-order-server, frontend, admin) to be run concurrently for full functionality.
  • ⚠️Services use specific local ports: products-api (8082), fulfillment-api (8080), mcp-order-server (9533), admin (3001), frontend (5173). Ensure these ports are available.
  • ⚠️Uses 'pnpm' as the package manager; 'npm' or 'yarn' are not directly supported.
  • ⚠️The 'kill:port' scripts are Windows PowerShell specific.
Verified SafeView Analysis
The system uses Express.js and makes HTTP requests between local services. CORS is configured with `origin: '*'` in all APIs (`products-api`, `fulfillment-api`, `mcp-order-server`), which is highly insecure for production environments but acceptable for local development/demonstration. There are no obvious hardcoded secrets in the provided snippets, 'eval' usage, or malicious patterns. For production deployment, CORS policies must be restricted, and all inter-service communication should use HTTPS.
Updated: 2025-11-30GitHub→
0
0
Low Cost
stevenwall icon

gfrestaurants-sse

by stevenwall

Sec1

Provides real-time updates and data streaming capabilities for a restaurant multi-channel platform.

Review RequiredView Analysis
Insufficient source code provided (only README.md) to perform a meaningful security audit. Cannot verify the presence of 'eval', hardcoded secrets, network risks, or malicious patterns.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
fab-codes icon

trakt-mcp-server

by fab-codes

Sec9

Provides AI assistants with access to the Trakt.tv API for TV show tracking, watchlist management, and personalized viewing recommendations.

Setup Requirements

  • ⚠️Requires a Trakt.tv account and API credentials (Client ID and OAuth Access Token).
  • ⚠️The OAuth Access Token must have `public`, `read`, and `write` permissions for full functionality.
  • ⚠️Python 3.11+ is required for optimal performance as per `pyproject.toml`.
Verified SafeView Analysis
The server loads sensitive API credentials (Trakt Client ID, Access Token) from environment variables, which is a good security practice. It uses `httpx` with configured timeouts and connection pooling for network requests. Comprehensive error handling is implemented for various API and network issues, including specific handling for 401 (AuthenticationError) and 429 (Rate Limit). There are no 'eval' statements, code obfuscation, or other immediately apparent malicious patterns. The `User-Agent` is hardcoded, which is standard for API clients and not a security risk.
Updated: 2025-12-30GitHub→
0
0
Low Cost
elvetah-cmd icon

mcp-server

by elvetah-cmd

Sec8

A comprehensive Model Context Protocol (MCP) server designed for business affairs professionals in media, entertainment, and production industries, offering data integration, workflow support, task automation, and project context management.

Setup Requirements

  • ⚠️Integrations for Google (Gmail, Drive) and Microsoft (Outlook) are currently placeholders and require manual installation of `googleapis` or `@microsoft/microsoft-graph-client`, along with a complete OAuth 2.0 flow to obtain client IDs, secrets, and refresh tokens. The provided code does not implement the full OAuth flow, only consumes the tokens.
  • ⚠️Specific optional dependencies (`googleapis`, `@microsoft/microsoft-graph-client`, `csv-parser`, `xlsx`) must be manually installed if the corresponding integration tools (e.g., email fetching, budget file import) are to be implemented and used.
  • ⚠️Node.js version 18.0.0 or higher is a prerequisite.
Verified SafeView Analysis
The server correctly uses environment variables for sensitive API keys (e.g., GMAIL_CLIENT_ID, GDRIVE_CLIENT_SECRET), preventing hardcoded secrets. No direct use of `eval` or `child_process` with unsanitized user input was found, reducing command injection risks. The HTTP routes (via Express) are optional and not enabled by default via `npm start`; if enabled, proper authentication and authorization would be critical. Google Drive webhook integration is mentioned as a placeholder, which would require careful security implementation (e.g., signature verification) when fully realized. Input validation in `lib/validators.js` helps prevent malformed data, but robust input sanitation is key for all text processing functions. Overall, the foundational codebase is relatively secure for its stdio-based operation.
Updated: 2025-11-19GitHub→
0
0
Medium Cost
chintakjoshi icon

mcp-context-ai-agent

by chintakjoshi

Sec6

A privacy-first AI agent that maintains persistent awareness of a user's digital life to proactively provide insights, warnings, and assistance without being asked.

Setup Requirements

  • ⚠️Requires an OpenAI API Key (which can incur costs) for potentially full functionality, despite the README's emphasis on local LLMs.
  • ⚠️Requires Docker and Docker Compose for deployment and orchestration of all services (core agent, ChromaDB, MCP servers).
  • ⚠️Requires manual acquisition and placement of API credentials (e.g., Google OAuth JSON files, Notion tokens) into the `config` directory.
  • ⚠️Requires Python 3.10+.
Verified SafeView Analysis
The project states a 'privacy-first design' with 'no data sent to external AI providers (use local LLMs via Ollama)', but the `docker-compose.yml` explicitly configures an `OPENAI_API_KEY`. If this key is utilized by the core agent's ML models or context engine for advanced processing, sensitive user data will be sent to OpenAI, directly contradicting the privacy claim. OAuth credentials (e.g., Google Calendar `credentials.json`, `token.json`) are stored locally in a `config` directory mounted into Docker containers. While this avoids hardcoding, proper user permissions are critical to secure these sensitive files. The MCP (Model Context Protocol) servers are designed with scoped access, which is a positive security design principle, but the overall system's reliance on external LLMs when privacy is a core tenet presents a notable concern.
Updated: 2025-11-26GitHub→
0
0
High Cost

mcp-server

by arun-esh

Sec8

Extends Gemini CLI agent capabilities by providing specialized tools for YouTube transcript retrieval, note generation, and structured web search results.

Setup Requirements

  • ⚠️Requires Python 3.12+.
  • ⚠️Requires manual configuration of the `GEMINI_MCP_SERVER_URL` in the Gemini CLI or its `settings.json`.
  • ⚠️The `search_google_prompt` assumes the Gemini CLI agent has an available and functional `search_google_tool`, which is not part of this repository.
Verified SafeView Analysis
The server runs locally and provides specific tools/prompts. No `eval` or obfuscation is apparent from the README. Potential file system interaction risks (e.g., path traversal) are primarily dependent on the Gemini CLI agent's execution environment and how it interprets dynamic file paths from prompts, rather than direct vulnerabilities in the MCP server itself as described.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
Tetsukiba icon

MCP-demo-CSCI-435

by Tetsukiba

Sec8

Automates the end-to-end workflow from Figma design extraction and code generation, through SonarQube code quality analysis (with automated patching), to creating a GitHub Pull Request.

Setup Requirements

  • ⚠️Requires manual installation and PATH configuration for the `sonar-scanner` CLI.
  • ⚠️Requires setting up `GITHUB_TOKEN`, `SONAR_BASE_URL`, `SONAR_TOKEN`, `SONAR_ORGANIZATION`, and `SONAR_PROJECT` in a `.env` file.
  • ⚠️Requires manual configuration of Figma and GitHub MCP server URLs and authentication in `~/.vscode-server/data/User/mcp.json`.
  • ⚠️Users on the Figma Starter plan are limited to up to 6 tool calls per month for Figma MCP server interactions.
Verified SafeView Analysis
The project correctly utilizes environment variables for sensitive tokens and implements secret redaction for logging. However, `sonar.py` executes `sonar-scanner` via `subprocess.Popen`, which, while necessary for its functionality, introduces an inherent risk if inputs (like `project_key` or `files` content) were not adequately sanitized or could be manipulated for shell injection. The current implementation appears to construct arguments safely, mitigating immediate shell injection concerns.
Updated: 2025-12-06GitHub→
0
0
Medium Cost
fellnerd icon
Sec3

Integrates Dimetrics, Werkportal, and PPMC APIs, enabling natural language management of data, resources, and administrative entities through GitHub Copilot.

Setup Requirements

  • ⚠️Requires Docker and Docker Compose for multi-service deployment.
  • ⚠️Requires Python 3 dependencies (installable via `pip install -r requirements.txt`).
  • ⚠️Requires valid API keys for Dimetrics, Werkportal, and PPMC platforms; some are hardcoded in `docker-compose.yml` which must be changed before use.
  • ⚠️Designed for GitHub Copilot integration, necessitating an MCP client configuration.
Review RequiredView Analysis
Critical security risk: The `docker-compose.yml` file explicitly hardcodes API keys (`DIMETRICS_API_KEY`) for the `werkportal-mcp-server` and `ppmc-mcp-server` containers. This directly exposes sensitive credentials in the configuration. While the `dimetrics-mcp-server` references an `.env` file, the hardcoded keys for the other services are a major vulnerability. The server does implement transport security features like DNS rebinding protection and allowed hosts/origins, but their effectiveness depends on proper configuration, with a fallback to disabling protection if settings are incomplete.
Updated: 2025-12-23GitHub→
0
0
Low Cost

mcp-local-dev

by ilkergonenc

Sec5

Local development environment for a server or service, likely built with Node.js and TypeScript for handling a communication protocol or configuration management.

Setup Requirements

  • ⚠️Node.js runtime required
  • ⚠️npm or yarn package manager required
Review RequiredView Analysis
No code or README content was provided for analysis; therefore, a comprehensive security audit for 'eval', obfuscation, or specific network risks is not possible. The presence of 'package.json' indicates potential dependency-related risks that cannot be assessed without further information.
Updated: 2025-11-18GitHub→
0
0
High Cost

research-mcp-server

by Baggio200cn

Sec5

A Python server designed for advanced natural language processing, including document structure analysis, rephrasing technical content for broader audiences, and grouping similar texts.

Setup Requirements

  • ⚠️Likely requires an external Large Language Model (LLM) API Key (e.g., OpenAI, Anthropic) which incurs usage costs for rewriting and analysis tasks.
  • ⚠️May require significant computational resources (e.g., CPU/GPU, RAM) for processing large documents or performing complex clustering tasks locally.
Verified SafeView Analysis
Only `.gitignore` and `README.md` files are available, so no server code was audited for security vulnerabilities. As a 'server', network interaction is implied, requiring thorough code review for 'eval', input validation, authentication, and authorization once the server code is provided. Based on the provided files *only*, there are no direct security risks.
Updated: 2025-11-18GitHub→
0
0
Low Cost
Helmi97 icon

MCP-JS-Server

by Helmi97

Sec9

Provides a boilerplate for building Model Context Protocol (MCP) servers, enabling easy registration of tools via HTTP transport with Zod-based schema generation.

Setup Requirements

  • ⚠️Requires Node.js 18+
  • ⚠️Authentication requires setting the MCP_API_KEY environment variable (optional)
  • ⚠️Debug logging requires setting the DEBUG environment variable (optional)
Verified SafeView Analysis
The server uses environment variables for API keys and debug mode, which is good practice. Input validation is handled using Zod schemas for tool arguments, mitigating common injection risks. Standard Express.js practices are followed for routing and middleware. No 'eval' or obvious obfuscation is present. The `@modelcontextprotocol/sdk` itself is assumed to be secure. Default error handling prevents detailed error leaks. Rate limiting is present in the SDK dependencies but not explicitly configured in this boilerplate.
Updated: 2025-11-26GitHub→
PreviousPage 349 of 760Next