Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
Kimchiigu icon

aave-lending-mcp

by Kimchiigu

Sec9

Manages Aave V3 lending positions and executes transactions for users via natural language commands.

Setup Requirements

  • ⚠️Requires an Alchemy API Key (or equivalent RPC endpoint for the chosen network, potentially a paid service).
  • ⚠️Requires Python 3.12+ (if running without Docker).
  • ⚠️Requires Docker and Docker Compose (recommended setup) or manual npm/pip dependency management.
Verified SafeView Analysis
The project adheres to a non-custodial model, generating unsigned transactions for client-side signing. Input validation for user addresses is implemented. No direct handling of user private keys for user funds is observed. The presence of an `EXECUTOR_PRIVATE_KEY` environment variable is noted, which could introduce a risk if misused for internal operations, but is not part of the standard user transaction flow.
Updated: 2025-12-02GitHub→
0
0
Low Cost
ebhawana icon

basic-mcp-server

by ebhawana

Sec9

This server provides a set of simple utility tools (dice roll, arithmetic) exposed via an HTTP API using FastMCP for potential agent interaction.

Setup Requirements

  • ⚠️Python 3.12+ only
  • ⚠️Requires 'uv' or 'fastmcp' installed
Verified SafeView Analysis
No 'eval', obfuscation, or hardcoded secrets found. Tools are simple and perform basic arithmetic/random operations. The server binds to localhost (127.0.0.1:8000) by default, limiting direct external exposure. It uses HTTP transport which is unencrypted unless a reverse proxy is used.
Updated: 2025-12-02GitHub→
0
0
High Cost

ai-mcp-agent

by sandaliqbal

Sec6

A minimal AI agent platform for integrating with YouTube APIs to extract transcripts and generate content like blog posts, social media updates, and video chapters.

Setup Requirements

  • ⚠️Requires YouTube API Key for transcript extraction.
  • ⚠️Requires API Key for an AI Model Provider (e.g., OpenAI, Anthropic, Google Gemini) for agent functionality and content generation.
  • ⚠️Relies on 'uv' for dependency management; 'pip' can be used alternatively but setup instructions specify 'uv sync'.
Verified SafeView Analysis
The project includes a 'custom MCP server implementation' in 'mcp-server/server.py'. Without code review, it's difficult to ascertain specific security vulnerabilities regarding endpoint exposure, authentication, or authorization. No obvious signs of 'eval' or obfuscation from the provided description. General network risks associated with running any custom server apply.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
stacklet icon

mcp-server

by stacklet

Sec6

The Stacklet MCP Server integrates LLMs with cloud governance and analytics by exposing tools for AssetDB SQL queries, Platform GraphQL operations, and comprehensive documentation access.

Setup Requirements

  • ⚠️Requires `STACKLET_ENDPOINT`, `STACKLET_ACCESS_TOKEN`, `STACKLET_IDENTITY_TOKEN` environment variables or ~/.stacklet configuration files for authentication.
  • ⚠️Requires Python 3.12 or newer.
  • ⚠️Authentication tokens obtained via `stacklet-admin login` expire after 12 hours, necessitating re-authentication.
Review RequiredView Analysis
The server can access confidential data. It directly executes LLM-generated SQL queries via `assetdb_sql_query`, which poses a high risk of SQL injection, especially with 'text' parameters that use template substitution rather than prepared statements. By default, write operations (saving queries, archiving queries, executing GraphQL mutations) are disabled, significantly reducing risk. However, enabling `_ALLOW_` environment variables grants the LLM the same powers as the authenticated user, allowing potentially destructive or data-modifying actions. Full query results are saved locally, potentially exposing sensitive data. There are no hardcoded secrets or 'eval' usage observed. Proper authentication via `stacklet-admin login` is required, and permissions are inherited from the authenticated user. The `json_guard` decorator is used to prevent accidental JSON encoding issues from LLMs, but does not prevent malicious input.
Updated: 2026-01-14GitHub→
0
0
Medium Cost
mozhaa icon

mcp-sbt-shell

by mozhaa

Sec4

Execute sbt commands in a persistent shell session to interact with Scala projects and their build processes.

Setup Requirements

  • ⚠️Requires sbt to be installed and accessible in the system PATH.
  • ⚠️Requires a Scala project with a 'build.sbt' file in the specified working directory.
  • ⚠️The sbt prompt detection logic is 'tested on Windows with sbt.bat' and uses a specific byte sequence, which might behave differently or fail on non-Windows operating systems (e.g., macOS, Linux).
Review RequiredView Analysis
The server executes arbitrary sbt commands provided by the client without input sanitization for the 'command' parameter. If exposed to untrusted networks or users, this poses a significant command injection risk, allowing execution of potentially malicious sbt commands or underlying system commands. Requires careful deployment to ensure only trusted clients can access it, preferably within a sandboxed environment.
Updated: 2025-11-30GitHub→
0
0
Low Cost
Brahhime icon
Sec9

This template facilitates the quick setup of a Modular Control Protocol (MCP) server using the Yokai Go framework, enabling easy customization and integration of server components.

Setup Requirements

  • ⚠️Docker is required to run the application using the provided `docker-compose.yaml`.
  • ⚠️Developers looking to extend or modify the server will need a Go development environment.
  • ⚠️Familiarity with the `ankorstore/yokai` framework is beneficial for advanced customization and understanding of the server's architecture.
Verified SafeView Analysis
The provided Go source code appears clean, utilizing the Yokai framework without explicit dangerous functions ('eval' or similar) or hardcoded secrets. The `docker-compose.yaml` mounts the entire project directory into the container (`.:/app`), which is standard for development environments but should be carefully reviewed for production deployments to mitigate potential host system exposure. All external links in the README (Download, Documentation, Issues, Contributing) uniformly point to the same `.zip` file. While this does not directly indicate a security flaw within the server's provided source code, it represents an unusual and potentially suspicious practice regarding repository hygiene and distribution methods.
Updated: 2026-01-19GitHub→
0
0
Low Cost
hitosh308 icon

mcp-server-sample

by hitosh308

Sec9

A simple HTTP server demonstrating basic API endpoints for health checks, resource listing, and an echo tool, typical for MCP-style interactions.

Setup Requirements

  • ⚠️Requires Java Development Kit (JDK) to build and run.
  • ⚠️Requires Apache Maven to build the project.
Verified SafeView Analysis
The server uses `com.sun.net.httpserver.HttpServer` and `Google Gson` for JSON parsing. No 'eval' or similar dangerous dynamic code execution patterns are observed. Input from the echo endpoint is parsed as JSON and the 'message' field is extracted as a string, then simply concatenated into the response, preventing obvious injection vectors. There are no hardcoded secrets or direct file system interactions beyond standard HTTP I/O. The `readBody` method reads all request body bytes, which could theoretically be resource-intensive for extremely large malicious inputs, but is acceptable for a sample server.
Updated: 2025-12-14GitHub→
0
0
High Cost
zhcsyncer icon

cc-plan-review

by zhcsyncer

Sec8

Provides a human review workflow for Claude Code's Plan Mode, allowing users to annotate and provide feedback on AI-generated plans via a web interface.

Setup Requirements

  • ⚠️Requires pnpm for dependency management and scripts.
  • ⚠️Requires Node.js v18+ (preferably v20+ as indicated by some dependencies).
  • ⚠️Operates by opening a web browser for the review UI, which implies a graphical environment.
Verified SafeView Analysis
The server runs locally (localhost:3030/3031) and opens a browser UI, which significantly limits external attack surface. File paths for review data are constructed using `path.join` and `encodeProjectPath` to mitigate path traversal risks. No `eval` or obvious obfuscation detected. While explicit web security headers or CSRF tokens are not present, this is less critical for a local-only developer tool not intended for public internet exposure.
Updated: 2025-12-24GitHub→
0
0
Medium Cost
goyaladitya05 icon

omni-parser-mcp-server

by goyaladitya05

Sec8

Automates GUI interactions on any software by 'seeing' the screen with computer vision and executing actions based on LLM reasoning.

Setup Requirements

  • ⚠️Requires Google API Key (Paid) for Gemini LLM calls.
  • ⚠️Requires downloading large YOLO model weights (approx. 50MB) during setup via `python setup.py`.
  • ⚠️PyAutoGUI, used for screen interaction, may require specific OS dependencies (e.g., screencapture tools, X11 utilities on Linux) not explicitly listed in `requirements.txt`.
Verified SafeView Analysis
The system processes and executes actions based on LLM output, including mouse clicks and keyboard typing. While the JSON parsing helps mitigate direct code injection, a compromised or poorly prompted LLM could instruct the agent to perform malicious actions on the host machine. No direct 'eval' or hardcoded secrets were found. Temporary screenshot files are used and overwritten.
Updated: 2025-11-25GitHub→
0
0
Medium Cost
Bazinga640 icon
Sec8

This server provides a comprehensive set of automated EVM blockchain interaction tools for development, testing, and analytics across multiple chains, focusing on wallets, DeFi, NFTs, and MEV.

Setup Requirements

  • ⚠️RPC/WebSocket RPC Configuration: Requires setting RPC URLs for all desired EVM chains (e.g., ETHEREUM_RPC_URL, POLYGON_RPC_URL) and optional WebSocket RPCs for mempool monitoring (e.g., MEMPOOL_WS_ETHEREUM_URL) as environment variables.
  • ⚠️API Keys for External Services: Full functionality for features like NFT image generation (AI services), IPFS uploads (Pinata/Web3.Storage), and Flashbots (MEV_TOOLS on Ethereum) depends on setting corresponding API keys as environment variables (e.g., PINATA_API_KEY, FLUX_API_KEY). These often involve paid services or API access.
  • ⚠️Testnet Limitations: Many advanced DeFi, Staking, and Lending tools are intentionally disabled on the default testnet server, returning messages indicating mainnet-only support for those protocols unless ENABLE_TESTNET_LENDING=true is explicitly set (and even then, testnet deployments for such complex protocols may not fully exist or be stable).
  • ⚠️Node.js Environment: Requires a Node.js runtime environment.
Verified SafeView Analysis
The server clearly distinguishes between testnet and mainnet functionalities, explicitly disabling certain DeFi/staking tools on testnets by default to prevent misuse. It uses environment variables for API keys (e.g., PINATA_API_KEY, AI service keys) and strongly warns against exposing or hardcoding private keys, which are passed as parameters but not persistently stored. The code explicitly uses `ethers.js`, a well-audited library, for most blockchain interactions. Potential risks include reliance on external RPC providers (rate limits, reliability) and third-party IPFS/AI services, which are external dependencies rather than inherent code vulnerabilities.
Updated: 2026-01-19GitHub→
0
0
Low Cost
WhenMoon-afk icon

snapshot-mcp-server

by WhenMoon-afk

Sec9

A Model Context Protocol (MCP) server for saving and resuming AI conversations with token-efficient context preservation, working standalone or integrated with larger memory systems.

Setup Requirements

  • ⚠️Requires Node.js 18+ to be installed.
  • ⚠️Requires restarting Claude Desktop completely after installation or configuration changes.
  • ⚠️For manual Windows setup, requires `cmd /c` wrapper for npx in Claude config (though installer uses `node` directly).
Verified SafeView Analysis
The server uses `better-sqlite3` with prepared statements, mitigating SQL injection risks. Communication with the MCP client (e.g., Claude Desktop) is primarily via standard I/O (`StdioServerTransport`), which limits network exposure. The `install.js` script handles file system operations for setup, including creating directories and modifying the Claude Desktop configuration file. The server itself does not appear to execute arbitrary commands based on user input, nor does it contain obvious hardcoded secrets. The primary risk would be in the MCP SDK dependencies, but the server's implementation is robust for its scope.
Updated: 2025-12-02GitHub→
0
0
Low Cost
paylinkmcp icon

basic-mcp-agent

by paylinkmcp

Sec8

Provides monetized arithmetic tools (add, subtract) via an MCP (Model Context Protocol) HTTP server, integrating with PayLink for automatic payment processing.

Setup Requirements

  • ⚠️Requires Python 3.13+
  • ⚠️Requires `uv` package manager
  • ⚠️Requires `MCP_WALLET_CONNECTION_STRING` for the server (from PayLink platform) in a `.env` file
Verified SafeView Analysis
The server exposes endpoints on `0.0.0.0:5003`, which makes it accessible from any network interface. While acceptable for development and examples, this requires careful consideration and potentially firewall restrictions in a production environment. Payment processing relies on the `PayLink` SDK and external PayLink infrastructure, assuming its security mechanisms are robust. No obvious malicious patterns or unsafe code execution (`eval`, `exec`) are found in the tool logic itself. Wallet connection string is expected via environment variables.
Updated: 2025-11-30GitHub→
PreviousPage 360 of 760Next