Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
peacockery-studio icon

mcp-sharepoint-cert

by peacockery-studio

Sec9

Integrate AI assistants with Microsoft SharePoint for comprehensive document and folder management using certificate-based authentication.

Setup Requirements

  • ⚠️Requires Python 3.12+.
  • ⚠️Requires manual Azure AD App Registration: create app, upload certificate, and grant `Sites.FullControl.All` or `Sites.ReadWrite.All` permissions.
  • ⚠️Requires OpenSSL installed on the system for certificate generation during setup.
  • ⚠️Installation and execution examples typically use `uv` and `uvx`, which may require prior setup of the uv package manager.
Verified SafeView Analysis
The server uses certificate-based authentication (preferred) or client secrets, handled via environment variables, avoiding hardcoded credentials. It employs input validation (`PathValidator`) to prevent common path traversal and invalid character attacks in file/folder names. `subprocess.run` is used for certificate generation (OpenSSL) and clipboard operations, which are controlled and expected CLI calls, not arbitrary user input execution. Content extraction from PDF, Word, and Excel files relies on external libraries, which have inherent risks with malicious files, but the server primarily extracts text and does not execute file content directly.
Updated: 2025-12-05GitHub→
0
0
Medium Cost
QuickMythril icon

qortal-mcp-server

by QuickMythril

Sec10

Provides a read-only, LLM-friendly API for Qortal blockchain and QDN data, designed for agents to query information without transaction capabilities.

Setup Requirements

  • ⚠️Requires Python 3.11+
  • ⚠️Requires a running Qortal Core node accessible via HTTP API (default localhost:12391)
  • ⚠️Qortal Core API key required for /admin/* endpoints (can be set via environment variable QORTAL_API_KEY or apikey.txt)
Verified SafeView Analysis
The project adheres to a robust and explicitly enforced read-only security model. It strictly whitelists GET endpoints, performs rigorous input validation (e.g., address formats, numeric ranges, list limits) before querying the Qortal Core node, and sanitizes/truncates outputs to prevent data leaks or excessive payloads. The Qortal Core API key is kept server-side and never exposed. Rate limiting is implemented per-tool. Error handling is standardized to prevent exposure of internal stack traces. There is no evidence of 'eval' or obfuscation. Deployment notes advise on external exposure for enhanced security.
Updated: 2025-12-03GitHub→
0
0
Medium Cost

tiling-trees-mcp

by k-chrispens

Sec8

Provides a structured framework for systematically exploring and organizing solution spaces using the Mutually Exclusive and Collectively Exhaustive (MECE) principle, from problem definition to solution evaluation.

Setup Requirements

  • ⚠️Requires Node.js and npm to be installed on the system.
  • ⚠️Requires manual configuration in an MCP settings file (e.g., `claude_desktop_config.json`), specifying the absolute path to the server's `dist/index.js`.
  • ⚠️The `npm run build` step must be executed to compile the TypeScript source into JavaScript (`dist/index.js`).
Verified SafeView Analysis
The server runs locally via Node.js as an MCP server. The primary security consideration is the integrity of the downloaded code itself, as it executes a local script. There is no indication of 'eval', obfuscation, or direct network exposure beyond the local MCP framework.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
rahibas icon

ts-mcp

by rahibas

Sec2

Provides a server for the Minecraft Protocol, likely for custom game logic or proxying.

Setup Requirements

  • ⚠️Node.js runtime required
  • ⚠️TypeScript compiler required (for building from source)
Review RequiredView Analysis
Insufficient source code provided (only README.md) to perform a comprehensive security audit. Cannot check for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns. The score reflects an inability to verify safety rather than identified vulnerabilities.
Updated: 2025-11-25GitHub→
0
0
Low Cost

server-model-mcp

by Tintas-Formosenias

Sec4

A Python-based server application that likely implements a model or protocol, potentially related to game server logic (e.g., Minecraft Coder Pack, if 'MCP' is interpreted in that context) or a generic micro-controller platform.

Review RequiredView Analysis
No code available for inspection, making it impossible to audit for specific vulnerabilities like 'eval' or obfuscation. As a server, it inherently presents network exposure, but specific risks cannot be determined without code. The 'MCP' abbreviation could be related to 'Minecraft Coder Pack', which typically points to Java projects, but 'requirements.txt' and 'src' suggest Python, making its exact context ambiguous.
Updated: 2025-11-18GitHub→
0
0
High Cost
BUZDOLAPCI icon

openapi-generate

by BUZDOLAPCI

Sec8

Parse OpenAPI 3.x specifications to generate MCP tool schemas and full MCP server scaffolds in TypeScript or Python.

Setup Requirements

  • ⚠️Requires Node.js 18.0.0 or higher.
  • ⚠️The server exclusively uses HTTP transport (fixed to port 8080 and host 0.0.0.0), despite the README claiming STDIO as the default transport and providing CLI options (`-t, --transport`) or environment variables (`MCP_TRANSPORT`) for STDIO transport. These options are not implemented in the server's primary entry point (`src/index.ts`) or CLI argument parsing (`src/cli.ts`) for this server instance.
  • ⚠️The configuration environment variables (e.g., `MCP_PORT`, `MCP_HOST`, `MCP_SERVER_NAME`, `MCP_SERVER_VERSION`) listed in the README for this server are hardcoded in its primary entry point (`src/index.ts`), making them non-configurable via environment variables or CLI arguments for this specific server instance. The `loadConfig` function that would read these environment variables is only used in the *generated* scaffolds, not in the `openapi-generate` server itself.
Verified SafeView Analysis
The server uses `@apidevtools/swagger-parser` to dereference OpenAPI specs, which can involve fetching remote URLs (via `spec_url_or_json` input). This introduces a potential Server-Side Request Forgery (SSRF) risk if untrusted or malicious URLs are provided, and the server's environment is not adequately isolated. However, this is a core and expected functionality of an OpenAPI parser. The implementation of tool execution via JSON-RPC uses a `switch` statement to explicitly call known functions (`openapiParse`, `generateToolSchemas`, `generateServerScaffold`), preventing dynamic code execution vulnerabilities like `eval`. No hardcoded sensitive secrets were found in this server's codebase, although generated server scaffolds include placeholder API keys in their `.env.example` files, which is appropriate.
Updated: 2026-01-17GitHub→
0
0
Low Cost
payvilla icon
Sec3

Provides a centralized Model Context Protocol (MCP) server for SabPaisa's design system, enabling AI assistants and developers to access design tokens, components, patterns, and formatting guidelines.

Setup Requirements

  • ⚠️Requires Node.js 20.x or higher.
  • ⚠️When deployed as an HTTP API (e.g., AWS Lambda), Claude Code requires a local `mcp-bridge.mjs` script to connect to the HTTP-based MCP endpoint. This script needs to be manually created and made executable.
  • ⚠️The `data/` and `data-enhanced/` directories containing the design system JSON files must be correctly present relative to the compiled `dist` directory or bundled with the deployment.
Review RequiredView Analysis
CRITICAL VULNERABILITY: The `src/index-http.ts` exposes a `/debug/files` endpoint that allows listing directories and reading files from the server's filesystem (`process.cwd()`, `data/`, `data-enhanced/`). This is a severe information disclosure vulnerability for a publicly deployed Lambda function, as it can expose sensitive configurations, server logic, and internal directory structures. This endpoint lacks authentication/authorization and should be removed or heavily secured (e.g., IP whitelisting, authentication) immediately if deployed publicly. Reliance on numerous third-party dependencies also expands the attack surface.
Updated: 2025-12-05GitHub→
0
0
Medium Cost
satheeshds icon

gbp-review-agent

by satheeshds

Sec8

Manages Google Business Profile reviews by fetching reviews, generating AI-powered responses, and posting replies back to Google Business Profile.

Setup Requirements

  • ⚠️Requires Google Business Profile API Access (requires Google approval, which can take time)
  • ⚠️Requires Google Cloud Platform account with My Business API and My Business Account Management API enabled
  • ⚠️Manual OAuth authentication (`npm run auth`) required to generate and store local tokens before first use
Verified SafeView Analysis
The server stores Google OAuth tokens in a local `.tokens.json` file. While convenient for development, this file could be accidentally exposed if committed to a public repository or not properly secured on the host system, potentially leading to unauthorized access to the linked Google Business Profile. The `authenticate.js` and `quick-test.js` scripts use `execSync` from `child_process`, but these are auxiliary setup/test scripts and not part of the main server runtime, mitigating risk.
Updated: 2025-12-03GitHub→
0
0
Low Cost
jack6249 icon
Sec9

Provides real-time weather information for specified cities via an MCP server, integrating with LLM agents.

Setup Requirements

  • ⚠️Requires Python 3.10 or higher.
  • ⚠️Dependencies `requests`, `fastmcp`, and `smithery` must be installed (e.g., via `pip install requests fastmcp smithery`).
Verified SafeView Analysis
The server makes external HTTP requests to `wttr.in`, a known public weather API, with a 10-second timeout. No `eval` or similar dangerous patterns were found. There are no hardcoded secrets or sensitive information.
Updated: 2025-11-21GitHub→
0
0
Medium Cost
ismaeldosil icon

benefisio-docs-mcp

by ismaeldosil

Sec9

Provides programmatic access to FinaShopping documentation for AI agents, enabling search, document retrieval, agent discovery, and template-based prompt generation for tasks like finding agents or creating tickets.

Setup Requirements

  • ⚠️Requires the `DOCS_PATH` environment variable to be set and point to an existing 'finashopping-docs' repository, which must follow a specific internal structure (e.g., '.claude/agents', 'finashopping', '_universal' directories, and a 'README.md').
  • ⚠️Requires Node.js version 20.0.0 or higher.
Verified SafeView Analysis
The server explicitly implements path traversal prevention in the `getDoc` tool by normalizing paths and ensuring they remain within the configured `DOCS_PATH`. File system operations using `glob` are restricted to the `docsPath` or subdirectories. Markdown parsing is used, not direct execution of user-provided content. No `eval` or direct command execution of user input was found. The use of environment variables for `DOCS_PATH` is standard and secure.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
nicsuzor icon

zotmcp

by nicsuzor

Sec8

MCP server for semantic search, literature review, and citation retrieval from a ChromaDB-indexed Zotero academic library.

Setup Requirements

  • ⚠️Requires GCP access (contact maintainer and run `gcloud auth application-default login`)
  • ⚠️Requires `uv` (uvx) or `docker` container runtime installed locally.
  • ⚠️First-time setup involves downloading ~8GB of ChromaDB vectors.
  • ⚠️Local development of the vectorization pipeline requires `poppler-utils` (e.g., `apt install poppler-utils`).
Verified SafeView Analysis
The OAuth client ID and secret for installed apps are hardcoded in `src/zotmcp/download.py`. While typical for public clients, this means they are not truly secret. Zotero API key is expected from environment variables and managed by Buttermilk's credential system (likely GCP Secret Manager), which is good practice. The HTTP server binds to `0.0.0.0` by default, which is standard for containerized applications but requires proper firewalling in production environments. No 'eval' or obvious obfuscation found.
Updated: 2026-01-07GitHub→
0
0
Medium Cost

MCP-Server

by archis17

Sec8

Provides Git and GitHub workflow tools via an HTTP API for AI assistants to interact with local repositories and GitHub.

Setup Requirements

  • ⚠️Requires a valid Git repository path to be set via `GIT_MCP_REPO` environment variable, otherwise Git operations will fail.
  • ⚠️GitHub API tools require a `GITHUB_TOKEN` with `repo` scope to be set, otherwise GitHub operations are disabled.
  • ⚠️Requires Python dependencies installed via `pip install -r requirements.txt`.
Verified SafeView Analysis
The server uses `subprocess.run` with lists of arguments, which generally prevents shell injection. File paths for Git operations are validated to prevent path traversal outside the repository root. GitHub API interactions require an explicit `GITHUB_TOKEN` from environment variables, avoiding hardcoded secrets. The server itself does not implement authentication, relying on the security of the host environment and the AI assistant's configuration. Binding to `0.0.0.0` (if configured) allows network access, requiring external firewalling for production.
Updated: 2025-11-26GitHub→
PreviousPage 362 of 760Next