Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
Nard1975 icon
Sec9

Manages ActiveCampaign email campaigns by providing tools to create, retrieve, and list campaigns.

Setup Requirements

  • ⚠️Requires ACTIVECAMPAIGN_URL environment variable to be set.
  • ⚠️Requires ACTIVECAMPAIGN_API_KEY environment variable to be set.
  • ⚠️Requires 'fastmcp' and 'requests' Python packages to be installed.
Verified SafeView Analysis
The server correctly uses environment variables for API keys and URLs, preventing hardcoded secrets. It performs standard HTTP requests to a configured ActiveCampaign API endpoint. There is no usage of 'eval' or other highly dangerous functions. The primary security consideration would be ensuring the ACTIVECAMPAIGN_URL is configured to a trusted endpoint to prevent potential SSRF, though this is typically a static setup.
Updated: 2025-11-20GitHub→
0
0
High Cost
j0hanz icon
Sec9

The server fetches web pages, extracts readable content using Mozilla Readability, and returns AI-friendly Markdown for LLM summarization, context retrieval, knowledge base ingestion, and AI agents.

Setup Requirements

  • ⚠️Requires Node.js version 20.18.1 or higher.
  • ⚠️HTTP mode requires authentication via an API key (`API_KEY` or `ACCESS_TOKENS`) or a full OAuth 2.0 configuration.
  • ⚠️Remote access in HTTP mode (setting `ALLOW_REMOTE=true`) is only supported when OAuth 2.0 is fully configured.
Verified SafeView Analysis
The server demonstrates strong security practices, including extensive URL validation, SSRF protection with comprehensive IP and hostname blocklists (private IP ranges, cloud metadata endpoints, internal domain suffixes), and robust HTTP host/origin validation. It implements rate limiting and requires authentication (API key or OAuth) for HTTP mode, using timing-safe comparisons for static tokens. Content transformation is handled in worker threads, mitigating some types of exploitation. No 'eval' or obvious malicious patterns were found in the provided code. However, as noted in the README, caution is advised when deploying in sensitive environments, as it can access external URLs on behalf of AI assistants.
Updated: 2026-01-18GitHub→
0
0
Medium Cost
democratize-technology icon

fuzzing-mcp-server

by democratize-technology

Sec9

Provides property-based testing and fuzzing capabilities to AI assistants for automated discovery of edge cases and bugs in Python functions.

Setup Requirements

  • ⚠️Requires Python 3.9+ to run locally from source.
  • ⚠️Requires specific configuration for MCP clients (e.g., Claude Desktop) or environment variables for HTTP transport, as it is not a simple plug-and-play server.
  • ⚠️Docker or Kubernetes environment setup is required for robust production deployments, managing security and resource isolation.
Verified SafeView Analysis
The server intentionally uses `exec()` for dynamic code execution, which is generally a high-risk operation. However, this is heavily mitigated by a robust, multi-layered sandbox built upon the professionally audited `asteval.Interpreter` library. Key security measures include AST validation, strict whitelisting of allowed modules, comprehensive blocking of dangerous built-in functions, frame access blocking, and enforced resource limits (memory, time, recursion). The Docker and Kubernetes configurations also demonstrate strong hardening with non-root users, read-only filesystems, dropped capabilities, and strict resource controls. A comprehensive security audit is claimed to be completed and approved for production, significantly reducing the inherent risks of dynamic code execution.
Updated: 2025-12-14GitHub→
0
0
Low Cost

movie-catalog-mcp-server

by cloudz-modern-platform-demo

Sec8

Provides movie catalog information through a Model Context Protocol (MCP) server, supporting both manual and OpenAPI-driven tool exposure for AI agents.

Setup Requirements

  • ⚠️Requires Python >= 3.12.
  • ⚠️Requires `uv` Python package manager to be installed globally or via `pip`.
  • ⚠️Requires a separate backend API running (default `http://localhost:8000`) with an OpenAPI specification for full functionality, especially for the FastMCP auto-generated server.
Verified SafeView Analysis
The server binds to `0.0.0.0` by default, making it accessible externally if not properly firewalled. It relies on an external backend API (defaulting to `http://localhost:8000`), whose security is not covered by this analysis.
Updated: 2025-11-18GitHub→
0
0
High Cost
developerlabsai icon

mcp-cloudformation-builder

by developerlabsai

Sec9

An AI-native CloudFormation/Terraform generator that creates and self-heals infrastructure templates from GitHub repositories, designed for DeveloperLabs AI internal products.

Setup Requirements

  • ⚠️Requires Anthropic, OpenAI, and Pinecone API keys (Paid APIs).
  • ⚠️Requires an AWS account with specific permissions for CloudFormation, IAM, Service Quotas, STS, and Pricing API.
  • ⚠️Requires manual Supabase database setup and migration application.
Verified SafeView Analysis
The server correctly uses environment variables for all sensitive API keys and secrets. It interacts with various external APIs (GitHub, AWS, Supabase, Anthropic, OpenAI, Pinecone, internal Scaffold API) as expected for its functionality. The `generateSandboxCredentials` function handles temporary AWS credentials and console sign-in URLs, which is a sensitive operation but appears to be intended for internal, authorized use within the application's scope. There are no obvious signs of eval, obfuscation, or malicious patterns.
Updated: 2025-11-26GitHub→
0
0
Low Cost

mcp-ed

by wondermuttt

Sec7

A Node.js/TypeScript server application likely for managing educational content or system parameters, with authentication features.

Setup Requirements

  • ⚠️Requires Node.js & npm
  • ⚠️Requires Docker & Docker Compose
  • ⚠️Requires environment variables setup (see .env.example)
Verified SafeView Analysis
No explicit 'eval' or obfuscation found in file names. As a server, it inherently presents network risks and requires proper configuration. The presence of 'authenticationAnalysis.md' and 'testing_suite.ts' suggests some consideration for security and quality, but actual implementation needs review.
Updated: 2025-11-18GitHub→
0
0
Medium Cost
SUMAIRA-SHAIKH icon
Sec6

Implements or proxies the Minecraft Client Protocol (MCP), likely for custom game logic, data interception, or alternative server implementations.

Setup Requirements

  • ⚠️Requires Node.js installed
  • ⚠️Requires `npm install` to set up dependencies.
  • ⚠️Compatibility might be tied to specific Minecraft client and/or server versions.
Verified SafeView Analysis
As a custom network server handling a complex and often low-level protocol like Minecraft's, there are inherent risks related to input validation, buffer handling, and protocol compliance. Without access to the full source code, a comprehensive audit for 'eval', obfuscation, hardcoded secrets, or specific vulnerabilities is impossible. The score assumes a typical implementation without explicit malicious patterns but acknowledges the complexity and potential for common server-side vulnerabilities.
Updated: 2025-11-26GitHub→
0
0
Medium Cost
jelmersnoeck icon

mcp-fitness-coach

by jelmersnoeck

Sec9

Integrates intervals.icu with AI assistants for workout analysis, planning, and calendar management.

Setup Requirements

  • ⚠️Requires Node.js 18+ runtime.
  • ⚠️OAuth authentication for multi-user applications requires prior registration with intervals.icu (email 'david@intervals.icu').
  • ⚠️Requires manual generation and configuration of an intervals.icu API key and athlete ID for personal use (or OAuth credentials).
Verified SafeView Analysis
The server uses environment variables for sensitive API keys and OAuth credentials, preventing hardcoding. The OAuth authentication flow correctly implements CSRF protection using a 'state' parameter. File-based token storage is secured with appropriate file permissions (0600). Input validation for tool arguments is performed using Zod. No direct 'eval' or obvious code injection vulnerabilities were found. Standard network request practices are followed.
Updated: 2026-01-18GitHub→
0
0
Low Cost
mtnvencenzo icon
Sec9

Provides a Model Context Protocol (MCP) server that gives AI agents secure, first-class access to Cezzis.com cocktail data for searching, retrieving details, authenticating, and rating cocktails.

Setup Requirements

  • ⚠️Requires Go 1.25+ for local development and compilation.
  • ⚠️Requires a subscription key (`COCKTAILS_API_XKEY`) for the upstream Cezzis.com Cocktails API and `AISEARCH_API_XKEY` for Azure AI Search, which must be provided via environment variables or Azure Key Vault.
  • ⚠️Full functionality (e.g., user ratings, login) depends on proper configuration of Auth0 (`AUTH0_DOMAIN`, `AUTH0_CLIENT_ID`, `AUTH0_AUDIENCE`, `AUTH0_SCOPES`) and Azure CosmosDB (`COSMOS_CONNECTION_STRING` or `COSMOS_ACCOUNT_ENDPOINT`, `COSMOS_DATABASE_NAME`, `COSMOS_CONTAINER_NAME`) for secure token storage.
Verified SafeView Analysis
The server implements robust security practices, including: secrets management via environment variables and Azure Key Vault, OAuth 2.1 / OIDC authentication with Auth0 for end-users, and secure token storage in Azure CosmosDB. All telemetry is sent via OpenTelemetry. HTTP/HTTPS transport is supported, with TLS configuration available. A minor note is the explicit `InsecureSkipVerify` for TLS connections to CosmosDB when `ENV` is 'loc', which is acceptable for local development but must be prevented in production.
Updated: 2026-01-19GitHub→
0
0
High Cost
KSAklfszf921 icon

Merinfo.se-MCP

by KSAklfszf921

Sec5

A Model Context Protocol server for retrieving and analyzing Swedish company information from merinfo.se and allabolag.se, using robust web scraping and intelligent caching mechanisms.

Setup Requirements

  • ⚠️Requires Node.js 18+ and npm/yarn for execution.
  • ⚠️Playwright browser dependencies (Chromium) might require additional system-level packages depending on the host environment and configuration (e.g., outside of Docker, or without a specified `PLAYWRIGHT_CHROMIUM_EXECUTABLE_PATH`).
  • ⚠️An initial database setup is required by running `npm run setup-db` before starting the server.
Verified SafeView Analysis
The server performs web scraping using Playwright, which inherently introduces security considerations. Notably, Playwright is launched with `--no-sandbox` and `--disable-web-security` flags. While `--no-sandbox` is common in containerized environments, `--disable-web-security` is a significant browser security bypass that, if exploited (e.g., through redirection to a malicious site during scraping), could pose a risk to the host environment. The server includes input validation (Zod) and rate limiting, which are positive. The MCP endpoint (HTTP/SSE) does not implement explicit authentication, assuming client-side security or network isolation for access.
Updated: 2025-11-23GitHub→
0
0
Medium Cost
Khanhshuyen icon

cursor-n8n-builder

by Khanhshuyen

Sec9

An MCP server enabling AI assistants to manage n8n workflows (create, update, delete, activate, deactivate, and trigger) and view execution details via the n8n REST API.

Setup Requirements

  • ⚠️Requires Node.js 18+ to run.
  • ⚠️Requires a running n8n instance with API access enabled.
  • ⚠️Mandatory environment variables: N8N_API_URL and N8N_API_KEY.
  • ⚠️Requires manual configuration in Cursor's .cursor/mcp.json (automated by the 'setup' command, but still a specific step).
Verified SafeView Analysis
The server's code itself appears robust, with no evident use of 'eval' on arbitrary user input or other direct malicious patterns. It correctly uses environment variables for sensitive API keys. The primary 'risk' involves the inherent capabilities of the tool: giving an AI assistant the ability to manage and trigger n8n workflows and webhooks. Users must ensure that the configured n8n instance and the workflows created/triggered are themselves secure and do not expose sensitive information or initiate harmful actions. The 'n8n_trigger_webhook' tool can call any user-provided URL, which is a powerful capability that needs to be used responsibly by the AI and end-user.
Updated: 2026-01-19GitHub→
0
0
Medium Cost

ai-memory-mcp

by lapino-web

Sec4

Provides Claude Desktop with access to an external AI memory system for context retrieval.

Setup Requirements

  • ⚠️Requires SSH access to a remote server, and configuration to run as `root` (security risk; a dedicated user with minimal permissions is recommended).
  • ⚠️Assumes an existing AI Memory System is accessible by the remote server where the script runs.
  • ⚠️Requires manual deployment of the `ai_memory_mcp_server.py` script to the `/tmp/ai-memory-mcp/` directory on the remote server.
Review RequiredView Analysis
The setup involves configuring Claude Desktop to run a Python script as `root` on a remote server via `ssh`. Without examining the script's code (`ai_memory_mcp_server.py`), it's impossible to verify its safety and potential vulnerabilities. Running arbitrary code as root on a remote server poses significant security risks, including potential for arbitrary command execution, privilege escalation, or data exfiltration.
Updated: 2025-11-23GitHub→
PreviousPage 387 of 760Next