Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
robwatsongtr icon

notes-querier-mcp

by robwatsongtr

Sec8

A macOS Notes app MCP server for querying notes and folders via AppleScript.

Setup Requirements

  • ⚠️Requires macOS with Notes.app installed.
  • ⚠️Requires user permission for AppleScript automation to access Notes.app.
  • ⚠️Requires Python 3.10 or higher.
Verified SafeView Analysis
The server interacts with macOS Notes.app via AppleScript, which typically requires user permissions. The server is read-only, reducing attack surface. AppleScript inputs for note names and search queries are escaped to mitigate simple injection risks, but complex AppleScript injection vulnerabilities might theoretically exist if the escaping is not exhaustive for all edge cases. The server runs locally and communicates via STDIO, limiting direct network exposure.
Updated: 2025-12-02GitHub→
0
0
Medium Cost
makespacemadrid icon

docmost-mcp

by makespacemadrid

Sec8

Provides a lightweight HTTP and JSON-RPC interface, implementing the MCP protocol, to interact with a Docmost instance, enabling agents to read and write pages and spaces.

Setup Requirements

  • ⚠️Requires Node.js v18+.
  • ⚠️Requires either `DOCMOST_API_TOKEN` OR (`DOCMOST_EMAIL` AND `DOCMOST_PASSWORD`) for Docmost authentication.
  • ⚠️Requires `DOCMOST_BASE_URL` pointing to a Docmost instance.
Verified SafeView Analysis
The server relies on environment variables for sensitive Docmost authentication credentials (API token or email/password), which is good practice. It handles JSON input parsing carefully, using it for parameters rather than direct code execution. The use of `fetch` for external API calls is standard. CORS `Access-Control-Allow-Origin: *` is enabled, which means it will accept requests from any origin; for some applications, this might be overly permissive, but for an API gateway consumed by various agents, it might be acceptable if Docmost's internal authentication is robust. No 'eval' or obvious malicious patterns were found in the provided source code.
Updated: 2025-12-03GitHub→
0
0
High Cost
fvanlanduyt icon

mcp-generator

by fvanlanduyt

Sec7

A web application that enables users to connect to various databases, analyze schemas with AI assistance (Claude), and generate Model Context Protocol (MCP) capabilities for use by MCP-compatible AI clients.

Setup Requirements

  • ⚠️Requires Anthropic API Key (Paid Service)
  • ⚠️Requires Python 3.11+
  • ⚠️Requires Node.js 18+ (for frontend development, or Docker for production)
Verified SafeView Analysis
The application employs parameterized queries to mitigate SQL injection risks and uses environment variables or an internal settings store for the Anthropic API key. AI prompts are designed to encourage safe SQL generation (e.g., using WHERE clauses for UPDATE/DELETE). However, database connection strings, which can contain sensitive credentials, are stored in the application's local SQLite database without explicit encryption in the SQLAlchemy model (though the README states 'Encrypted'). If the application's database itself is compromised, these connection strings could be exposed. There are no obvious `eval` or malicious patterns found in the truncated source.
Updated: 2025-12-08GitHub→
0
0
Medium Cost
kankbokans icon

eBird-Navigator

by kankbokans

Sec9

A multi-agent birding assistant that automatically finds birding hotspots, recent observations, and top species lists for any location worldwide using eBird data and Google AI.

Setup Requirements

  • ⚠️Requires Python 3.10+
  • ⚠️Requires Node.js 18+
  • ⚠️Requires an eBird API Key (may be rate-limited or require registration for extensive use)
Verified SafeView Analysis
The system uses environment variables for API keys (EBIRD_API_KEY, GOOGLE_GENAI_API_KEY), which is a good security practice. Communication with the eBird MCP server (Node.js) is handled via stdio, reducing external network exposure for the internal MCP component. No 'eval' or obvious malicious patterns were found in the provided Python code. Security heavily relies on the external APIs (eBird, Google Search, Gemini) and the integrity of the unprovided Node.js server code.
Updated: 2025-12-01GitHub→
0
0
Medium Cost
aubi-one-david icon

claude-container-mssql

by aubi-one-david

Sec8

Provides a secure, isolated Podman container environment for running Claude Code with pre-configured MSSQL database tools and multiple MCP servers.

Setup Requirements

  • ⚠️Requires Podman (or Docker with minor modifications) to be installed on the host machine.
  • ⚠️ANTHROPIC_API_KEY environment variable is mandatory for Claude Code authentication.
  • ⚠️Full MSSQL database functionality and integration tests require an accessible external MSSQL Server instance, with credentials provided via environment variables (DB_SERVER, DB_USERNAME, DB_PASSWORD, DB_DATABASE).
Verified SafeView Analysis
The container employs robust security measures against the host, including iptables for strict network isolation (whitelist by default), running as a non-root user, and restricting filesystem access to the mounted workspace. API keys are passed at runtime rather than baked into the image. However, it explicitly runs Claude Code with '--dangerously-skip-permissions', granting Claude arbitrary execution capabilities *within the container*. While this is mitigated by the container's isolation from the host, users must be aware of the high trust implicitly placed in the AI's actions inside the sandbox. The 'NET_ADMIN' capability is added for firewall management, a powerful permission, but used for a restrictive whitelist.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
LKCY23 icon
Sec8

The ArXiv MCP Server enables AI assistants to programmatically search, access, download, and analyze academic papers from arXiv via the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires Python 3.11+ to run.
  • ⚠️Recommends 'uv' for dependency installation, which may require prior setup.
  • ⚠️Requires outbound network access to the arXiv API for searching and downloading papers.
  • ⚠️Needs write permissions to the configured storage path for paper downloads and conversions.
Verified SafeView Analysis
The server primarily communicates via stdio, limiting direct network attack surface from the MCP client. Input validation for search categories is present. File operations are confined to a resolved storage path from CLI/ENV/default, mitigating simple path traversal. The main potential risk lies in the external dependency `pymupdf4llm` processing downloaded PDFs, which could theoretically be exploited by a maliciously crafted PDF, though papers are sourced from generally trusted arXiv.
Updated: 2025-11-22GitHub→
0
0
Low Cost
priadiliav icon

ShoppingMCP

by priadiliav

Sec9

Provides a backend API for an e-commerce or shopping application, handling server-side logic and data interactions.

Setup Requirements

  • ⚠️.NET SDK is required to build and run the application.
Verified SafeView Analysis
The provided code consists solely of configuration files (launch settings, app settings) for an ASP.NET Core application. No business logic, data handling, or secret management is visible, preventing a comprehensive security audit. The 'AllowedHosts: *' in appsettings.json is a broad default that should be restricted to specific hostnames in production environments for enhanced security, but it is not a direct vulnerability in these configuration files.
Updated: 2025-12-06GitHub→
0
0
Medium Cost
chrishayuk icon
Sec3

Reference implementation for Model Context Protocol (MCP) servers and clients, demonstrating all features of the MCP specification.

Setup Requirements

  • ⚠️Requires Python 3.11+
  • ⚠️Requires local `chuk-mcp-server` repository in parent directory (e.g., `../chuk-mcp-server`)
Review RequiredView Analysis
The `calculate` tool (in examples/11_full_server.py, 12_icons_metadata.py, 14_spec_2025_11_25.py) uses `eval()` to execute mathematical expressions. While a `safe_dict` is provided to limit its scope, `eval()` with user-provided input is an inherently dangerous function that can lead to arbitrary code execution if not perfectly sanitized or if vulnerabilities in the `safe_dict` setup are discovered. This constitutes a significant security risk for a production server.
Updated: 2025-11-27GitHub→
0
0
Low Cost
brianshin22 icon

dubcap-browser-mcp

by brianshin22

Sec5

A browser-based tool for interacting with or managing Minecraft Coder Pack (MCP) resources.

Review RequiredView Analysis
No source code was provided for analysis after the 'SOURCE CODE (Truncated, some files summarized):' header. Therefore, a comprehensive security audit for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns could not be performed. The score is a neutral default due to lack of information; caution is advised.
Updated: 2025-12-05GitHub→
0
0
Medium Cost

mcp-server

by izardy

Sec9

Serves a local Ollama Large Language Model (LLM) via the MCP protocol over standard I/O, enabling client applications to interact with the LLM as a tool.

Setup Requirements

  • ⚠️Requires Ollama to be installed and running locally.
  • ⚠️Requires 'mcp' and 'ollama' Python packages to be installed.
  • ⚠️Requires a specific Ollama model (e.g., 'llama3') to be pulled locally via Ollama.
Verified SafeView Analysis
The server code itself does not contain obvious vulnerabilities like 'eval' or hardcoded secrets. It relies on a locally running Ollama instance, meaning its security posture is largely dependent on the security of the local Ollama setup. Input prompts are passed directly to Ollama, which is expected behavior for an LLM tool.
Updated: 2025-11-28GitHub→
0
0
Low Cost
rishika105 icon

mcp-weather-server

by rishika105

Sec8

This server acts as a Model Context Protocol (MCP) agent to provide real-time weather data for specific cities to an AI language model.

Setup Requirements

  • ⚠️Requires Node.js 18+
Verified SafeView Analysis
The server's direct code is simple and does not contain obvious malicious patterns, hardcoded secrets, or uses of `eval`. It uses `StdioServerTransport`, suggesting communication via standard I/O, which limits direct network exposure from this application's perspective. However, it relies on `@modelcontextprotocol/sdk` and `express` which introduce their own dependencies and potential attack surface, although the SDK itself appears to include some security features like rate limiting.
Updated: 2025-11-25GitHub→
0
0
Medium Cost

mcp-server-movements

by matiasferrerovilas

Sec6

This project provides a server-side backend designed to interface with and process data for an 'api-movements' service.

Setup Requirements

  • ⚠️Requires Java Development Kit (JDK) to build and run.
  • ⚠️Requires an external 'api-movements' service to function (implied by README).
Review RequiredView Analysis
Source code is not available for full audit. Assumed standard Java/Gradle project. Potential network risks and common server application vulnerabilities exist without code inspection.
Updated: 2025-11-17GitHub→
PreviousPage 389 of 760Next