Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse Directory Why Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:

SORT:

Vetted Servers(9120)

Low Cost

sample-mcp-server

by cs224

Sec10

A sample server demonstrating the Model Context Protocol (MCP) for integrating custom data and tools with ChatGPT's Developer Mode.

Setup Requirements

⚠️Requires ChatGPT Pro subscription with Developer Mode enabled.
⚠️Requires ngrok (or similar tunneling service) to expose the local server to the internet.
⚠️Requires Python 3.10 or higher.
⚠️This server is designed for testing and explicitly does not implement authentication, making it unsuitable for production use.

Verified SafeView Analysis

The server is a 'toy' example explicitly for testing purposes. It does not contain `eval`, `exec`, or other dynamic code execution risks. No hardcoded secrets were found. It is designed to be run locally and exposed via ngrok; however, it explicitly notes 'No authentication' making it unsuitable for production, but safe for its stated test use. The data returned is hardcoded and non-sensitive.

Updated: 2025-12-02GitHub→

Medium Cost

mcp-obsidian

by halbares

Sec8

Enables AI agents to directly interact (read, search, write) with an Obsidian knowledge vault.

Setup Requirements

⚠️Requires `ripgrep` (rg) system dependency for optimal search performance.
⚠️Crucially requires the `OBSIDIAN_VAULT_PATH` environment variable to be set to an existing Obsidian vault directory.
⚠️A hardcoded fallback path (`/home/pablo/Baul_Obsidian`) for `OBSIDIAN_VAULT_PATH` exists in `src/server.py` if the environment variable is not set or valid, which will likely not work for other users.
⚠️Requires Python 3.12 or higher.

Verified SafeView Analysis

The `_safe_path` method is implemented to prevent directory traversal attacks by resolving paths and ensuring they remain within the vault. `subprocess` is used to execute `ripgrep` for search functionality; this is a controlled call to an external, well-defined CLI tool, with `--json` output for safer parsing and arguments passed directly (not via shell), mitigating injection risks. No `eval`, hardcoded sensitive secrets, or obvious network risks beyond local file system access are present. A hardcoded fallback path for `OBSIDIAN_VAULT_PATH` is present in `server.py`, but it's a configuration detail, not a security flaw.

Updated: 2026-01-16GitHub→

Medium Cost

edupage-mcp

by peskaf

Sec8

Serves as an MCP (Multi-Channel Platform) backend server for the EduPage service.

Setup Requirements

⚠️Requires Python 3.13.0 or higher.
⚠️Requires 'uv' package manager for environment setup.

Verified SafeView Analysis

Based on the provided truncated source, no 'eval' calls, obfuscation, hardcoded secrets, or obvious malicious patterns are present. The project relies on the 'fastmcp' dependency, whose security posture is not ascertainable from this snippet alone. As a server, it inherently faces network-based security risks, which are not mitigated or exacerbated by the provided code.

Updated: 2025-11-29GitHub→

Low Cost

rag-mcp-server

by Scarmonit

Sec7

Provides semantic document search and management capabilities as a Model Context Protocol (MCP) server.

Setup Requirements

⚠️Requires Python >= 3.10.
⚠️ChromaDB and ONNX embedding models require local disk space (downloads on first use).
⚠️Needs specific MCP client configuration (e.g., Claude Desktop JSON config).

Verified SafeView Analysis

The `ingest_file` tool allows reading arbitrary local files based on a user-provided path. While `path.resolve()` helps prevent simple path traversal, it does not prevent access to any file the server process has read permissions for (e.g., `/etc/passwd`). The `ingest_url` tool allows fetching content from arbitrary URLs, which could be exploited for Server-Side Request Forgery (SSRF) if the server is deployed in a sensitive network. There are no obvious hardcoded secrets, obfuscation, or direct use of `eval` or `exec`. The risks are primarily due to the nature of the ingestion tools if the server is exposed or run with excessive permissions.

Updated: 2025-12-02GitHub→

High Cost

pysr-mcp-server

by archetana

Sec6

Discovering interpretable mathematical equations from data using symbolic regression for scientific discovery, feature engineering, and data modeling.

Setup Requirements

⚠️Requires Julia backend installation (5-10 minutes) for PySR to function, which is a significant initial setup step.
⚠️Requires Python and specific libraries: `pysr`, `numpy`, `pandas`, (potentially `matplotlib`, `seaborn`, `sympy`, `psutil` based on dependencies in READMEs).
⚠️Relies on temporary files for data exchange between Node.js and Python, which might require appropriate file system permissions and sufficient disk space in `/tmp` or the configured `workDir`.

Verified SafeView Analysis

The server uses Python's `pickle` module for saving and loading PySR models. `pickle` is known to be insecure against maliciously constructed data, which could lead to arbitrary code execution if a loaded model file is untrusted or tampered with. While the server generates these files internally, a compromised file system could exploit this. The Node.js wrapper utilizes `child_process.spawn` to execute Python scripts, but input sanitization and path management appear to be handled carefully by internal logic, reducing direct command injection risk. For other components in the repository (like `app_server.py`, which is not the MCP server itself), a hardcoded fallback `SECRET_KEY` poses a critical vulnerability if deployed in production without modification.

Updated: 2025-11-25GitHub→

Low Cost

mcp-marketplace

by saraivabr

Sec9

A marketplace and API gateway for Model Context Protocol (MCP) servers, enabling discovery, installation, and management of AI application capabilities.

Setup Requirements

⚠️Requires Node.js 18+ for development and production.
⚠️Requires PostgreSQL 16 as the primary database.
⚠️Requires Redis 7 (optional but highly recommended for distributed rate limiting and session management in production).
⚠️Full feature set (e.g., publisher authentication) requires GitHub OAuth App credentials (client ID and secret).
⚠️Email notifications depend on an external service (e.g., Resend) with a configured API key and 'FROM_EMAIL'.
⚠️Analytics and error tracking require API keys for PostHog and Sentry, respectively.

Verified SafeView Analysis

The application demonstrates high security awareness, utilizing bcryptjs for password hashing, JWT for authentication, and retrieving all sensitive credentials from environment variables. The middleware applies comprehensive security headers (CSP, XSS, Frame Options, Referrer Policy, Permissions Policy, CORS) and implements rate limiting per IP and endpoint. The core MCP message router currently returns mock responses, which inherently limits direct execution risks. Future plans for hosted MCPs detail robust sandboxing, resource limits, and container isolation, indicating a strong commitment to security for dynamic execution. Minor deduction for the current design choice of allowing unauthenticated access for 'public servers' in the MCP gateway, although it's within expected design parameters for an open marketplace and not a direct vulnerability in the current mock implementation.

Updated: 2025-11-27GitHub→

Medium Cost

jpilot-mcp

by jmcdice

Sec8

Provides an MCP server to allow AI agents to manage Jira projects and issues.

Setup Requirements

⚠️Requires Python 3.11+.
⚠️Requires a Jira Cloud account and API token.
⚠️Manual editing of `.env` file is necessary after initial setup to configure Jira credentials.
⚠️Requires an MCP client (e.g., Claude Desktop, Augment Code) to interact with the server.

Verified SafeView Analysis

Credentials are loaded from environment variables (.env file), which is a good practice. Interaction with Jira is primarily through the `jira-python` library, which should handle API communication securely. JQL queries are constructed using f-strings with quoted input, relying on the Jira API to prevent injection; however, robust input sanitization within the `jira-python` library is assumed. No direct `eval` or `os.system` calls were found. Custom field IDs for progress reports are hardcoded, but these are configuration values, not directly exploitable code patterns.

Updated: 2025-12-12GitHub→

Medium Cost

AdminAPI_MCP

by ctslone

Sec7

Enables AI assistants like Claude to manage CData Arc instances and workflows through natural language interactions by wrapping the CData Arc Admin API.

Setup Requirements

⚠️Requires a running CData Arc instance with its Admin API enabled and accessible.
⚠️Requires CData Arc API base URL (`CDATA_BASE_URL`) and an admin-level authentication token (`CDATA_AUTH_TOKEN`) configured as environment variables.
⚠️Requires specific configuration within Claude Desktop's `claude_desktop_config.json`, including the correct absolute path to the compiled `dist/index.js` file and proper environment variable setup for Claude Desktop.

Verified SafeView Analysis

The server communicates with a CData Arc instance via HTTP, requiring a sensitive `CDATA_AUTH_TOKEN`. The example `CDATA_BASE_URL` uses plaintext HTTP, posing a network risk if not configured with HTTPS in production environments. The server's own experimental HTTP transport mode explicitly notes it only supports plaintext HTTP, although MCP protocol endpoints are not yet available over it. `CDATA_AUTH_TOKEN` is a critical credential and must be managed securely via environment variables. The primary communication with Claude Desktop uses stdio, which is generally secure.

Updated: 2025-11-17GitHub→

Medium Cost

mcpx

by rossja

Sec9

This project provides an adversarial MCP server for AI red-teaming and safety evaluation of AI tool integrations.

Setup Requirements

⚠️Requires OpenAI API Key (Paid) for the 'Web Search' tool to function.
⚠️Requires Python 3.10+ and uses the 'uv' package manager for dependency management.
⚠️Production deployment involves system-level configurations (Nginx, systemd, Certbot) and 'sudo' access, even with the provided automation scripts.

Verified SafeView Analysis

The project is designed for adversarial testing, explicitly defining its defensive scope. It implements robust security features including HTTPS, OAuth 2.0 with PKCE, JWT tokens with expiration/refresh, bcrypt password hashing, CSRF protection, modern TLS, security headers, and input validation. API keys are managed via environment variables. The primary 'risk' is inherent to its purpose (testing adversarial scenarios), not internal security flaws, assuming proper deployment in a controlled environment as documented.

Updated: 2025-11-17GitHub→

Medium Cost

mcp

by LandonSchropp

Sec7

This repository provides a personal toolkit for AI agents, containing skills and reusable documentation to streamline developer workflows within agent environments like Claude Code.

Setup Requirements

⚠️Requires Bun runtime for TypeScript scripts.
⚠️Primarily designed as a plugin/toolkit for AI agent environments (e.g., Claude Code), not a standalone application.
⚠️The `WRITING_FORMAT` environment variable must be configured with a valid path to a markdown file for certain skills to function correctly.

Verified SafeView Analysis

The toolkit involves scripts that access local files, including potentially sensitive Claude Code conversation logs (`~/.claude/projects/`) for the 'identifying-skill-gaps' functionality. The 'writing-markdown' skill uses `cat "$WRITING_FORMAT"` to output content from an environment variable; if `WRITING_FORMAT` were maliciously configured (e.g., to a path pointing to an executable or a very large file), it could lead to arbitrary code execution or a Denial-of-Service. While the toolkit's design implies trust in the agent and user configuration, these points present potential risks outside of the core code's benign intent. No hardcoded secrets or direct 'eval' calls on unsanitized input were found.

Updated: 2026-01-18GitHub→

Low Cost

mcp-servers

by jacekciszkowski-plum

Sec8

Provides comprehensive JSON validation, analysis, and manipulation capabilities for developers.

Setup Requirements

⚠️Requires jsonschema library for schema validation (pip install jsonschema).
⚠️Requires PyYAML library for YAML conversion (pip install pyyaml).
⚠️Python 3.7+ is required.
⚠️MCP settings file path (`mcp_settings.json`) must be absolute and use double backslashes on Windows.

Verified SafeView Analysis

The server primarily performs local file operations (reading JSON files) and string processing. No direct network calls are made by the server for its core functions. The main potential risk would be file path traversal if the `file_path` arguments supplied by the MCP client (e.g., Claude Code) are not adequately sanitized, allowing access to arbitrary files outside the intended scope. However, this is a client-side sanitation responsibility. No hardcoded secrets or direct code execution from user input ('eval') were found.

Updated: 2026-01-07GitHub→

Medium Cost

wp-media-mcp

by Akungapaul

Sec4

Manages WordPress media library programmatically through a Model Context Protocol (MCP) server, allowing AI agents to upload, retrieve, list, update, and delete media.

Setup Requirements

⚠️Requires a running WordPress instance accessible via REST API.
⚠️WordPress 'Application Passwords' must be configured for authentication.
⚠️Requires Node.js runtime (version >=18 for @modelcontextprotocol/sdk dependency).
⚠️WP-CLI must be installed and configured on the WordPress server (or remotely via SSH) if WP-CLI dependent tools like 'regenerate_thumbnails' are to be used.

Review RequiredView Analysis

The `upload_media` tool handler is vulnerable to Server-Side Request Forgery (SSRF) as it fetches an arbitrary URL provided by the user (`args.source`) without sufficient validation or sanitization. This could lead to internal network scanning, access to sensitive internal resources, or denial-of-service by downloading large or malicious files. Additionally, the WP-CLI integration, while not directly exploitable for command injection in the provided snippet, relies on the `WPCLIClient` implementation in a shared library for robustness. Broad commands like `regenerate_thumbnails` without a specific ID could be resource-intensive if triggered maliciously on a large WordPress site.

Updated: 2025-11-28GitHub→

PreviousPage 402 of 760Next