Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
kanekitakitos icon

pentest-mcp-server

by kanekitakitos

Sec1

Provides a server to bridge AI assistants with Kali Linux penetration testing tools via Docker's MCP protocol for authorized security assessments.

Setup Requirements

  • ⚠️Requires Docker installed and running
  • ⚠️Requires at least 4GB of RAM allocated to Docker
  • ⚠️Running the container requires the --privileged flag, posing a significant security risk to the host system.
Review RequiredView Analysis
The server uses `subprocess.run(cmd, shell=True)` for executing commands. Many exposed tools (`sqlmap_test`, `wpscan_scan`, `dirb_scan`, `searchsploit_search`, `whatweb_scan`, `gobuster_dir`, `wafw00f_detect`) use user-supplied string inputs directly within f-strings without proper sanitization or escaping, leading to severe command injection vulnerabilities. The `sanitize_target` function used by other tools (`nmap_scan`, `nikto_scan`, `masscan_fast`) is insufficient to prevent injection in a `shell=True` context, and the `ALLOWED_TARGET_PATTERN` regex is defined but never used for validation. Furthermore, the installation explicitly requires running the Docker container with `--privileged` mode, which grants extensive capabilities to the container and critically reduces isolation, making a compromise of the vulnerable server a direct threat to the host system. There are no apparent authentication or authorization mechanisms, meaning anyone who can connect to the server's port can execute these powerful tools.
Updated: 2025-11-22GitHub→
0
0
Low Cost
dvvbk icon

bdl-mcp-ts

by dvvbk

Sec9

Exposes the Polish Central Statistical Office (GUS) Local Data Bank API as Model Context Protocol (MCP) tools, enabling AI assistants to query statistical data.

Setup Requirements

  • ⚠️Requires a Cloudflare account and Wrangler CLI for deployment and development.
  • ⚠️Requires Node.js 18+.
  • ⚠️Relies on the external Bank Danych Lokalnych (BDL) API for all data, which must be accessible.
Verified SafeView Analysis
The server demonstrates good security practices for an API gateway. It uses Zod for robust input validation, preventing malformed requests and potential injection. Environment variables (BDL_API_BASE_URL, DEFAULT_LANGUAGE) are properly configured via Cloudflare Workers environment, avoiding hardcoded secrets. The use of `crypto.randomUUID()` for session IDs is secure. CORS is set to allow all origins (`*`), which is acceptable for a public API but should be noted. No 'eval' or other directly dangerous patterns were found. Relies on the security of the upstream BDL API.
Updated: 2026-01-19GitHub→
0
0
High Cost
dbrown725 icon
Sec3

Spring Boot server demonstrating AI capabilities, RAG, image processing, and human resources data management as a learning tool.

Setup Requirements

  • ⚠️Requires multiple third-party API keys (Brave Search, Gemini, Groq, OpenRouter), some potentially paid.
  • ⚠️Extensive setup for Google Cloud Platform (GCP) including project ID, Storage Bucket, and Application Default Credentials (ADC) for Vertex AI and GCS.
  • ⚠️Manual installation and configuration of Elasticsearch, Kibana, and data ingestion (CSV to index) is required, along with Docker for Prometheus and Grafana.
Verified SafeView Analysis
The README explicitly states, 'Do not use it as a template for a Production application. Giving your LLM access to create, update and delete database rows is probably not a good idea.' This indicates a critical architectural security flaw for production use cases involving sensitive HR data. Additionally, the default Grafana admin password ('mysecretpassword') in `compose.yml` and the lack of security enabled for Elasticsearch (`ES_API_KEY: " "`) pose immediate security risks in any deployed environment. Direct LLM access to database CRUD operations on HR data is highly risky.
Updated: 2026-01-01GitHub→
0
0
Medium Cost
Sec8

Converts natural language QA scenarios into fully automated test execution across UI, API, and Database layers, leveraging AI for scenario parsing and execution.

Setup Requirements

  • ⚠️Requires Node.js 17+ and Playwright 1.48+ for local environment setup.
  • ⚠️Requires an LLM API Key (e.g., OpenAI, Anthropic) for scenario parsing, which may be a paid service.
Verified SafeView Analysis
The server interacts with external LLM providers (OpenAI, Anthropic) which implies sending test scenario data for processing. This carries a data privacy consideration depending on the sensitivity of the test data. The server also executes browser automation, API calls, and database operations which, if given malicious or poorly crafted instructions (via LLM), could potentially interact with unintended systems or data. However, it parses natural language into structured steps, providing a layer of control over direct arbitrary execution.
Updated: 2025-11-20GitHub→
0
0
Medium Cost
alacambra icon
Sec9

Provides Claude with scoped file system access and Git operations within a specific directory of a Git repository, ensuring path traversal protection.

Setup Requirements

  • ⚠️Requires `MCP_SCOPED_REPO_PATH` environment variable to be set.
  • ⚠️Requires Node.js runtime (>=18.0.0).
  • ⚠️Requires `git` command-line tool to be installed and available in the server's execution environment for Git operations.
Verified SafeView Analysis
The server implements robust path validation using `path.resolve` and `path.normalize` to prevent path traversal attacks, explicitly checking if resolved paths remain within the configured `basePath`. File system operations use `fs/promises`. Git commands are executed via `child_process.execFile` which is safer than `exec` as it avoids shell interpretation of arguments, with `cwd` explicitly set to the `repoRoot`. Delete operations are intentionally omitted. No 'eval' or other dynamic code execution is apparent. No hardcoded secrets were found. The server communicates via standard I/O (StdioServerTransport) which typically implies local process communication rather than exposing network ports by default, reducing external attack surface.
Updated: 2025-11-28GitHub→
0
0
Medium Cost
fwextensions icon

datasf-mcp

by fwextensions

Sec9

Provides LLMs with seamless access to San Francisco's open data portal (DataSF), enabling dataset search, schema retrieval, and SoQL querying.

Setup Requirements

  • ⚠️Requires Node.js 18 or higher.
  • ⚠️Optional Socrata App Token (free registration required) for higher API rate limits.
Verified SafeView Analysis
The server uses environment variables for sensitive API tokens (SOCRATA_APP_TOKEN), implements robust input validation using Zod, and includes comprehensive error handling for external API calls, covering network issues, timeouts, and rate limits. No 'eval' or obfuscation found. External network calls are made via axios with a 30-second timeout. Overall, the security practices are sound for an API integration.
Updated: 2025-12-11GitHub→
0
0
High Cost
RafaPan04 icon

mcp-server

by RafaPan04

Sec1

This server provides a Model Context Protocol (MCP) interface to a PostgreSQL database, allowing clients (e.g., AI models) to query the database and retrieve table schemas via defined tools.

Setup Requirements

  • ⚠️Requires a running PostgreSQL database instance.
  • ⚠️Requires environment variables for database connection (DATABASE_URL or POSTGRES_USER, POSTGRES_HOST, POSTGRES_DB, POSTGRES_PASSWORD) and server port (PORT).
Review RequiredView Analysis
CRITICAL SQL INJECTION VULNERABILITY: The `query_database` tool directly executes the `args.query` parameter (`pool.query(args.query)` in `src/tools/queryDatabase.ts`) without any sanitization or parameterization. This allows an attacker to inject arbitrary SQL commands, potentially leading to data exfiltration, modification, deletion, or even remote code execution depending on database configuration. This is a severe vulnerability making the server unsafe to run with untrusted input. No hardcoded secrets were found as database configuration uses environment variables.
Updated: 2026-01-18GitHub→
0
0
High Cost
eic icon
Sec2

The server enables LLMs to interact with XRootD file systems for scientific data access, management, and ROOT file analysis, particularly for the Electron-Ion Collider (EIC) project data.

Setup Requirements

  • ⚠️Requires Node.js 18 or higher.
  • ⚠️Requires XRootD client tools (xrdfs, xrdcp) to be installed and accessible in the system's PATH.
  • ⚠️Requires access to an XRootD server for functionality. ROOT file analysis involves reading entire files into memory, which may cause memory pressure for very large files (>1GB).
Review RequiredView Analysis
CRITICAL: The server is highly vulnerable to command injection. User-provided `path` arguments (and other string arguments used in shell commands) are directly interpolated into `execAsync` calls for `xrdfs` and `xrdcp` without proper shell escaping. This allows a malicious user or LLM to inject arbitrary shell commands (e.g., `list_directory({ path: ".; rm -rf /" })`) that will be executed on the host machine where the MCP server is running. While there is path traversal protection (preventing `../`), this does not mitigate command injection within valid path segments. No hardcoded secrets were found.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
snorlak1 icon

mem0-server-mcp

by snorlak1

Sec7

Provides intelligent memory and knowledge graph capabilities for Claude Code and other AI agents, managing coding preferences, context, and architectural decisions.

Setup Requirements

  • ⚠️Requires Docker installed and running for the full stack.
  • ⚠️Using Ollama as the LLM provider requires a local Ollama server running (e.g., at `http://192.168.1.2:11434`) and specific models (e.g., `qwen3:8b`, `qwen3-embedding:8b`) to be pulled.
  • ⚠️Default database (PostgreSQL, Neo4j) credentials are weak and MUST be changed for production environments to avoid security risks.
  • ⚠️Claude Code (or other MCP clients) requires specific configuration including `X-MCP-Token` and `X-MCP-UserID` headers for authentication.
Verified SafeView Analysis
The default configuration of the Docker Compose stack exposes several services (PostgreSQL, Neo4j, Mem0 API, MCP Server) on default ports to the host, and uses weak default credentials ('postgres', 'mem0graph'). The core Mem0 API (port 8000) does not enforce authentication by default, making it vulnerable if exposed without a reverse proxy or custom API key implementation. However, the documentation (AUTHENTICATION.md, SECURITY.md) explicitly highlights these risks and provides comprehensive guidance and scripts for: token-based authentication for the MCP server, securing default passwords, restricting network access, enabling HTTPS, implementing custom API keys, and audit logging. While the defaults are insecure for production, the project's explicit security awareness and provided solutions mitigate these to a large extent for informed users.
Updated: 2026-01-19GitHub→
0
0
High Cost
ramgeart icon

llm-mcp-bridge

by ramgeart

Sec9

An agnostic MCP server that bridges various OpenAI-compatible LLM APIs, providing tools for LLM model analysis, benchmarking, and quality evaluation.

Setup Requirements

  • ⚠️Requires Node.js version 18 or higher.
  • ⚠️Needs an external LLM server (e.g., LM Studio, Ollama, vLLM) with an OpenAI-compatible API running and accessible.
  • ⚠️An API key (LLM_API_KEY) is required in the environment or as a tool argument when connecting to commercial cloud LLM services (e.g., OpenAI, Groq, Azure OpenAI).
  • ⚠️When configuring for VS Code, the exact absolute path to the compiled 'dist/index.js' script needs to be specified.
Verified SafeView Analysis
The server correctly handles API keys via environment variables or explicit arguments, avoiding hardcoding. Input validation for tool arguments is implemented using Zod, which helps prevent common injection vulnerabilities. The design allows overriding the LLM base URL and API key per tool call, which is a powerful feature but implies that the calling client needs to be trusted to prevent redirection to malicious endpoints, though this is a characteristic of the MCP protocol itself and not a flaw in the bridge's implementation. No 'eval' or other directly exploitable patterns were found in the provided source.
Updated: 2025-12-06GitHub→
0
0
Medium Cost
lukas-bekr icon

fathom-mcp

by lukas-bekr

Sec9

Enables LLMs to interact with the Fathom.video API for meeting recording management, transcripts, summaries, and analytics.

Setup Requirements

  • ⚠️Requires FATHOM_API_KEY environment variable, which must be obtained from Fathom.video settings.
  • ⚠️Requires Node.js (>=18) and npm for installation and build steps.
  • ⚠️Potential for large responses (transcripts, detailed meeting lists) that may be truncated to a CHARACTER_LIMIT of 25000 characters.
Verified SafeView Analysis
The server uses Zod for robust input validation, which is excellent for security. API keys are loaded from environment variables, avoiding hardcoding. Error handling explicitly covers common API errors including authentication (401) and rate limiting (429). There are no 'eval' statements, code obfuscation, or obvious malicious patterns. The main security concern would be ensuring the Fathom API key is kept secure and that the server's network access is properly configured, as it makes external API calls.
Updated: 2025-11-30GitHub→
0
0
Low Cost
NaokiTest icon
Sec5

Provides an API server for simple arithmetic calculations, intended for multi-client access.

Review RequiredView Analysis
Source code was not provided for analysis. Therefore, a thorough check for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns could not be performed. The score reflects a conservative estimate due to lack of verification; actual security cannot be assessed.
Updated: 2025-11-27GitHub→
PreviousPage 405 of 760Next