Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
bitovi icon
Sec8

Provides an MCP tool for AI agents to search enterprise codebases and documentation for development context.

Setup Requirements

  • ⚠️Requires `WEBHOOK_URL` environment variable for the `search` tool to function.
  • ⚠️Requires an MCP client (e.g., VSCode with Cline extension) and specific client-side JSON configuration to load the server.
Verified SafeView Analysis
The server makes an HTTP POST request to a configurable `WEBHOOK_URL`. The security and trustworthiness of this external webhook endpoint are critical, as it processes AI agent inputs and returns content. Ensure the `WEBHOOK_URL` points to a trusted and secured service. No 'eval' or obvious hardcoded secrets found.
Updated: 2026-01-16GitHub→
0
0
High Cost
openpharma-org icon

sec-mcp

by openpharma-org

Sec9

Provides comprehensive access to SEC EDGAR for searching, retrieving, and analyzing public company filings, financial statements, and dimensional XBRL data.

Setup Requirements

  • ⚠️Requires Node.js 18.0.0 or higher.
  • ⚠️The default `User-Agent` email address `your-email@domain.com` in `src/edgar-api.js` should be replaced with a valid email for SEC API compliance and best practices.
  • ⚠️SEC EDGAR APIs have rate limits (e.g., 10 requests/second). Frequent or unoptimized calls may result in temporary blocks or errors.
Verified SafeView Analysis
The server uses official SEC EDGAR API endpoints (data.sec.gov, www.sec.gov) and includes a `User-Agent` header as required by SEC guidelines. It uses `axios` for HTTP requests with timeouts, preventing indefinite hangs. Input validation is present for tool call arguments. No `eval`, dynamic code execution, hardcoded sensitive credentials, or obvious malicious patterns were found. The tool relies on parsing public SEC documents, including iXBRL HTML, which could theoretically contain unexpected structures, but operates within the bounds of publicly available, official data.
Updated: 2025-12-22GitHub→
0
0
Low Cost

todo-mcp

by merlynkdeng-eng

Sec7

A server-side application for managing a personal or collaborative To-Do list.

Setup Requirements

  • ⚠️Node.js (and npm/yarn) environment is required to run the server locally.
  • ⚠️A database or persistence layer (e.g., SQLite, PostgreSQL, MongoDB, etc.) is necessary for storing To-Do items; the specific type is not identified from the provided files.
  • ⚠️A Vercel account and Vercel CLI are required for deploying the server to Vercel.
Verified SafeView Analysis
Without access to the actual code within the 'api' directory, a thorough security audit is not possible. Based on the project type (To-Do list server), typical risks could include input validation vulnerabilities (e.g., XSS if rendering user input directly in a frontend, or injection if using a database), insecure API endpoints, or improper authentication/authorization. The score assumes standard development practices, but specific issues cannot be identified.
Updated: 2025-11-17GitHub→
0
0
High Cost
Bwizrd icon

Trading-MCP

by Bwizrd

Sec2

This MCP server provides a comprehensive platform for backtesting trading strategies, visualizing results with interactive charts, managing technical indicators, and integrating with external systems like Notion and SSH for reporting and diagnostics. It supports both code-based and JSON-configured DSL strategies, such as the Stochastic Quad Rotation.

Setup Requirements

  • ⚠️Requires external API servers running on `localhost:8000` (cTrader/InfluxDB) and `localhost:8020` (VPS Tick Data). An additional API server is started on `localhost:8001` for Notion/SSH integrations.
  • ⚠️Requires numerous environment variables to be configured (e.g., `CTRADER_API_URL`, `VPS_API_URL`, `INFLUXDB_URL`, `VPS_API_KEY`).
  • ⚠️Requires Python 3.10+ and a comprehensive list of dependencies from `requirements.txt` (including `pandas`, `httpx`, `plotly`, `pydantic`, `mcp`, `ta`, `pytz`, `uvicorn`, `fastapi`, `pexpect`, `dotenv`, `influxdb_client`).
Review RequiredView Analysis
CRITICAL: The `eval()` function is used in `shared/strategies/dsl_interpreter/dsl_strategy.py` to dynamically evaluate comparison expressions from JSON configurations. This allows for arbitrary code execution if a malicious DSL configuration is introduced, making the server highly vulnerable to injection attacks. Additionally, the use of `pexpect` for SSH uploads in `api_server.py` (which itself runs on localhost:8001) could pose risks if not handled with extreme care regarding credential management and command sanitization. Diagnostic logs written to `/tmp/` could potentially expose sensitive data if file permissions are not strictly controlled. Extensive use of `httpx` for external API calls (`VPS_TICK_URL`, `CTRADER_API_URL`, InfluxDB) could lead to SSRF or data leakage if URLs or parameters are not properly validated.
Updated: 2026-01-16GitHub→
0
0
Low Cost

spawn

by teggr

Sec8

A Spring Boot application for configuring, building, and deploying new AI applications and agents by managing AI models, MCP servers, and their configurations through a web-based UI.

Setup Requirements

  • ⚠️Requires Java 17 or higher
  • ⚠️Requires Maven 3.6 or higher
Verified SafeView Analysis
The application is a Spring Boot web server running locally on port 8080, using an in-memory H2 database. Configurations are loaded from local CSV and JSON files, mitigating risks from external dynamic configuration. While it allows 'building and deploying' AI applications, the description suggests configuration management rather than arbitrary code execution from user input. Template processing uses placeholders, with password fields masked. As a local development tool, it appears reasonably secure, but production deployment would require standard security hardening.
Updated: 2025-11-17GitHub→
0
0
Low Cost
arnaucast icon

MCP_SERVER

by arnaucast

Sec9

Defines tools for an AI agent to query an SQLite database, specifically for human resources data and database schema exploration.

Setup Requirements

  • ⚠️Requires an agent framework to interpret and execute the defined tools.
  • ⚠️A local SQLite database file named 'dummy_db.sqlite' must exist.
  • ⚠️The 'dummy_db.sqlite' database must contain a 'users' table with 'name', 'salary', and 'department' columns for tools to function effectively.
Verified SafeView Analysis
The SQL statements utilize parameterized queries for user input ('?'), which effectively mitigates common SQL injection vulnerabilities. The 'get_db_catalog' tool exposes the database schema, which is a standard feature but should be noted for access control considerations if used in a sensitive context. No 'eval', obfuscation, hardcoded secrets, or direct network risks (beyond the local database) are present in the provided configuration.
Updated: 2025-12-06GitHub→
0
0
High Cost
consigcody94 icon

vault-weaver

by consigcody94

Sec9

Vault Weaver enables AI-powered knowledge management for Obsidian vaults, allowing users to create, search, link, and visualize notes through natural language.

Setup Requirements

  • ⚠️Requires Node.js 18+ to be installed.
  • ⚠️Requires an existing Obsidian vault (local folder) with read/write permissions.
  • ⚠️The `OBSIDIAN_VAULT_PATH` environment variable must be set to an absolute path of your Obsidian vault for the server to function.
Verified SafeView Analysis
The server primarily interacts with the local file system within the `OBSIDIAN_VAULT_PATH` specified by the user. Filenames are sanitized, and content is written as markdown. There are no direct `eval` calls, arbitrary command execution from user input, or external network calls beyond the standard MCP transport. The main security consideration is the `OBSIDIAN_VAULT_PATH` environment variable; users must configure this to a trusted and isolated Obsidian vault to prevent unintended file system access.
Updated: 2025-11-25GitHub→
0
0
Low Cost
Originate-Group icon

common-mcp-server

by Originate-Group

Sec9

Provides a reusable framework for building HTTP Model Context Protocol (MCP) servers with FastAPI, supporting OAuth 2.1 and Personal Access Token (PAT) authentication.

Setup Requirements

  • ⚠️Requires Docker for the recommended 'container-first' development and production pattern.
  • ⚠️Full OAuth 2.1 functionality requires an external Keycloak or OIDC-compatible identity provider with specific client configurations (e.g., public client, PKCE, specific redirect URIs).
  • ⚠️Personal Access Token (PAT) authentication requires the developer to implement a custom asynchronous `verify_function` (e.g., querying a database) to validate tokens.
  • ⚠️The server is a framework; developers must implement tool definitions and handlers specific to their application logic.
Verified SafeView Analysis
The server design generally follows good security practices for OAuth 2.1 and PAT handling. OAuth token validation uses `python-jose` and fetches JWKS for signature verification, including checks for expiration and claims. PAT authentication relies on a user-provided asynchronous `verify_function` to integrate with a database or external service, which is crucial for secure PAT management. OAuth proxy endpoints are clearly defined and adhere to RFCs for discovery and client registration (returning a pre-configured public client ID with no secret). There are no obvious signs of `eval`, code obfuscation, or hardcoded secrets beyond what's expected in an example's `verify_pat` function, which explicitly notes to use a database in production.
Updated: 2025-12-12GitHub→
0
0
Medium Cost
ysonawan icon
Sec9

This server provides tools for managing and accessing financial portfolio data from Famvest.

Setup Requirements

  • ⚠️Requires Python 3.14 or newer (as specified in pyproject.toml, note that Python 3.14 is not yet released and this may be a typo for an earlier version).
  • ⚠️Requires manual login to famvest.online to obtain a JWT token, which must then be manually added to the Authorization header for subsequent tool calls.
  • ⚠️Relies on the external 'famvest.online' API for all financial data retrieval.
Verified SafeView Analysis
The server includes a BearerAuthMiddleware that enforces authentication for most tools, requiring a JWT token in the Authorization header. No hardcoded secrets, 'eval', or obfuscation are present in the provided code. All external API calls use HTTPS to `famvest.online` and include a 10-second timeout. The overall security is also dependent on the security of the external Famvest API.
Updated: 2026-01-17GitHub→
0
0
Medium Cost
lambda-tuber icon

bokicast-mcp-server

by lambda-tuber

Sec9

This MCP server assists bookkeeping study sessions by AITubers, visualizing journal entries, T-accounts, and balance sheets/income statements.

Setup Requirements

  • ⚠️Requires Windows OS.
  • ⚠️Requires Claude (an MCP client) to be running.
  • ⚠️Requires VOICEVOX for speech synthesis functionality.
  • ⚠️Requires a YAML configuration file to be provided at startup.
Verified SafeView Analysis
The server primarily handles UI visualization and data processing from a well-defined JSON schema provided by the MCP client. It uses `yaml.safe_load` for configuration, mitigating YAML injection risks. Communication is via standard I/O (stdio), reducing network attack surfaces. No direct `eval` or `exec` on untrusted input was found. The use of `json.loads` on tool arguments is standard for MCP, and the defined data structure limits potential abuse to data content rather than code execution.
Updated: 2025-12-27GitHub→
0
0
Medium Cost
hafshari icon

OpenLV

by hafshari

Sec5

Facilitates analysis, transpilation, and AI/LLM insights for LabVIEW VIs by converting them into textual models and ASTs.

Setup Requirements

  • ⚠️Requires LabVIEW environment or SDK for VI Scripting.
  • ⚠️May require an API key for a commercial LLM provider (e.g., OpenAI).
Review RequiredView Analysis
The provided source code is limited to the README, making a comprehensive security audit impossible. No malicious patterns, 'eval', hardcoded secrets, or network risks could be identified or ruled out from the available information. A 'built-in MCP server' implies network exposure, but specific implementation details are unknown.
Updated: 2025-12-04GitHub→
0
0
Medium Cost
toms74209200 icon

mcp-maxima

by toms74209200

Sec1

Provides a Model Context Protocol (MCP) interface for the Maxima symbolic mathematics system, allowing clients to execute Maxima commands.

Setup Requirements

  • ⚠️Requires Maxima symbolic mathematics software to be installed and accessible in the system's PATH.
  • ⚠️Requires Deno 2.0.0+ or Node.js 24+ runtime environment for local execution.
Review RequiredView Analysis
The server directly embeds user-provided 'command' input (from the 'execute-maxima' tool) into a shell command for Maxima's '--batch-string' argument without explicit sanitization or escaping. This creates a critical command injection vulnerability. An attacker could potentially inject arbitrary shell commands or Maxima commands that invoke system calls (e.g., using Maxima's `system()` function) to execute arbitrary code on the host machine. This is a severe security risk.
Updated: 2026-01-15GitHub→
PreviousPage 420 of 760Next