Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
zv-louis icon

mcp7zop

by zv-louis

Sec8

A local MCP server for performing 7-Zip archive and file system operations.

Setup Requirements

  • ⚠️Requires Python 3.12+
  • ⚠️Requires 7-Zip (>=23.0) to be installed locally and configured (either via system PATH or a configuration file at `~/.mcp7zop/config.json`).
  • ⚠️Requires 'uv' package manager for installation.
Verified SafeView Analysis
The server interacts with the local 7-Zip command-line interface via `asyncio.create_subprocess_exec`. This method is generally secure against shell injection when commands and arguments are passed as a list. The primary security consideration is ensuring the configured 7-Zip executable path (either via PATH or `~/.mcp7zop/config.json`) points to a trusted binary, as a malicious configuration could lead to arbitrary command execution. Input paths are validated for existence before being passed to 7-Zip. No 'eval' or obvious obfuscation patterns were found.
Updated: 2026-01-10GitHub→
0
0
Low Cost
tejzpr icon
Sec10

This server provides a comprehensive suite of 70+ mathematical operations through the Model Context Protocol (MCP) for integration with AI assistants and compatible clients.

Setup Requirements

  • ⚠️Requires Go 1.23 or later if running directly from source/go modules.
  • ⚠️For HTTP transport, ensure port 8080 (or `MATH_PORT` specified) is open.
Verified SafeView Analysis
The source code appears to be very secure. It is written in Go, which provides strong type safety and memory management. Input validation is performed for all tool parameters (e.g., `RequireFloat`, `RequireInt`, checking for non-negative numbers where appropriate, division by zero). Critical numerical operations like factorial and Fibonacci use `math/big` for arbitrary precision integers and include resource limits. Error messages returned to the client are generic and do not expose internal stack traces. There are no indications of code injection vulnerabilities, `eval` usage, insecure deserialization, hardcoded secrets, or unintended system access. The server uses standard Go `math` and `math/cmplx` packages for computations and `mcp-go` for protocol handling.
Updated: 2026-01-17GitHub→
0
0
High Cost
chernistry icon

ohmyrepos

by chernistry

Sec8

The MCP Server integrates Oh My Repos' semantic search, RAG chat, and similarity tools with AI coding assistants like Claude Desktop and Cursor.

Setup Requirements

  • ⚠️Requires Python 3.11+
  • ⚠️Requires Qdrant instance (cloud or local Docker)
  • ⚠️LLM and Embedding model choices (e.g., Ollama locally or external APIs like Jina/OpenAI) incur varying costs and setup complexity. Ollama requires a local server running.
  • ⚠️Initial ingestion of repositories triggers embedding/LLM calls, which can be computationally intensive and costly depending on the number and size of repositories.
Verified SafeView Analysis
The server uses Pydantic's `SecretStr` and supports `env`, `keyring`, or `aws` as `SECRETS_BACKEND` for managing API keys and tokens, which is a good security practice. It also implements in-memory rate limiting and token budget tracking to prevent abuse and control costs. Network communication relies on external services (GitHub, LLMs, Qdrant) which inherently carry some risk, but the implementation appears to follow standard secure coding practices. No direct use of `eval` or obfuscation found.
Updated: 2025-11-22GitHub→
0
0
Medium Cost
ZCAD-Products icon

mcp-jobboss2-server

by ZCAD-Products

Sec9

Integrate AI assistants with JobBOSS2 ERP for managing manufacturing operations, including orders, customers, quotes, materials, and employee attendance.

Setup Requirements

  • ⚠️Requires a JobBOSS2 Cloud account with API access enabled (contact ECI Solutions to obtain).
  • ⚠️Requires JobBOSS2 API credentials (API Key, API Secret, and OAuth2 Token URL) which must be configured as environment variables.
Verified SafeView Analysis
The server uses standard OAuth2 for authentication, managing tokens securely. API calls are made using `axios` (TypeScript) or `httpx` (Python), both well-regarded libraries. The `apiCall` method correctly prefixes endpoints with `/api/v1/` and uses `encodeURIComponent` for path parameters, mitigating basic path traversal and injection risks. No direct `eval` or `child_process` execution, or hardcoded sensitive credentials were found. The `custom_api_call` tool allows arbitrary API interaction, which grants broad access and necessitates careful control over the AI's capabilities and trust in its use.
Updated: 2025-12-17GitHub→
0
0
Medium Cost
cnitlrt icon
Sec2

Provides an MCP server to enable AI agents or other clients to perform dynamic debugging using GDB/pwndbg.

Setup Requirements

  • ⚠️Requires Python 3.13 or higher.
  • ⚠️Requires GDB (preferably pwndbg) to be installed and accessible in the server's PATH.
  • ⚠️The `HOST` environment variable defaults to '0.0.0.0', which exposes the server to all network interfaces. This can be a security risk if not explicitly intended.
Review RequiredView Analysis
The `execute` tool allows arbitrary GDB/pwndbg commands to be executed. GDB includes a `shell` command that can execute arbitrary system commands on the host machine. This poses a critical security risk, as a malicious client or compromised LLM could leverage this to gain remote code execution with the privileges of the server process. If the server is exposed to untrusted networks or users, or runs with elevated privileges, this vulnerability is severe. There are no obvious hardcoded secrets or obfuscation, and environment variables are used for network configuration.
Updated: 2025-11-30GitHub→
0
0
Low Cost
metaif icon
Sec9

Provides a Dockerized wrapper for the Longport Model Context Protocol (MCP) server for easy deployment and management of Longport API services.

Setup Requirements

  • ⚠️Requires Docker Engine (20.10.0 or later)
  • ⚠️Requires Docker Compose (1.29.0 or later) for Docker Compose setup
  • ⚠️Requires Longport API credentials (APP_KEY, APP_SECRET, ACCESS_TOKEN) which must be obtained separately from Longport
Verified SafeView Analysis
The Docker wrapper itself follows good security practices: credentials are handled via environment variables with a clear warning not to commit the .env file, the service defaults to a 'read-only' mode, and there are no apparent 'eval' or malicious patterns in the provided scripts. Network binding is to all interfaces (0.0.0.0:8000), but the README correctly advises on firewall configuration for public exposure. The core 'longport-mcp' binary's source is not provided in this repo, so its internal security cannot be fully audited here.
Updated: 2025-11-20GitHub→
0
0
Low Cost
Manideep337 icon

add_mcp_server

by Manideep337

Sec1

This project provides a utility to assist in the setup and management of a Minecraft (MCP) server environment.

Setup Requirements

  • ⚠️Requires Java Runtime Environment (JRE) installed.
  • ⚠️May require specific system dependencies (e.g., `screen`, `curl`, `wget`).
  • ⚠️Requires an existing Minecraft server jar or components to manage.
Review RequiredView Analysis
CRITICAL: No source code was provided for analysis. Therefore, a comprehensive security audit could not be performed. It is impossible to verify the absence of 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns. Running unverified code poses significant security risks.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
SamMorrowDrums icon

mcp-csharp-starter

by SamMorrowDrums

Sec8

A starter template for building Model Context Protocol (MCP) servers in C# with .NET 8, demonstrating core MCP features like tools, resources, and prompts.

Setup Requirements

  • ⚠️Requires .NET 8.0 SDK
Verified SafeView Analysis
The `ask_llm` tool facilitates LLM sampling, which inherently carries risks like prompt injection or potential data exposure if not carefully managed in a production environment. However, the server itself, as a template, does not exhibit direct system-level vulnerabilities like arbitrary code execution or hardcoded secrets in the provided source code.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
bvm-arjun108 icon

mcp-server-weather

by bvm-arjun108

Sec9

Provides current weather, hourly forecasts, and geocoding-based location lookup using the Open-Meteo API.

Setup Requirements

  • ⚠️Requires Python 3.10+
  • ⚠️Requires MCP Python SDK (`mcp[cli]`)
Verified SafeView Analysis
The server utilizes `httpx` for external API interactions, incorporating basic error handling. Input validation is performed for `forecast_days` and `count` parameters to ensure they fall within acceptable ranges. No `eval` statements, obfuscation, hardcoded secrets, or obvious malicious patterns were identified. Generic exception handling in `make_openmeteo_request` could obscure specific types of errors, but this is a minor concern in this context and not a direct security vulnerability.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
heebin2 icon

go-swagger-mcp

by heebin2

Sec8

This server provides a Model Context Protocol (MCP) interface to manage and retrieve Swagger/OpenAPI specifications.

Setup Requirements

  • ⚠️The `SWAGGER_MCP_SERVER_URL` environment variable is required and must point to the URL (or local file path) of a Swagger/OpenAPI specification file, not the MCP server's own endpoint.
  • ⚠️As implemented in `cmd/mcp/main.go`, the server currently loads only a single Swagger specification, even though the underlying `swagger.NewServer` function could technically handle multiple if the environment variable was parsed differently.
  • ⚠️The server defaults to listening on port `8080`, which might conflict with other services running on the host.
Verified SafeView Analysis
The server loads Swagger specifications from pre-configured URLs or local paths at startup. While loading from untrusted URLs could theoretically pose risks (e.g., if a malicious spec is hosted), the implementation only processes URLs provided via the `SWAGGER_MCP_SERVER_URL` environment variable during server initialization, mitigating dynamic SSRF risks from external requests. There are no 'eval' or similar dangerous dynamic code execution patterns. The server binds to port 8080 by default, primarily for SSE communication, and lacks explicit authentication/authorization mechanisms within the provided code, relying on the MCP framework or deployment context for security.
Updated: 2025-12-15GitHub→
0
0
Low Cost
Volk-Prizrak icon

mcp

by Volk-Prizrak

Sec8

Enables AI assistants to safely and efficiently interact with AWS DocumentDB databases through a Model Context Protocol (MCP) interface.

Setup Requirements

  • ⚠️Requires `uv` (Python package manager) and Python 3.10 for local development/execution.
  • ⚠️Requires network access to an AWS DocumentDB cluster with appropriate credentials.
  • ⚠️Requires an SSL/TLS certificate (`global-bundle.pem`) if TLS is enabled for DocumentDB connection.
  • ⚠️The DocumentDB connection string MUST include `retryWrites=false`.
Verified SafeView Analysis
The server runs in read-only mode by default, blocking all write operations and collection modifications, significantly enhancing security. It validates DocumentDB-specific connection parameters like `retryWrites=false` to prevent common misconfigurations. No direct code injection vulnerabilities or `eval` usage detected. However, if the server is run with the `--allow-write` flag and overly permissive AWS credentials or database connection strings, it could perform destructive actions.
Updated: 2025-12-06GitHub→
0
0
Medium Cost
onoda4480 icon
Sec9

Efficiently deliver project documentation to AI agents (e.g., Claude) on demand to optimize token usage.

Setup Requirements

  • ⚠️Requires Python 3.10 or higher.
  • ⚠️The `MCP_DOCS_DIR` environment variable must be set, pointing to the directory containing documents, or ensure documents are in `./docs` relative to the server.
  • ⚠️Integration with Claude Desktop requires manual configuration of `claude_desktop_config.json`.
Verified SafeView Analysis
The server implements robust security measures including explicit path traversal attack prevention via `SafeFileHandler`, file size limits, and input validation for document paths and encodings. Logging is properly configured to `stderr` and files to avoid corrupting STDIO-based JSON-RPC communication. The core MCP server runs on STDIO, which is generally safer for local integration. An optional HTTP API adds a network surface but includes error handling. No 'eval' or obvious malicious patterns were found.
Updated: 2025-12-14GitHub→
PreviousPage 428 of 760Next