Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
llamasearchai icon

OpenMCPAgent

by llamasearchai

Sec8

An AI agent that controls a Minecraft bot to perform tasks within the game, leveraging Large Language Models (LLMs) for decision-making and task execution.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid) or Azure OpenAI Service credentials (Paid)
  • ⚠️Requires a running Minecraft server
  • ⚠️Requires Node.js environment
Verified SafeView Analysis
The project uses environment variables for sensitive API keys (OpenAI/Azure) and configurable options for Minecraft server connection details. No 'eval' or obvious malicious patterns found. The primary security considerations involve how the user secures their environment variables and the Minecraft server configuration.
Updated: 2025-11-23GitHub→
0
0
High Cost
T3chFreak13 icon

XcodeDocsMCP

by T3chFreak13

Sec8

Provides a local server for accessing and searching Xcode documentation and SDK symbols efficiently on macOS.

Setup Requirements

  • ⚠️Requires macOS (10.15 Catalina or later).
  • ⚠️Requires Xcode or Command Line Tools for Xcode to be installed and configured for access to SDKs and documentation tools like `swift-symbolgraph-extract`.
  • ⚠️The source code implements a JSON-RPC server communicating via standard input/output (stdin/stdout), not a network-bound HTTP server as suggested by the README's mention of `http://localhost:8080`. A separate wrapper application would be needed to expose it over HTTP or open it in a web browser.
Verified SafeView Analysis
The server uses `Process` to execute system commands (`mdfind`, `grep`, `xcrun`, `sh`). User-provided query parameters (`query`, `symbol`) are sanitized for shell special characters (e.g., single quotes) before being interpolated into shell commands, which is a good practice. Paths used for `grep` commands are derived internally from the SDK path, limiting direct user path injection. No direct outbound network connections or hardcoded secrets were found. The primary risk would be if the sanitization were incomplete or if the system tools themselves had exploitable vulnerabilities, but the current implementation shows reasonable care for its intended local, command-line usage.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
digitalxenon98 icon

sendify-dbschenker-mcp

by digitalxenon98

Sec9

Tracks DB Schenker shipments by reference number, providing structured shipment information including sender/receiver details, package information, and complete tracking history.

Setup Requirements

  • ⚠️Requires Node.js version 18 or higher.
  • ⚠️The `run_command` uses `tsx` to run directly from TypeScript source. This implies `tsx` is available globally via `npx` or locally in `node_modules`.
  • ⚠️The `run_command` requires replacing `/absolute/path/to/sendify-dbschenker-mcp` with the actual absolute path to the project directory.
Verified SafeView Analysis
The server's core functionality involves interacting with an external DB Schenker API that employs a browser-bound CAPTCHA challenge. The server includes a reimplemented, pure JavaScript proof-of-work algorithm to automatically solve these CAPTCHAs. There are no indications of 'eval', code obfuscation, or hardcoded sensitive secrets in the provided source code. Network requests are handled with retries, exponential backoff, and clear error differentiation (rate limiting vs. CAPTCHA challenges). An in-memory cache is used for CAPTCHA-blocked results to prevent redundant API calls. The primary security consideration is the ongoing reliability of the reverse-engineered CAPTCHA solving algorithm if the upstream API's challenge mechanism changes, requiring updates to the server.
Updated: 2026-01-09GitHub→
0
0
Medium Cost
sedoglia icon
Sec9

Enables Claude Desktop to access and analyze FreeStyle Libre continuous glucose monitoring (CGM) data.

Setup Requirements

  • ⚠️Requires Node.js 18.0.0 or higher.
  • ⚠️Requires an active LibreLinkUp account with shared data from a FreeStyle Libre 2 or 3 sensor.
  • ⚠️Requires `keytar` for maximum security, which may need additional system dependencies on Linux (e.g., `libsecret-1-dev`, `gnome-keyring`). A file-based fallback exists if Keytar is unavailable.
  • ⚠️Initial setup requires running a CLI configuration tool (`npm run configure`) to provide LibreLinkUp credentials and preferences.
  • ⚠️Requires Claude Desktop for integration, with manual configuration steps if not using the precompiled bundle.
Verified SafeView Analysis
The server employs robust security measures, including AES-256-GCM encryption for credentials and JWT tokens, with encryption keys stored in the OS keychain (Keytar) or a permission-restricted fallback file. It communicates only with official LibreLinkUp API endpoints, enforces API version 4.16.0+, and includes explicit privacy considerations. No hardcoded secrets or arbitrary network calls were found. The primary security risk is the dependency on `keytar` which requires system libraries on Linux, though a file-based fallback is provided.
Updated: 2026-01-16GitHub→
0
0
Low Cost
asume21 icon
Sec9

Facilitates real-time communication, task management, and shared context exchange between AI agents like Cascade and Codex within an MCP ecosystem.

Setup Requirements

  • ⚠️Requires an existing MCP host environment (e.g., Windsurf) to integrate and run.
  • ⚠️Requires the 'mcp' Python library and its dependencies (`pip install -r requirements.txt`).
Verified SafeView Analysis
The server runs via standard I/O, does not expose network ports, uses in-memory storage, and lacks direct execution of arbitrary user-provided code. Input schemas are defined for tools, reducing injection risks. No hardcoded secrets or 'eval' calls found. It's generally safe for its intended internal use.
Updated: 2025-11-25GitHub→
0
0
Low Cost
Csmally icon

ai-mcp-server

by Csmally

Sec8

The server implements a simple tool service based on the Modular Capabilities Protocol (MCP) for performing basic arithmetic operations (sum).

Setup Requirements

  • ⚠️Requires Node.js runtime.
Verified SafeView Analysis
The server directly parses JSON input from stdin and dynamically dispatches method calls based on the 'req.params.name' field. While the currently defined 'tools' (sum, initialize) are safe and deterministic, this pattern could pose a risk if malicious or unintended functions were added to the 'tools' object in the future, or if the input was not strictly controlled. No 'eval', obfuscation, hardcoded secrets, or direct network risks (as it uses stdin/stdout) are observed.
Updated: 2025-11-27GitHub→
0
0
Low Cost
colinterface icon

bay-wheels-mcp

by colinterface

Sec9

Provides realtime Bay Wheels bikeshare data through an MCP server.

Setup Requirements

  • ⚠️Requires Python 3.11+
  • ⚠️Requires `uv` or `uvicorn` package for local execution/development
  • ⚠️Requires Docker for containerized deployment options
Verified SafeView Analysis
The codebase appears generally secure. No use of dangerous functions like 'eval' or 'exec' was found. It makes external HTTP requests to a public, well-known GBFS endpoint, which is expected for its functionality. There are no hardcoded secrets. Input validation relies on type hints and the underlying FastMCP framework, with internal error handling for exceptions during API calls or data processing. The dependencies are standard and widely used.
Updated: 2025-12-07GitHub→
0
0
Low Cost
AlexKidd727 icon

test_mcp

by AlexKidd727

Sec10

Simple MCP server for testing FastMCP connectivity and demonstrating basic tool functionality.

Setup Requirements

  • ⚠️Requires Python 3.8 or higher.
  • ⚠️Requires 'fastmcp' library to be installed.
Verified SafeView Analysis
The code is simple and directly implements the advertised functionality without any discernible security risks such as dynamic code execution (e.g., 'eval'), hardcoded credentials, or insecure network operations. Functions are basic arithmetic and string manipulation, posing no inherent threat.
Updated: 2025-12-13GitHub→
0
0
High Cost
OnboardedInc icon

onboarded-mcp

by OnboardedInc

Sec1

An MCP server enabling AI assistants to interact with the Onboarded platform's APIs, manage entity state, and optionally access local repository files.

Setup Requirements

  • ⚠️Requires Node.js 18+
  • ⚠️Requires `git` for setup
  • ⚠️Requires `onboarded-cli` for authentication and recommended setup
  • ⚠️Credentials securely stored in macOS Keychain, limiting cross-OS compatibility
Review RequiredView Analysis
CRITICAL VULNERABILITY: The `src/lib/keychain.ts` file uses `child_process.execSync` to run a shell command. The `profile` variable, which is user-controlled input from tool arguments, is directly embedded into the shell command string without sanitization or proper escaping. This creates a shell injection vulnerability (e.g., `profile='myprofile" -d arbitrary-command-injection; echo "'`), allowing an attacker to execute arbitrary commands on the host system where the MCP server is running. While there are path traversal checks for repository tools, this Keychain interaction flaw is severe.
Updated: 2025-12-13GitHub→
0
0
High Cost
eztakesin icon

llm-mcp-gateway-rs

by eztakesin

Sec8

An OpenAI Responses API-compatible gateway for LLM applications that integrates local knowledge base (RAG) and database tool-using MCP servers, designed for use with `big-agi.com`.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid) for upstream LLM and embedding calls.
  • ⚠️Requires Rust 2024 Edition toolchain to build.
  • ⚠️Requires `pdftotext` for PDF indexing (part of Poppler tools) if PDF documents are to be indexed.
  • ⚠️Configuring HTTPS with Caddy and mkcert is recommended for browser compatibility, especially with `big-agi.com`.
  • ⚠️Using the Oracle Database MCP functionality requires Oracle client setup (`TNS_ADMIN`) and a valid connection string.
Verified SafeView Analysis
The server employs robust guardrails for SQL tools, including strict allowlisting of commands (only SELECT/WITH, no DML/DDL/PLSQL) and automatic row limits. It also enforces a tool allowlist for MCP tools. Environment variables for spawning MCP servers (`DOCS_MCP_COMMAND`, `ORACLE_MCP_COMMAND`) could pose a risk if misconfigured to arbitrary executables, but are intended for internal components. Network best practices (CORS, PNA, recommendations for DB network isolation and Caddy/Nginx authentication) are noted in the documentation. No hardcoded secrets or 'eval' equivalents were found in the provided code.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
sarramakhlouf icon

smartDoc_mcpServer

by sarramakhlouf

Sec3

This server provides microservice-style tools for document processing (PDF, CSV) and statistical calculations, intended for integration with AI agents.

Setup Requirements

  • ⚠️Requires Java Development Kit (JDK) 17+ to build and run.
  • ⚠️Requires Apache Maven or Gradle for building the project.
  • ⚠️Designed for integration with Spring AI's Microservice Component Platform (MCP), implying a specific deployment context for AI agent tooling.
Review RequiredView Analysis
The SecurityConfig explicitly disables CSRF protection (`csrf().disable()`) and allows any request without authentication or authorization (`authorizeHttpRequests(authz -> authz.anyRequest().permitAll()`). This makes the server highly vulnerable if exposed to untrusted networks or the public internet, as any user can access all endpoints and functionality without any security checks. It is only safe to run in a tightly controlled, trusted, and isolated internal network where external authentication and authorization are handled by an upstream service.
Updated: 2025-12-08GitHub→
0
0
Low Cost

mcp-retialops

by sarthaksolow

Sec9

Predicts future demand for retail products using historical sales, seasonal events, and historical surge profiles, providing a narrative explanation.

Setup Requirements

  • ⚠️Requires OPENROUTER_API_KEY environment variable (Paid API).
  • ⚠️Requires Python packages: mcp, pandas, openai.
Verified SafeView Analysis
API key loaded from environment variable. No 'eval' or similar dangerous functions observed. Relies on external LLM API (OpenRouter) for narrative generation, which is a controlled network interaction.
Updated: 2025-11-26GitHub→
PreviousPage 429 of 760Next