Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
akutishevsky icon

google-tasks-mcp

by akutishevsky

Sec9

This server acts as a Model Context Protocol (MCP) endpoint, enabling AI clients like Claude to manage Google Tasks (task lists and individual tasks) through natural language conversations.

Setup Requirements

  • ⚠️Requires a Google Cloud Project with the Google Tasks API enabled and OAuth 2.0 Web application credentials (Client ID, Client Secret, Redirect URI) configured.
  • ⚠️A strong, randomly generated `ENCRYPTION_SECRET` environment variable (at least 32 characters) is critical for token encryption and must be set; `npm run generate-secret` is provided to help.
  • ⚠️Utilizes Deno KV for persistence, which means it's primarily designed for Deno environments (e.g., Deno Deploy) and requires Deno CLI for local execution and deployment.
Verified SafeView Analysis
The server demonstrates strong security practices. Sensitive data, specifically Google access and refresh tokens, are encrypted at rest using AES-256-GCM with a PBKDF2-derived key, requiring a secure `ENCRYPTION_SECRET`. Logs are meticulously designed for privacy, automatically redacting tokens, client secrets, and user IDs. It implements OAuth 2.0 with PKCE for secure authentication. Network security includes robust CORS configuration, rate limiting based on IP and path, and the application of various HTTP security headers (e.g., Strict-Transport-Security, Content-Security-Policy). There are no `eval` statements or obvious malicious patterns in the provided source code. Session management includes timeouts and cleanup. Overall, it's very well-engineered for privacy and security.
Updated: 2025-11-20GitHub→
0
0
High Cost
Cyronius icon
Sec6

Integrate Claude Code with SQL Server databases for CLI-driven and MCP-based operations, supporting SQL Server authentication.

Setup Requirements

  • ⚠️Requires SQL Server credentials (SQL_SERVER, SQL_DATABASE, SQL_USER, SQL_PASSWORD) to be configured in a .env file.
  • ⚠️Critical Security: To enforce a truly read-only server, both `READONLY=true` (for MCP tool listing) and `READONLY_MODE=true` (for blocking write operations) MUST be set in the server's environment configuration. Failure to set `READONLY_MODE=true` leaves write operations vulnerable to direct invocation even if the MCP server is configured as `READONLY=true`.
  • ⚠️The MCP server integration is explicitly noted as 'experimental' and not fully tested, suggesting potential instability or incomplete features for Claude Code integration.
Verified SafeView Analysis
The server implements strong SQL injection prevention for SELECT queries, using extensive keyword and pattern validation. DML operations (INSERT, UPDATE, DELETE) correctly utilize parameterized queries and enforce safety mechanisms like requiring a WHERE clause for updates/deletes and explicit confirmation for physical deletions. However, a critical security vulnerability exists in the implementation of read-only mode: the MCP server's tool listing relies on `process.env.READONLY`, while the core database operations (e.g., `InsertData`, `DeleteData`) check `process.env.READONLY_MODE`. If `READONLY=true` is set in the MCP server configuration (as per README) but `READONLY_MODE=true` is not also set in the server's `.env` file, the MCP client will only *list* read-only tools, but direct invocation of write tools via the MCP protocol could still succeed, bypassing the intended security restriction. This creates a false sense of security for read-only deployments.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
gigitiminkova icon
Sec5

This server facilitates the integration of data and operations between Microsoft Excel and a Frappe ERPNext instance, acting as an intermediary API.

Setup Requirements

  • ⚠️Requires a running Frappe/ERPNext instance with API access.
  • ⚠️Frappe API Key/Secret must be configured as environment variables.
  • ⚠️Specific language runtime (e.g., Node.js or Python) and package manager (npm/yarn/pip) are required for dependencies.
Review RequiredView Analysis
Source code was not provided for analysis. Without access to the actual code, a thorough security audit for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns cannot be performed. Therefore, a comprehensive security assessment and a definitive 'safe to run' judgment are not possible. The score reflects this lack of information, defaulting to a cautious neutral.
Updated: 2025-11-26GitHub→
0
0
Medium Cost
vthapar icon

subm-mcp-server

by vthapar

Sec8

Manages Kubernetes resources and ServiceExports across multiple clusters via a unified JSON-RPC API, enabling generic and specialized operations.

Setup Requirements

  • ⚠️Requires Go 1.21 or later for building.
  • ⚠️Requires access to one or more Kubernetes clusters and valid kubeconfig files.
  • ⚠️Kubeconfig files must have appropriate RBAC permissions for the operations the server performs.
Verified SafeView Analysis
The server securely interacts with Kubernetes clusters using client-go and kubeconfig files. It uses URL encoding for label selectors, preventing URL injection. However, the HTTP transport's CORS middleware sets `Access-Control-Allow-Origin: *`, which could be a security risk if the server is exposed publicly without proper authentication/authorization. The inherent power of managing Kubernetes resources means that the server's host environment and the configured kubeconfig files' RBAC permissions must be carefully managed to prevent unauthorized access or privilege escalation.
Updated: 2025-11-26GitHub→
0
0
Low Cost
tzDel icon
Sec8

Manages isolated Git worktrees for AI coding agents to enable parallel work, isolated testing, and controlled merging.

Setup Requirements

  • ⚠️Requires Git CLI (version 2.27.0+ recommended) to be installed and accessible in the system's PATH.
  • ⚠️Operates on a local Git repository, which must exist. By default, it uses the current working directory, but a specific path can be provided via the `-repo` flag.
  • ⚠️If running from source, a Go environment (Go 1.18+ or similar) is required for building and execution.
Verified SafeView Analysis
The server executes Git CLI commands using `os/exec`. While this inherently carries a risk of command injection, the `sessionId` (which forms part of branch and worktree names) is strictly validated via regex (`^[a-z0-9][a-z0-9-]*[a-z0-9]$`), significantly mitigating this risk. No direct 'eval' or arbitrary command execution is observed. Configuration values like repository paths are passed via flags, not directly from untrusted user input within tool arguments, further reducing risk. There are no hardcoded secrets or network listeners beyond stdio interaction.
Updated: 2025-11-26GitHub→
0
0
Medium Cost
tejas-borate-wai icon

python-mcp-server

by tejas-borate-wai

Sec2

A dual-mode server (MCP protocol and REST API) providing LLMs and applications with tools for SQL database operations, weather information, file management, web requests, and system diagnostics.

Setup Requirements

  • ⚠️Requires 'uv' for package management and running.
  • ⚠️Requires 'ODBC Driver 17 for SQL Server' to be installed for database functionality.
  • ⚠️Requires a local SQL Server database named 'IntimeProDB' accessible at 'localhost' for database tools.
  • ⚠️Integration with Claude Desktop requires manual configuration in 'claude_desktop_config.json'.
Review RequiredView Analysis
The server has critical security risks. The `read_file` and `write_file` tools allow arbitrary file system access (read/write to any path the server process has permissions for), posing a significant threat of data leakage or corruption. The `web_request` tool can make arbitrary HTTP GET requests, which could be exploited for Server-Side Request Forgery (SSRF) or to interact with internal network resources. Crucially, the FastAPI REST API server (`api_server.py`) has no authentication implemented (`allow_origins='*'` and no API key enforcement), making all its powerful tools accessible to anyone who can reach the server's endpoint. While SQL queries are restricted to 'SELECT', direct execution of raw query strings could still be vulnerable to injection without robust input sanitization by the ODBC driver. The `DB_CONFIG` is hardcoded, which is generally poor practice but not a direct security flaw in this specific 'trusted connection' setup.
Updated: 2025-11-19GitHub→
0
0
High Cost
majidraza1228 icon

local-mcpserver

by majidraza1228

Sec3

Converts various document types (PDF, DOCX, XLSX, images, etc.) and URLs to Markdown format, offering AI assistant integration, a web interface, and file system automation.

Setup Requirements

  • ⚠️Requires Python 3.10+.
  • ⚠️Manual configuration of `~/.config/mcp/config.json` with absolute paths is needed for AI assistant integration, which can be error-prone.
  • ⚠️Deployment to OpenShift requires Docker/Podman and OpenShift CLI (`oc`) installation, along with registry authentication.
Review RequiredView Analysis
CRITICAL VULNERABILITIES IDENTIFIED: 1. Local File Disclosure/Arbitrary File Read: The `convert_file` and `convert_batch` MCP tools (exposed via both STDIO and HTTP APIs) accept an arbitrary `path: str` argument. A malicious actor could specify paths like `/etc/passwd` to read sensitive server files, or other system files, leading to unauthorized information disclosure. 2. SQL Injection: The `db_preview` tool in `db_server/server.py` constructs SQL queries via f-strings with a user-controlled `table` name (`f"SELECT * FROM {table} LIMIT {limit}"`). This is vulnerable to SQL injection if `table` contains malicious input. Other Concerns: - CORS policy set to `allow_origins=['*']` is overly permissive for production environments. - Hardcoded API key example (`'your-secret-token'`) in `MCP_HTTP_GUIDE.md` might be overlooked and used as-is in deployments. - File uploads are saved to `tempfile.NamedTemporaryFile` before processing, which is standard, but the overall lack of input validation on file paths for conversion tools remains a severe risk.
Updated: 2025-11-27GitHub→
0
0
High Cost
powlite32 icon
Sec4

Provides a Model Context Protocol (MCP) server to connect Large Language Models (LLMs) with Google Docs for document creation, reading, updating, formatting, and structural manipulation.

Setup Requirements

  • ⚠️Requires a Google Cloud Project with Google Docs API and Google Drive API enabled.
  • ⚠️Requires Google OAuth2 Desktop App credentials (`credentials.json`) to be placed in the project root. This file is manually created and contains your client ID, client secret, and redirect URIs.
  • ⚠️The initial OAuth flow requires opening a browser to authenticate and grants access to your Google Docs and Drive. A local web server on port 3001 is used for the OAuth callback, which might conflict with other services.
  • ⚠️The project's README explicitly states 'Bug #3: Case-Insensitive Search Index Bug (search.ts)' and 'Bug #4: SQL Injection in Query (read.ts)' are '⚠️ REQUIRES MANUAL FIX'. These indicate known, unpatched vulnerabilities that could lead to data corruption or injection.
  • ⚠️Integration tests may hit Google API rate limits or quotas, especially with large-scale operations.
Review RequiredView Analysis
The project's README explicitly lists critical bugs that require manual fixes with security implications: 'Case-Insensitive Search Index Bug (search.ts)' could lead to incorrect deletions, and 'SQL Injection in Query (read.ts)' is marked as vulnerable to injection despite some sanitization attempts. These unaddressed vulnerabilities significantly lower the security score. Additionally, sensitive Google OAuth2 credentials are stored in `credentials.json` and `token.json` files locally; while a common pattern, their security depends entirely on the host environment's file system permissions.
Updated: 2026-01-19GitHub→
0
0
Low Cost
pasie15 icon
Sec9

This server provides an MCP interface to the MusicGPT API, enabling AI-powered music generation, voice manipulation, audio processing, and analysis.

Setup Requirements

  • ⚠️Requires a MusicGPT API Key, obtained from the MusicGPT API Dashboard, which is associated with usage-based costs and rate limits.
  • ⚠️Requires Node.js version 18.0.0 or higher to run.
  • ⚠️This server is designed to operate within a Model Context Protocol (MCP) client environment (e.g., Claude Desktop, Cline) and is not intended to be run as a standalone HTTP server.
Verified SafeView Analysis
The server correctly handles API key management via environment variables, preventing hardcoded secrets. It includes robust error handling for external API interactions, which helps prevent sensitive backend details from leaking and provides specific guidance (e.g., for authentication or rate limits). The server operates via stdio, limiting its direct network exposure as it's designed to be run as a child process by an MCP client. Input validation is present for tool arguments. No discernible malicious patterns or unsafe code execution mechanisms (like 'eval' or arbitrary 'child_process' execution) were found.
Updated: 2025-12-13GitHub→
0
0
Medium Cost
ShootaOT icon

db-mcp

by ShootaOT

Sec1

Run an SQLite Model Context Protocol (MCP) server that provides secure access via OAuth 2.0, tool filtering, and options for WASM or native SQLite versions to manage databases effectively.

Setup Requirements

  • ⚠️Requires Node.js version 20 or higher.
  • ⚠️OAuth 2.0 setup with an authorization server like Keycloak is complex, requiring realm, client, scopes, and user creation.
  • ⚠️The 'better-sqlite3' native adapter is an optional dependency and may require additional system configuration (e.g., SpatiaLite extension might need to be available).
Review RequiredView Analysis
The server has critical SQL injection vulnerabilities. Numerous tools, such as `sqlite_vector_search`, `sqlite_text_split`, `sqlite_json_extract`, `sqlite_stats_basic`, and many others, accept user-provided SQL fragments like `whereClause` or `orderBy` as direct string inputs. These inputs are then concatenated directly into the SQL queries executed against the database without proper escaping or parameterization. This allows an attacker to inject arbitrary SQL, leading to data exfiltration, modification, deletion, or even full database compromise. While a `validateQuery` method exists, it performs only basic pattern matching and is insufficient to prevent sophisticated SQL injection attacks. The `no-console` ESLint rule is good for MCP's stdio transport, and OAuth implementation uses the `jose` library correctly, but these do not mitigate the core SQL injection risk.
Updated: 2026-01-19GitHub→
0
0
Low Cost
Geoff-Robin icon
Sec8

This server provides an API endpoint for detecting whether an input email text is a normal email or a phishing email using a pre-trained ONNX machine learning model.

Setup Requirements

  • ⚠️Requires the 'tfidf_logistic_regression.onnx' model file to be manually placed in the 'models/' directory relative to the executable path.
  • ⚠️'onnxruntime-node' is a native dependency which might require specific system build tools or pre-built binaries for the target OS/architecture, potentially complicating local setup outside Docker.
Verified SafeView Analysis
The server uses Express with 'morgan' for logging and handles JSON input. It implements an MCP server with a single tool for phishing detection. The core logic involves loading an ONNX model and performing inference. There are no obvious 'eval' calls, obfuscated code, or hardcoded secrets found in the provided snippets. The input 'emailText' is passed to 'onnxruntime-node' as a string tensor, which is generally safe against command injection for the ONNX runtime itself. Network risks are typical for any exposed API endpoint, but no specific vulnerabilities are introduced by the code itself beyond standard web server concerns (e.g., DoS, input validation where applicable, though 'z.string()' provides basic type validation). The server correctly handles unsupported HTTP methods (GET, DELETE) with a 405 response.
Updated: 2025-11-19GitHub→
0
0
Low Cost
KennethCarlos icon

fabric-atelier

by KennethCarlos

Sec9

This repository provides a collection of Python programming examples and exercises, demonstrating fundamental concepts, data structures, simple algorithms, and basic machine learning techniques, primarily for educational purposes.

Setup Requirements

  • ⚠️Requires scikit-learn library (pip install scikit-learn)
Verified SafeView Analysis
The codebase consists of standalone Python scripts primarily for learning purposes. It does not expose any network services, use 'eval', or contain hardcoded sensitive information. User input is taken directly via `input()` in several scripts, which is acceptable for local console applications but would require sanitization in a more robust application context (e.g., web server). Overall, it is safe for its intended use.
Updated: 2026-01-19GitHub→
PreviousPage 430 of 760Next