Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
CyprianFusi icon
Sec8

A Model Context Protocol (MCP) server for intelligent research data management using vector embeddings and semantic search.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid)
  • ⚠️Python 3.13+
  • ⚠️AWS EC2 instance (for deployment)
Verified SafeView Analysis
The server correctly externalizes sensitive API keys via environment variables or a .env file. User inputs for topic names are sanitized, preventing path traversal attacks from the `delete_research_topic` tool that uses `shutil.rmtree`. No `eval` or direct command injection vulnerabilities were found. Critical security considerations for production deployments, such as implementing authentication, securing EC2 instances with appropriate security groups, and using IAM roles/AWS Secrets Manager, are highlighted in the README.
Updated: 2025-12-13GitHub→
0
0
Medium Cost
emeinardus icon
Sec6

Enables an AI agent to create, analyze, fix, and run Flutter projects following Clean Architecture patterns locally.

Setup Requirements

  • ⚠️Requires Flutter SDK (3.0.0+)
  • ⚠️Requires Android Studio for Android features
  • ⚠️Manual configuration of Claude Desktop with an absolute path is required
  • ⚠️Untested on macOS and Linux, potential for platform-specific issues
Verified SafeView Analysis
The server executes local commands (e.g., `flutter`, `dart`, `gradle`) and performs file system operations (read, write, create) based on input from the AI client. While running locally and configured by the user, this inherent capability introduces a risk of unintended or malicious command execution if the AI client's input is compromised or malformed. Input validation and sanitization are critical for parameters like `path` and `file_path` to prevent directory traversal or command injection.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
InboundCPH icon

architect-mcp

by InboundCPH

Sec9

An autonomous Presentation Architect MCP server for Google Slides, managing a digital twin of presentations, generating styled charts via QuickChart.io, and automating slide updates.

Setup Requirements

  • ⚠️Requires Google Cloud Service Account credentials (GOOGLE_CREDENTIALS_BASE64 or GOOGLE_CREDENTIALS_JSON environment variable or 'credentials.json' file).
  • ⚠️Requires Google Slides API and Google Sheets API to be enabled in Google Cloud Console.
  • ⚠️The Service Account must have 'Editor' access to all Google Presentations and Sheets it interacts with.
Verified SafeView Analysis
The codebase demonstrates good security practices: uses parameterized SQL queries to prevent injection, handles Google API credentials via environment variables or file (not hardcoded), and makes external network requests using 'requests' with timeouts. No 'eval' or obfuscation is present. JSON parsing for configuration values is handled by the standard library's 'json.loads', which is safe, though any future interpretation of these parsed structures could introduce risks if not carefully managed.
Updated: 2025-11-28GitHub→
0
0
Low Cost
Arenjb19 icon

MCP-Server-

by Arenjb19

Sec1

To host a server, likely for multiplayer game protocol interaction or general network services.

Review RequiredView Analysis
No actual source code was provided for analysis beyond a truncated README.md file. Therefore, a comprehensive security audit is impossible, and the score reflects a complete lack of visibility into the project's security posture.
Updated: 2025-11-20GitHub→
0
0
Medium Cost
taocodao icon
Sec7

AI-powered multimodal content analysis for various file types (image, PDF, text, audio, video) using Google Gemini.

Setup Requirements

  • ⚠️Requires Google Gemini API Key (paid tier likely for high usage).
  • ⚠️Requires Perplexity API Key (for advanced web context/RAG features, as seen in other related files within the repository).
  • ⚠️May require Chromium/Puppeteer dependencies in the deployment environment if full 'gemini-file-search' MCP features (like website crawling) are enabled.
Verified SafeView Analysis
The server uses Multer with memory storage and a 200MB file size limit, along with a whitelisted MIME type filter, which are good security practices. API keys are sourced from environment variables. Temporary files are created for PDF processing and then deleted, which is generally safe but could pose a risk if cleanup fails under high load. Error responses might expose internal server details in case of failures, which should be made more generic in production.
Updated: 2025-12-27GitHub→
0
0
High Cost
expanso-io icon

mcp.expanso.io

by expanso-io

Sec3

A Model Context Protocol (MCP) server for semantic search and retrieval over Expanso documentation, leveraging Cloudflare Workers, Vectorize, and LLMs to answer natural language queries and generate pipeline configurations.

Setup Requirements

  • ⚠️Requires a Cloudflare account with a Workers paid plan for Vectorize.
  • ⚠️Requires installation and configuration of the Wrangler CLI.
  • ⚠️Requires manual creation and configuration of Cloudflare KV Namespace and Vectorize Index via `wrangler` CLI.
  • ⚠️Requires `CLOUDFLARE_API_TOKEN` for content indexing and deployment.
  • ⚠️Relies on an external `validate.expanso.io` API for pipeline schema and validation, which is a critical external dependency.
Review RequiredView Analysis
The `get_resource` MCP tool directly fetches content from a user-provided URI without validation or sanitization. This constitutes a critical Server-Side Request Forgery (SSRF) vulnerability, allowing an attacker (or a malicious AI prompt) to potentially access internal network resources, local files (if the runtime permits), or perform port scanning by crafting a URI like `http://localhost/admin` or `file:///etc/passwd`.
Updated: 2026-01-16GitHub→
0
0
Low Cost
Zarak-Shah-ji icon

MCP_Server

by Zarak-Shah-ji

Sec9

This project provides a Model Context Protocol (MCP) server to expose specific tools or functions for AI models or agents to consume.

Setup Requirements

  • ⚠️Requires the 'mcp' CLI tool to be installed and available in the environment.
Verified SafeView Analysis
The provided code for `server.py` is minimal and clean, with no apparent use of 'eval', 'exec', hardcoded secrets, or suspicious network patterns. The security relies heavily on the underlying `mcp.server.fastmcp` framework, which is not provided for audit. Based on the given snippet, it appears safe.
Updated: 2025-12-07GitHub→
0
0
Medium Cost
Sec7

Automatically generates a time-blocked task list for the next day by fetching calendar events, new tasks, and outstanding items, then prioritizing them intelligently.

Setup Requirements

  • ⚠️Extensive Google Cloud Project configuration required for APIs (Calendar, Docs, Drive) and OAuth 2.0 credentials.
  • ⚠️Requires an OpenRouter API Key for local server setup.
  • ⚠️A ChatGPT Plus subscription is needed for the recommended ChatGPT client and Fly.io server option.
Verified SafeView Analysis
The application integrates with Google Calendar, Docs, Drive, and OpenRouter APIs. It handles OAuth tokens and stores them locally (`server/data/tokens/default.json`). The local setup requires specific OAuth redirect URIs. Deploying to Fly.io for the ChatGPT option would require further security considerations for public exposure and data handling, but the local setup instructions do not indicate immediate vulnerabilities in the provided steps.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
AymThomas icon

mcp

by AymThomas

Sec2

An open-source Yang Browser and NetConf/RESTConf RPC Builder application to experiment with Yang Data Models and interact with network devices.

Setup Requirements

  • ⚠️Requires Python 2.7 (End-of-Life and insecure).
  • ⚠️Requires a browser with Flash plugin (End-of-Life and insecure).
  • ⚠️Requires Graphviz for dependency graph visualization.
  • ⚠️Not supported on Windows.
Review RequiredView Analysis
CRITICAL: Multiple severe vulnerabilities identified: 1. Command Injection: The `bulkupload.py` script uses `os.system()` with user-controlled `git_path` and `dir_path` for `git clone` and `cp` commands, leading to arbitrary command execution. 2. Plaintext Password Storage: The README explicitly states that 'passwords are transmitted in plaintext' during user account creation and 'device login info is not secured' for device profiles. This means credentials are stored unencrypted in the database. 3. Flash Dependency: The README states 'Browser with latest flash plugin (tested with google chrome)' is a prerequisite. Flash is End-of-Life and notoriously insecure, posing a significant attack surface. 4. Weak NetConf Security: `ncclient.manager.connect` is configured with `hostkey_verify=False` in `pyscript.py` and `runner.py`, making NetConf connections vulnerable to Man-in-the-Middle (MITM) attacks. 5. Dangerous `eval()` Usage: `runner.py` uses `eval('requests.' + method.lower())`. While `method` appears constrained by `rest_ops`, using `eval` is generally a high-risk practice and can be exploited if input sanitization is insufficient. 6. Deprecated Python Version: The project explicitly requires Python 2.7, which is End-of-Life and no longer receives security updates, exposing the application to known vulnerabilities. 7. Development Server in Shared Environment: The `start.sh` script runs `python manage.py runserver`, which is Django's development server, not suitable or secure for production or shared server environments, as indicated in the README for shared server setup.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
Hanzlazafar1 icon
Sec3

An AI assistant for answering technical questions by searching documentation for specific Python libraries and summarizing content using a Large Language Model.

Setup Requirements

  • ⚠️Requires a Groq API Key (paid service) to interact with the LLM (currently hardcoded in utils.py, which must be fixed to use `os.getenv('GROQ_API_KEY')`).
  • ⚠️Requires a Serper API Key (paid service) for web search.
  • ⚠️Requires Python 3.11+.
  • ⚠️Requires `uv` for running the server (specified in StdioServerParameters).
Review RequiredView Analysis
A Groq API key is hardcoded directly in `utils.py`, despite a comment indicating it should use an environment variable. This makes the key visible in source control and is a critical security vulnerability. It must be replaced with `os.getenv('GROQ_API_KEY')` for safe operation. The application also performs web scraping (fetching content from arbitrary URLs via Serper search results), which introduces a potential attack surface if malicious content is retrieved, although `trafilatura` is used for content extraction to mitigate some risks.
Updated: 2025-11-28GitHub→
0
0
Low Cost
itsubaki icon
Sec8

An MCP server for running, sharing, and editing quantum circuits written in OpenQASM 3.x, backed by the Quasar quantum simulator.

Setup Requirements

  • ⚠️Requires a Google Cloud Platform account for deployment to Cloud Run.
  • ⚠️Requires the `quasar` quantum simulator service (github.com/itsubaki/quasar) to be deployed as a prerequisite to Cloud Run.
  • ⚠️Requires `IDENTITY_TOKEN` and `TARGET_URL` environment variables to be configured for authentication and communication with the `quasar` service.
Verified SafeView Analysis
The server fetches grammar files (`.g4`) from hardcoded GitHub URLs using `HttpGet`. While these URLs are fixed and appear benign, performing HTTP requests within resource handlers could potentially be a vector for abuse if URLs were dynamic or user-controlled. However, in this implementation, the URLs are static. Sensitive credentials (`IDENTITY_TOKEN`, `TARGET_URL`) are correctly loaded from environment variables, which is a good security practice. No `eval` or obvious obfuscation detected.
Updated: 2026-01-09GitHub→
0
0
Low Cost
kodexArg icon

syv-mcp-tools

by kodexArg

Sec2

Provides an MCP server to validate and extract metadata from Markdown files according to project-specific rules.

Setup Requirements

  • ⚠️Requires Python 3.12+
  • ⚠️Requires `uv sync` for dependency installation (not `pip`)
  • ⚠️Requires ANTHROPIC_API_KEY in `.env` for setup, though the provided server functions do not directly use it.
Review RequiredView Analysis
CRITICAL: The server endpoints `validar_metadatos_markdown` and `obtener_metadatos_markdown` directly accept `ruta_archivo` (file path) as a parameter. This creates a severe path traversal vulnerability, allowing an attacker to read the contents of arbitrary files on the server's filesystem (e.g., `/etc/passwd`, `/etc/shadow`, configuration files) by providing manipulated paths. This information disclosure risk is critical.
Updated: 2025-12-06GitHub→
PreviousPage 448 of 760Next