Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
Sec9

This project provides a local-first system combining a Chrome extension and an MCP server to help users systematically identify, generate, and track fixes for reused and weak passwords with optional AI assistance from Claude Desktop.

Setup Requirements

  • ⚠️Requires Node.js 18+ installed locally.
  • ⚠️Requires enabling 'Developer mode' in Chrome and manually loading an unpacked extension.
  • ⚠️Requires the Claude Desktop app for full AI-assisted functionality and MCP server integration.
Verified SafeView Analysis
The project prioritizes security by storing no plaintext passwords, using SHA-256 for comparison, generating passwords cryptographically (`crypto.randomBytes()`), and keeping all data and processing local ('No Cloud Storage'). Communication between the Chrome extension and MCP server, and between the MCP server and Claude Desktop, occurs locally (stdio), minimizing network exposure. Progress tracking is stored encrypted in Chrome's local storage.
Updated: 2025-11-17GitHub→
0
0
Low Cost
softwarewrighter icon

game-mcp-poc

by softwarewrighter

Sec8

This project implements a Tic-Tac-Toe game with dual interfaces (web UI and MCP server) for human and AI agent interaction, including trash talk.

Setup Requirements

  • ⚠️Requires Rust 2024 Edition, although build scripts assist with installing necessary WASM targets and tools (trunk, wasm-bindgen-cli).
  • ⚠️Python 3 is necessary for executing the provided AI agent example scripts and for JSON pretty-printing via `jq`.
  • ⚠️Manual configuration of Claude Desktop's settings is required to register and use the stdio MCP server binary.
  • ⚠️Specific environment variables (OPENAI_API_KEY, GOOGLE_API_KEY) are needed to run the respective AI agent examples, but not for the server itself.
Verified SafeView Analysis
No 'eval' or obvious malicious patterns found. Hardcoded secrets are not present in the Rust code; AI agent examples explicitly rely on environment variables (e.g., OPENAI_API_KEY, GOOGLE_API_KEY). Network exposure on port 3000 (HTTP API, SSE, HTTP MCP endpoint) and default permissive CORS (allow_origin(Any)) are typical for development but require hardening (e.g., specific CORS_ORIGIN, rate limiting) for production deployment, as acknowledged in the documentation. Database path configurability is good, but misconfiguration could lead to risks if 'GAME_DB_PATH' points to an insecure or sensitive location on the host system.
Updated: 2025-11-20GitHub→
0
0
Low Cost
Rutu-A icon
Sec1

This application facilitates fetching up-to-date documentation from specified API endpoints.

Setup Requirements

  • ⚠️Requires Windows 10+ or macOS 10.14+
  • ⚠️Requires an active Internet connection
  • ⚠️Distributed as a pre-compiled executable, requiring users to download and run a binary from an untrusted source, which carries inherent security risks and limits auditability.
Review RequiredView Analysis
A full security audit cannot be performed as only the `README.md` was provided as 'source code'. The project directs users to download a `.zip` file containing an executable application from `raw.githubusercontent.com`, which is an atypical and less auditable distribution method compared to GitHub Releases. Running pre-compiled executables from unverified sources carries significant inherent security risks, including potential for malware, data exfiltration, or other malicious behavior, especially without the ability to inspect the actual source code. The `README` describes running a desktop application ('double-click the file to run the application') rather than deploying a server from source. This lack of transparency and an unusual distribution method make it impossible to deem safe.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
yushulx icon
Sec8

Provides documentation, code snippets, and API guidance for Dynamsoft barcode and document scanning SDKs (Mobile, Python, Web) to AI assistants for code generation.

Setup Requirements

  • ⚠️Requires Node.js version 18 or higher.
  • ⚠️Relies on local 'data' and 'code-snippet' directories; ensure the repository is correctly cloned or packaged with npx.
  • ⚠️Trial license requires network connection for validation.
Verified SafeView Analysis
The server's core functionality involves reading local files from predefined 'data' and 'code-snippet' directories. Input validation using Zod helps mitigate some risks. The 'generate_project' tool performs file system walks and reads file content, but it's constrained to a maximum depth and explicitly filters out sensitive build directories (e.g., 'node_modules', '.git') and large files, reducing the risk of accidental exposure or resource exhaustion. The trial license included is public and not a sensitive secret. The primary communication mechanism via StdioServerTransport limits external network attack surface for the core server. While local file system interaction always carries some inherent risk, the current implementation shows reasonable precautions.
Updated: 2026-01-19GitHub→
0
0
Low Cost
null-create icon

mcp-web-server

by null-create

Sec9

A local, API-key-free web search server providing unified search tools via Model Context Protocol (MCP) for LLM agents and automation systems.

Setup Requirements

  • ⚠️Requires Python 3.10+
  • ⚠️DuckDuckGo and GitHub APIs are subject to rate-limiting and may return 403 errors if queries are too frequent.
Verified SafeView Analysis
The server's code does not contain 'eval', hardcoded secrets, or obvious malicious patterns. It relies on well-known public search engines (DuckDuckGo, Wikipedia, GitHub Public API) which inherently have rate-limiting. The default bind address of '0.0.0.0' for the HTTP server means it is accessible from any network interface; users should be aware of this and use `HOST_ADDRESS` to restrict access if exposing it to an untrusted network.
Updated: 2025-11-19GitHub→
0
0
High Cost
ContexaAI icon
Sec7

Implements an MCP server for the Notion API, allowing LLMs to interact with Notion pages, databases, and blocks.

Setup Requirements

  • ⚠️Requires a Notion internal integration with specific capabilities (Read content, etc.) and connection to relevant Notion pages/databases.
  • ⚠️Requires a Notion Integration Token (ntn_****) to be provided as part of `OPENAPI_MCP_HEADERS` environment variable.
  • ⚠️File upload parameters are expected to be absolute paths to local files accessible by the server process.
Verified SafeView Analysis
The server parses `OPENAPI_MCP_HEADERS` from environment variables, which includes JSON parsing; this is handled with basic error checking. The `HttpClient` for file uploads uses `fs.createReadStream` with paths provided in tool arguments. While the expectation is for LLMs to provide 'absolute paths to local files' (as per documentation), this pattern could potentially be exploited by a malicious LLM prompt to read or upload arbitrary files accessible to the server process. There's no explicit path sanitization or restriction on `filePath` content before `fs.createReadStream`. The `eval` statement in `OpenAPIToMCPConverter` is commented out, which is good. CORS is enabled for all origins, which is common for API servers but might be a minor concern in certain deployment scenarios.
Updated: 2025-11-20GitHub→
0
0
Medium Cost
AnnsHarry icon

CLAUDEmd

by AnnsHarry

Sec1

A desktop application designed to streamline AI-enhanced collaboration tasks, including content generation, context retrieval, and code auditing, aiming for users without programming knowledge.

Setup Requirements

  • ⚠️Requires downloading and installing a pre-compiled executable from an external GitHub release, which poses a trust risk as no source code is provided for audit.
  • ⚠️Implied reliance on external AI services (Codex, Gemini, Auggie ACE) suggests potential hidden API key requirements or developer-managed backend costs, which are not detailed in the README.
  • ⚠️System requirements (OS, RAM, Storage, Processor) must be met for smooth operation.
Review RequiredView Analysis
A security audit is not possible as no actual source code was provided for the CLAUDEmd application. The 'SOURCE CODE' section only contained a copy of the README.md file. Therefore, it's impossible to check for malicious patterns, 'eval' usage, obfuscation, network risks, or hardcoded secrets. Running pre-compiled software without access to its source code and an independent audit carries significant inherent risk, especially when downloaded as a binary from an unverified source.
Updated: 2026-01-19GitHub→
0
0
High Cost
danielecelsa icon

tavily-mcp-server

by danielecelsa

Sec8

Provides a web search tool for multi-agent systems and applications via the Tavily API.

Setup Requirements

  • ⚠️Requires Tavily API Key (Paid Service)
  • ⚠️Python 3.10+ required
Verified SafeView Analysis
No critical vulnerabilities like 'eval' or hardcoded secrets were found. The server appropriately uses environment variables for API keys. Potential risks are primarily related to how consuming agents handle the raw search results (e.g., if they execute content directly), rather than the server itself, which acts as a wrapper.
Updated: 2025-12-02GitHub→
0
0
Low Cost
mhsenpc icon
Sec9

Interacts with the Wallex Cryptocurrency Exchange API to retrieve account balances and historical OHLC data for trading pairs.

Setup Requirements

  • ⚠️Requires Go 1.21 or higher to build and run.
  • ⚠️A Wallex API key is required for authenticated calls (e.g., get_account_balances).
  • ⚠️Requires local compilation using `go build`.
Verified SafeView Analysis
The server correctly retrieves the API key from environment variables (WALLEX_API_KEY) and uses it to authenticate requests. There are no hardcoded secrets, 'eval' calls, or other immediately apparent malicious patterns. It makes standard HTTPS requests to a known exchange API. Error handling for API responses and missing API keys is present.
Updated: 2025-11-30GitHub→
0
0
Low Cost
mpryc icon
Sec9

Provides real-time and historical currency exchange rates and gold prices from the Polish National Bank (NBP) API.

Setup Requirements

  • ⚠️Requires Python 3.13 or higher
  • ⚠️Requires `uv` package manager for setup and running
  • ⚠️Absolute path to the server directory is needed for Claude Desktop configuration
Verified SafeView Analysis
The server uses `httpx` for external API calls to the public NBP API and includes input validation for all tool parameters, mitigating common injection risks. No hardcoded secrets are evident, and transport mechanisms (`stdio`, `streamable-http` via `uvicorn`) are standard and secure. Error handling for API requests is implemented.
Updated: 2025-11-21GitHub→
0
0
Medium Cost
Amama-Fatima icon
Sec8

Facilitates sequential, step-by-step reasoning for complex problem-solving by an AI agent, supporting thought revisions, branching, and session management.

Setup Requirements

  • ⚠️Requires Node.js version 18 or higher.
  • ⚠️Requires `npm install` and `npm run build` to compile the TypeScript source to JavaScript before running the server.
  • ⚠️The server manages sessions in-memory; restarting the server will clear all active thinking sessions.
Verified SafeView Analysis
The server uses `child_process.spawn` to run the main MCP tool, which is safer than `exec` as it explicitly executes a local Node.js script (`build/index.js`) rather than a shell command. Input validation for tool parameters is handled by Zod schemas, mitigating common injection risks. CORS is set to `origin: "*"`, which is highly permissive; while common for LLM tool servers, it could be a concern in some deployments if not properly secured at the network level. No hardcoded secrets or 'eval' statements were found. Session management includes cleanup for idle and max lifetime sessions, preventing resource leaks.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
shahlaukik icon

money-manager-mcp

by shahlaukik

Sec3

Enables AI assistants to manage personal finances through the Realbyte Money Manager application's web server.

Setup Requirements

  • ⚠️Requires Node.js v18 or higher to run.
  • ⚠️The Realbyte Money Manager app's web server must be enabled on your phone.
  • ⚠️Your computer and phone must be connected to the same Wi-Fi network.
  • ⚠️Requires manual retrieval and configuration of the Money Manager web server's IP address and port (e.g., `http://192.168.1.1:8888`).
Review RequiredView Analysis
CRITICAL VULNERABILITY: The `src/client/http-client.ts` file uses `new Function(`return (${responseText});`)` to parse API responses (line 314). This is equivalent to `eval()` and constitutes a Remote Code Execution (RCE) vulnerability. If the external 'Realbyte Money Manager application's web server' (which is the source of `responseText`) is compromised or returns malicious JavaScript, this server will execute it on the host machine. While the developer states 'This is safe because we're only evaluating data from our known API', this assumption introduces a significant attack vector. Additional risks: File operations (`downloadFile`, `uploadFile`, `summary_export_excel`) take `outputPath` or `filePath` as arguments. If an attacker can manipulate the AI's input (e.g., via prompt injection), they could potentially cause arbitrary file writes or reads on the server's host machine. The dangerous `backup_download` and `backup_restore` tools are explicitly disabled in `src/index.ts`, which is a positive security decision.
Updated: 2025-12-02GitHub→
PreviousPage 450 of 760Next