Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
Aswinks01 icon
Sec4

End-to-end application for generating high-quality 3D GLB assets from text prompts or existing images, leveraging AI models like Z-Image-Turbo and TRELLIS.2.

Setup Requirements

  • ⚠️Requires NVIDIA GPU with CUDA (compute capability 8.0+) and Flash Attention 3 for acceptable performance; falls back to CPU but will be extremely slow.
  • ⚠️Requires the `flex_gemm` library, which may have complex installation requirements specific to CUDA environments.
  • ⚠️Relies on an external Gradio client (`briaai/BRIA-RMBG-2.0`) for background removal, necessitating an active internet connection.
Review RequiredView Analysis
Uses `trust_remote_code=True` when loading models from Hugging Face (e.g., `DINOv3ViTModel`, `AutoModelForImageSegmentation`), which allows arbitrary code execution from external repositories and is a significant supply chain security risk. Also connects to an external Gradio client (`briaai/BRIA-RMBG-2.0`) for background removal, sending user input images to a third-party service.
Updated: 2026-01-19GitHub→
0
0
Low Cost
pixelbadger icon
Sec9

Hosts a Model Context Protocol (MCP) server to enable AI assistants to perform BM25, vector, or hybrid search on indexed content for Retrieval-Augmented Generation (RAG) workflows.

Setup Requirements

  • ⚠️Requires .NET 9.0 runtime.
  • ⚠️Requires OpenAI API Key (Paid) if vector or hybrid search modes are used, or during content ingestion.
  • ⚠️When integrating with Claude Desktop, the `--index-path` argument for the `serve` command must be an absolute path.
Verified SafeView Analysis
The server operates as a stdio-based MCP server, which generally limits network attack surface as it communicates via standard input/output, often as a local child process. It requires API keys (OPENAI_API_KEY) to be provided as environment variables, which is a good security practice. No 'eval' or code obfuscation is apparent from the provided truncated source code. Overall security is dependent on the underlying .NET runtime and the Lucene.NET/SQLite-vec libraries it utilizes.
Updated: 2026-01-18GitHub→
0
0
Low Cost
ajentsor icon

llm-radar

by ajentsor

Sec9

Provides real-time, curated intelligence about major AI models (OpenAI, Anthropic, Google) to AI assistants via the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires Python 3.10+.
  • ⚠️The live server component relies on the availability and integrity of an external public JSON data feed for model information (`https://llm-radar.ajents.company/models.json`).
  • ⚠️To generate the model data locally (rather than relying on the public feed), API keys for OpenAI, Anthropic, and Google (paid services) are required.
  • ⚠️Requires an MCP-compatible client to connect and utilize the exposed tools and resources (e.g., Claude Desktop, or other AI assistants supporting MCP).
Verified SafeView Analysis
No direct use of 'eval' or obvious obfuscation detected. API keys for data fetching are managed through environment variables, which is a good practice. The MCP server component loads its model data from a specific external public URL (`https://llm-radar.ajents.company/models.json`). While the server code itself is robust, its real-time data integrity and availability are dependent on this external service. The data generation process (which involves calls to OpenAI, Anthropic, and Google APIs and enrichment by Claude) runs offline as a daily GitHub Action, reducing the direct live server's exposure to those API interactions.
Updated: 2026-01-17GitHub→
0
0
Medium Cost
CaowardlyLion icon

grapher-mcp

by CaowardlyLion

Sec8

Provides an AI-powered Model Context Protocol (MCP) server for Penn Electric Racing telemetry data and CAN variable search and analysis.

Setup Requirements

  • ⚠️Requires Google Gemini API Key (Paid)
  • ⚠️Requires S3 bucket configuration for 'GeneratedCanIds.xml' (or local file path via CAN_DEFINES_PATH)
  • ⚠️Requires a compatible MCP client (e.g., Claude Desktop, custom Gemini client) for full interaction capabilities.
Verified SafeView Analysis
The project uses `os.getenv` for loading sensitive credentials (Gemini API key, S3 credentials), preventing hardcoding. File uploads are handled with `werkzeug.utils.secure_filename` and stored in a designated `uploads` directory, mitigating path traversal vulnerabilities for uploaded files. CSV parsing in `perda` appears to safely handle data types without executing arbitrary code. XML parsing for CAN definitions uses `lxml`, which is generally safe. The Flask web server utilizes standard practices like session management. No `eval` or direct shell execution with unvalidated user input was observed.
Updated: 2025-11-23GitHub→
0
0
Low Cost

SerialMemoryServer

by sblanchard

Sec8

A temporal knowledge graph memory system for AI agents, enabling semantic search, multi-hop reasoning, and user persona tracking.

Setup Requirements

  • ⚠️Docker & Docker Compose required for infrastructure (PostgreSQL, Redis, RabbitMQ)
  • ⚠️Python 3.11+ required
  • ⚠️Manual download of spaCy language model (en_core_web_sm)
Verified SafeView Analysis
The project uses parameterized queries for PostgreSQL, mitigating SQL injection risks. Environment variables are used for sensitive configurations (e.g., database credentials), though default values for local development are present. HTTP services for ML inference are exposed locally (ports 8765, 8766 in tools directory) which would require proper firewalling in a production environment. The Ollama-based extraction service (tools/extraction_http_service.py) uses HTTP calls to a local Ollama instance, which is generally safe for local use but could be a vector if configured to a malicious remote endpoint (not the default setup). The Python MCP server itself is STDIO-based, limiting direct network exposure.
Updated: 2025-11-27GitHub→
0
0
Low Cost
berserus icon
Sec10

A simple repository likely intended for a Git workshop or tutorial.

Verified SafeView Analysis
Only README.md content was provided in the source code. No executable files were present for security analysis. Thus, no 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns could be identified.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
MAnders333 icon

mem0-mcp-server

by MAnders333

Sec8

Provides a Model Context Protocol (MCP) server for persistent memory, enabling AI agents to store and semantically search conversational context.

Setup Requirements

  • ⚠️Requires an OpenAI API Key (or compatible LLM API Key via `LLM_API_KEY` or `OPENAI_API_KEY`) for embeddings and LLM calls, incurring paid service costs.
  • ⚠️Requires Python 3.10 or higher.
  • ⚠️By default, stores ChromaDB data locally in '/app/data' within the container; ensure appropriate volume mapping for data persistence when using Docker.
Verified SafeView Analysis
The server correctly sources API keys and sensitive URLs from environment variables, avoiding hardcoded secrets. Transport security for FastMCP is configured with DNS rebinding protection and allowed hosts. No direct code injection vulnerabilities (e.g., `eval`, `exec`) were identified. The use of external dependencies like `mem0ai` and LLM providers implies inherent risks that are outside the direct scope of this code analysis.
Updated: 2025-12-08GitHub→
0
0
Low Cost
louisburroughs icon

durion-chat

by louisburroughs

Sec7

Provides a Moqui-hosted chat UI for interacting with a backend MCP server, facilitating operational support, diagnostics, and guided workflows.

Setup Requirements

  • ⚠️Requires a running Moqui framework instance for deployment and hosting.
  • ⚠️Requires a separate backend MCP server endpoint to function.
Review RequiredView Analysis
The provided source code only contains the README.md. A full security audit for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns is not possible without the application's actual code. The README states that security policy definition is out of scope and relies on platform authentication/authorization, which is a reasonable design for a UI component. No immediate red flags are present in the provided text.
Updated: 2026-01-17GitHub→
0
0
Medium Cost
ShogoOkamoto icon

google-search-mcp

by ShogoOkamoto

Sec9

Enables Large Language Models (LLMs) to perform real-time web searches using Google Custom Search Engine.

Setup Requirements

  • ⚠️Requires a Google Custom Search API key (from Google Cloud Console) and a Custom Search Engine ID (from Programmable Search Engine).
  • ⚠️Google Custom Search API usage can incur costs depending on usage beyond the free tier.
  • ⚠️Windows users integrating with Claude Desktop might need to specify the full path to their Python executable.
Verified SafeView Analysis
The server loads sensitive credentials (Google API Key, CSE ID) from environment variables or a .env file, which is a good practice. It uses `httpx` for network requests to a legitimate Google API endpoint. Input parameters are validated (e.g., `num_results` clamping). The server does not use `eval` or other inherently dangerous functions. The `query` string is passed directly to the Google Custom Search API, relying on Google's API to handle potential sanitization. Error messages expose `response.text` which, in rare cases, could contain sensitive information if Google's API returned such in an error, but this is a minor concern.
Updated: 2025-11-29GitHub→
0
0
Medium Cost
annmalavet icon

MCP-SERVER

by annmalavet

Sec8

This server acts as a Model Context Protocol (MCP) tool provider, exposing functionalities like email search, appointment creation, and email sending for consumption by an MCP client or AI agent.

Setup Requirements

  • ⚠️Requires `RESEND_API_KEY` environment variable for email sending functionality.
  • ⚠️Requires `EMAIL_SEARCH_API_URL` environment variable pointing to an external email search service.
  • ⚠️Requires `APPOINTMENT_SERVICE_URL` environment variable pointing to an external appointment booking service.
Verified SafeView Analysis
The server correctly uses environment variables for API keys and external service URLs, preventing hardcoded secrets. Input validation is performed using Zod schemas for the registered tools. The use of `cors({ origin: true })` allows requests from any origin, which is common for public APIs but could be a concern if strict origin control is needed without relying on the MCP client's authentication/authorization layers. No 'eval' or obvious malicious patterns were found. The security of the external services (Resend, email search API, appointment service) is outside the scope of this code.
Updated: 2025-11-26GitHub→
0
0
Low Cost
cayour icon
Sec9

Provides real-time weather forecasts and alerts by integrating with the National Weather Service (NWS) API, primarily intended as a tool for an LLM.

Setup Requirements

  • ⚠️Requires the 'mcp-server' Python library to be installed.
  • ⚠️Requires the 'httpx' Python library for async HTTP requests.
  • ⚠️Designed to be run as a sub-process by an MCP client that handles its standard input/output (stdio).
Verified SafeView Analysis
The server code appears largely safe. It makes external HTTP requests to a known public API (NWS). Inputs (latitude, longitude, state) are used to construct API URLs, with coordinates rounded to prevent obvious injection. Error handling for HTTP requests is present. No 'eval' or other highly dangerous functions are used. There are no hardcoded API keys or sensitive credentials. The server operates via stdio, not exposing network ports directly. The main risk, though minor, would be unexpected behavior from the NWS API due to malformed input if not properly validated, but the current implementation shows reasonable care.
Updated: 2025-12-02GitHub→
0
0
Low Cost
Sec9

A centralized registry facilitating the discovery and integration of Model Context Protocol (MCP) server plugins for the OTUI application.

Verified SafeView Analysis
This repository primarily serves as a metadata registry in JSON format. It provides data for discovery and integration but does not contain executable application code for the listed plugins. The README explicitly warns users to exercise caution and do their own research when running the *listed MCP servers*, as they are not all tested or verified. The registry itself, comprising JSON files and administrative scripts, poses minimal direct security risk for consumption.
Updated: 2025-11-17GitHub→
PreviousPage 451 of 760Next