Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
vjgit-369 icon
Sec8

The server enables AI assistants to programmatically interact with Apache JMeter for comprehensive performance testing, including test execution, analysis, report generation, and test plan creation.

Setup Requirements

  • ⚠️Requires Node.js version 18 or higher to be installed.
  • ⚠️Requires Apache JMeter 5.0 or higher to be installed and accessible.
  • ⚠️The `JMETER_HOME` environment variable must be explicitly set to the JMeter installation directory.
Verified SafeView Analysis
The server utilizes `child_process.spawn` and `execFile` with array arguments for executing JMeter, which is the safest method to run external commands programmatically as it avoids shell interpretation. Environment variables `JMETER_HOME` and `JMETER_BIN` are read, preventing hardcoded secrets. The primary security consideration arises if an attacker can control the *values* of paths (`testPlan`, `resultsFile`, `reportDir`) or properties passed to JMeter, as JMeter itself would then process these potentially malicious inputs. However, the server's code itself mitigates direct command injection risk from its side.
Updated: 2025-12-05GitHub→
0
0
Low Cost

MCP-server-omkar

by omkar1930

Sec9

Provides a minimal Python server for fetching and broadcasting cryptocurrency market data using FastAPI and CCXT.

Verified SafeView Analysis
The server handles public market data only and does not require API keys for its operation, significantly reducing security risks associated with sensitive credential management. It utilizes established frameworks (FastAPI) and libraries (CCXT).
Updated: 2025-11-17GitHub→
0
0
High Cost
CengSin icon

mcp-server

by CengSin

Sec5

An AI-powered RAG (Retrieval Augmented Generation) system for financial news analysis and user management, leveraging vector search, relational database queries, and LLM orchestration through a tool-calling framework.

Setup Requirements

  • ⚠️Requires an OpenAI (or compatible service like OpenRouter.ai) API key, which incurs costs for embeddings and chat completions.
  • ⚠️Requires a running Qdrant vector database instance for semantic search capabilities.
  • ⚠️Requires a running MySQL database instance with specific schemas for content messages, articles, and users.
  • ⚠️Requires a running MinIO object storage instance for file generation and storage.
  • ⚠️A local HTTP/HTTPS proxy might be required if `HTTP_PROXY` and `HTTPS_PROXY` environment variables are set, which is done by default in `main.go` pointing to `127.0.0.1:7890`.
Review RequiredView Analysis
The `config/config.yaml` provides default credentials for MySQL (root:rootpassword) and MinIO (admin:password). These are highly insecure and must be changed for any production or even non-local deployment. The server listens on port 8085 (potentially 0.0.0.0:8085) without visible authentication or authorization mechanisms in the provided code, posing a risk if exposed publicly. HTTP/HTTPS proxies are explicitly set from environment variables which, if misconfigured or pointing to untrusted proxies, could introduce risks. No direct `eval` or command injection vulnerabilities were found.
Updated: 2026-01-05GitHub→
0
0
Low Cost
drkhannah icon

mcp-chess-server

by drkhannah

Sec10

Provides an MCP server to interact with the Chess.com API, offering tools to retrieve public player profiles and statistics by username.

Setup Requirements

  • ⚠️Requires Python 3.12 or newer.
  • ⚠️Requires 'mcp[cli]' and 'requests' dependencies to be installed.
Verified SafeView Analysis
The code makes standard HTTP GET requests to the public Chess.com API. It uses 'requests.raise_for_status()' for error handling and does not expose any sensitive information or use dangerous functions like 'eval'. No apparent network risks or hardcoded secrets.
Updated: 2025-11-28GitHub→
0
0
Medium Cost
nuin icon
Sec9

Provides a Model Context Protocol (MCP) server for accessing genomics data from the Alliance of Genome Resources across multiple model organisms.

Setup Requirements

  • ⚠️Requires Node.js 18+ to run directly.
  • ⚠️Requires specific JSON configuration in MCP clients (e.g., Claude Desktop) for integration.
  • ⚠️Relies on external Alliance of Genome Resources APIs, which are subject to their availability and stability.
Verified SafeView Analysis
The server uses Zod for robust input validation for all tool arguments. It interacts with public, read-only external APIs (Alliance of Genome Resources). No hardcoded secrets were found in the provided source code. Docker deployments are configured with strong security hardening (read-only filesystem, no-new-privileges). The `CHANGELOG.md` mentions query and error message sanitization, although explicit implementation details for all types of injections beyond Zod validation were not fully visible in the truncated `client.ts`. As it primarily makes HTTP requests and does not execute arbitrary code or interact with local databases based on user input, the risk is minimal.
Updated: 2025-12-16GitHub→
0
0
Low Cost
bernardpacis icon

bernardpacis.github.io

by bernardpacis

Sec5

Scaffolds a production-ready Model Context Protocol (MCP) server quickly with minimal configuration.

Setup Requirements

  • ⚠️Requires Node.js version 14 or later.
  • ⚠️Requires manual download and installation of the kit from GitHub releases (not directly via npm/npx for the kit itself).
  • ⚠️The 'npm run start' command is for running the scaffolded MCP server, implying a previous setup/generation step by the kit.
Review RequiredView Analysis
The provided SOURCE CODE is an `index.md` documentation file describing a server scaffolding kit. It does not contain executable code, making a direct security audit of the server or kit impossible. No security risks like 'eval', obfuscation, network risks, or hardcoded secrets can be identified from this documentation alone.
Updated: 2026-01-18GitHub→
0
0
Medium Cost
Sec9

Provides Claude with real-time weather alerts and forecasts via custom tools.

Setup Requirements

  • ⚠️Requires a publicly accessible endpoint for Claude to connect to the weather tools.
  • ⚠️Requires a Python environment with project dependencies installed (e.g., using `uv` and `pyproject.toml`).
Verified SafeView Analysis
Integrates with public weather services (e.g., NWS) to fetch real-time data. The README explicitly states no user API keys are required and location data is only used for weather queries. All data is sourced from public weather services, minimizing direct security risks from the tool itself. Network risks are limited to the reliability and security of the public weather data providers.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
lessuseless-systems icon

circular-mcp

by lessuseless-systems

Sec3

Provides a set of tools for an MCP-compatible server to interact with the Circular Protocol Blockchain, enabling AI agents to query and perform blockchain operations.

Setup Requirements

  • ⚠️Requires Node.js v20+ (v18+ minimum) to avoid `fetch` API polyfill issues.
  • ⚠️Requires setting API keys in `.env` (e.g., `ACME_API_KEY`) as per `README`, but the provided tool code snippets for Circular Protocol API calls do not currently integrate these environment variables, potentially leading to authentication failures or insecure requests.
Review RequiredView Analysis
The server's tools make direct HTTP POST requests to `https://nag.circularlabs.io/NAG.php` for all blockchain interactions. A critical security concern is the discrepancy between the `README` and the actual source code: the `README` explicitly states that environment variables (e.g., `ACME_API_KEY`) are used for authentication within generated tools, but the provided tool code snippets (e.g., `get-domain.js`, `send-transaction.js`) do not incorporate `process.env` variables into their requests. This means sensitive operations like `send_transaction` are sent without any explicit API key in the headers from the client-side tool, which is a major functional and security gap if the `nag.circularlabs.io` API requires authentication. Additionally, some tools (`get-transaction-by-id`, `get-blockchains`, `get-transaction-by-node`) explicitly set a `timestamp` header to an empty string (`''`), which could cause API request failures if the backend expects a valid timestamp format for security or request validation. The entire system relies on a single external API endpoint (`nag.circularlabs.io`), introducing a single point of failure.
Updated: 2025-11-26GitHub→
0
0
Low Cost
eatikrh icon
Sec6

A production-ready template for developing Model Context Protocol (MCP) servers, enabling AI agents to use specialized tools for arithmetic, code review prompt generation, resource handling, and backend service querying, with integrated Slack bot support via Keycloak OAuth.

Setup Requirements

  • ⚠️Requires Python 3.12+ and 'uv' package manager for local setup.
  • ⚠️For the Slack integration and local OAuth flows, a Keycloak instance must be running on 'http://localhost:8080' and manually configured (client, user, secret).
  • ⚠️The `ENABLE_AUTH=false` setting (required for the Slack bot demo) disables authentication middleware, making all endpoints public. Token validation must then be handled by individual tools, making secure deployment challenging without strict network controls.
Verified SafeView Analysis
The server offers an `ENABLE_AUTH=false` mode for simplified integrations (e.g., Slack bot demo), explicitly warned as 'not suitable for internet exposure' in documentation. This design shifts authentication responsibility to individual tools or external handling, posing a significant risk if not properly understood and configured. Hardcoded default `MCP_HOST=0.0.0.0` can expose the server if not behind a firewall. Deployment manifests (`secret.yaml`) contain placeholder secrets ('CHANGE_ME') requiring manual updates for production. The `_local_development_token` in `api.py` allows a browser-based OAuth flow for local development, which is a local-only bypass, not a production risk.
Updated: 2025-11-19GitHub→
0
0
High Cost
jerome79 icon
Sec7

Extract structured data (e.g., vendor, amount, date) from PDF invoices using a multi-agent AI pipeline.

Setup Requirements

  • ⚠️Requires Ollama to be installed and running locally with a model (e.g., 'llama3.2') for full LLM functionality; can be disabled by setting `LLM_BACKEND=none`.
  • ⚠️Requires Docker and Docker Compose for the recommended 'make dev' setup.
  • ⚠️Assumes Python 3.11+ (as suggested by the deployment script) or a compatible newer version.
Verified SafeView Analysis
The system uses environment variables for configuration (good), but the default CORS settings are wide open ('*') for both API and MCP, which is a significant risk for production deployments. The direct injection of raw, untrusted invoice text into LLM prompts in `InvoiceExtractionAgent` creates a potential for prompt injection, though output is constrained to JSON. PDF parsing with `fitz` is generally robust, and `SQLModel`'s ORM usage mitigates SQL injection. No hardcoded secrets or 'eval' statements were found.
Updated: 2025-12-29GitHub→
0
0
Low Cost
TomsTools11 icon

tomsmcps-v2

by TomsTools11

Sec9

A static directory website for Model Context Protocol (MCP) servers, allowing users to browse, filter, and search through a curated list of tools and their GitHub repositories.

Setup Requirements

  • ⚠️Requires Node.js version 20 (specified in `netlify.toml` and implicitly by `package.json` dev dependencies).
  • ⚠️Data is sourced from `mcp-directory.csv` at build time; changes require re-running `npm run process-csv` and re-building.
Verified SafeView Analysis
The application is a static site generated from a CSV file. Data processing occurs at build time using `scripts/process-csv.ts`, not at runtime with user-supplied data. Client-side search (Fuse.js) is generally safe. External links to GitHub repositories are explicitly labeled and open in new tabs, a standard practice for directories and not a direct vulnerability of the site itself. No obvious dynamic server-side code execution or `eval` calls that process user input.
Updated: 2025-12-02GitHub→
0
0
Medium Cost
ex-takashima icon

glm-image-mcp-server

by ex-takashima

Sec9

MCP server and CLI tool for generating images using Z.AI's glm-image model.

Setup Requirements

  • ⚠️Requires Z.AI API Key (Paid service, user responsible for costs).
  • ⚠️Node.js version 18.0.0 or higher is required.
  • ⚠️TypeScript compilation (npm run build) is required before running.
Verified SafeView Analysis
The code explicitly implements path traversal protection using `isPathWithinDirectory` and `getSafeOutputPath` when downloading and saving images, which is a strong security measure. API keys are loaded from environment variables (`process.env.Z_AI_API_KEY`) and checked for existence, preventing hardcoded secrets. No use of `eval` or obvious obfuscation was found. The main network risks are standard API calls and image downloads, handled by the `axios` library with reasonable timeouts. Overall, the server appears to be developed with good security practices.
Updated: 2026-01-17GitHub→
PreviousPage 456 of 760Next