Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
marcustomazelli icon

mcp-server

by marcustomazelli

Sec9

Provides weather alerts and forecasts by integrating with the National Weather Service (NWS) API.

Setup Requirements

  • ⚠️Requires Python 3.12 or newer.
  • ⚠️Requires active internet connectivity for NWS API calls.
  • ⚠️Relies on the 'mcp[cli]' package for execution.
Verified SafeView Analysis
The server makes external HTTP requests to a legitimate weather API (api.weather.gov). Requests include basic error handling. No hardcoded secrets, 'eval' usage, or obvious malicious patterns were found. Input for latitude, longitude, and state is used to construct API URLs, relying on httpx for proper encoding; direct code injection into the server's logic is unlikely.
Updated: 2025-12-01GitHub→
0
0
Medium Cost
Jnix2007 icon

baseql-mcp

by Jnix2007

Sec9

An MCP server providing AI agents with comprehensive tools and context for querying Base chain data via the Coinbase Developer Platform SQL API, including contract lookups, ENS resolution, and real-time CEX pricing.

Setup Requirements

  • ⚠️Requires CDP API Key ID and Secret from Coinbase Developer Platform (Paid API usage).
  • ⚠️Requires CDP_WALLET_SECRET if X402 payments are enabled (ENABLE_PAYMENTS=true).
  • ⚠️Requires deployment to a public URL (e.g., Vercel) for use with ChatGPT.
Verified SafeView Analysis
The code uses environment variables for API keys and secrets, a good practice for sensitive information. It interacts with legitimate, known public APIs from Coinbase and Flashbots. There is no use of `eval` or code obfuscation. The primary security consideration is that an AI agent, if poorly prompted or unconstrained, could construct and execute highly inefficient or broad SQL queries against the CDP SQL API. However, the MCP server itself provides extensive metadata, best practices, and query limits to guide agents towards safe and efficient query construction, thus mitigating this inherent risk of direct SQL execution via an agent.
Updated: 2025-11-29GitHub→
0
0
Medium Cost
osborn1997 icon
Sec3

An HTTP Model Context Protocol (MCP) server for integrating AI assistants with Instagram and Facebook APIs, enabling conversational automation for messaging, content management, and profile interactions.

Setup Requirements

  • ⚠️Requires extensive setup on Facebook/Meta Developer portal to obtain `FB_APP_ID`, `FB_APP_SECRET`, `FB_PAGE_ID`, `IG_ACCOUNT_ID`, and a `FB_PAGE_ACCESS_TOKEN` with numerous specific permissions.
  • ⚠️Requires an external PostgreSQL database (Supabase recommended) with schema migrations to persist workflows, executions, and sessions.
  • ⚠️Requires a Redis instance for hot session caching and rate limiting.
Review RequiredView Analysis
CRITICAL: The `evaluateCondition` function in `src/engine/executor.ts` directly uses `eval(resolved.expr)` for workflow condition evaluation. This allows arbitrary code execution if an attacker can control the `condition` value within a workflow definition. This is a severe vulnerability. MODERATE: Webhook signature validation in `src/index.ts` falls back to `FB_PAGE_ACCESS_TOKEN` if `FB_APP_SECRET` is not explicitly set, which is an incorrect and less secure practice. Similarly, `FB_VERIFY_TOKEN` can default to `FB_PAGE_ACCESS_TOKEN`, which is not ideal. LOW: The `/mcp` endpoint is unprotected if `MCP_API_KEY` environment variable is not set.
Updated: 2025-12-13GitHub→
0
0
Low Cost
tniita icon
Sec9

This server acts as a tool endpoint for a Multi-Agent Communication Protocol (MCP), specifically handling JSON-RPC POST requests and returning a simulated search result.

Setup Requirements

  • ⚠️Requires Python 3.x
  • ⚠️Requires `fastapi` library
  • ⚠️Requires `uvicorn` to run the server
Verified SafeView Analysis
The server is a simple FastAPI application parsing JSON and returning a fixed JSON-RPC response. No immediate security vulnerabilities like `eval`, hardcoded secrets, or complex logic that could be exploited are present in the provided code. The `try-except` block handles `json.decoder.JSONDecodeError` by returning a JSON-RPC error, which is good practice.
Updated: 2025-12-01GitHub→
0
0
Medium Cost
Mohadjkfahskjdh icon

timedoctor-mcp

by Mohadjkfahskjdh

Sec8

Extracts time tracking data from Time Doctor, parses it, and exports it in CSV or JSON format for analysis, primarily integrating with AI assistants via MCP.

Setup Requirements

  • ⚠️Requires valid Time Doctor account credentials (TD_EMAIL, TD_PASSWORD).
  • ⚠️Requires Playwright Chromium browser binaries to be installed (`playwright install chromium`), which downloads ~130MB.
  • ⚠️Python 3.12 or 3.13 is strongly recommended for development and execution.
Verified SafeView Analysis
Credentials (TD_EMAIL, TD_PASSWORD) are handled securely via .env files. The HTML parser uses BeautifulSoup and JSON deserialization, which are generally safe from code injection. Playwright is used for browser automation, and while the Docker setup uses '--no-sandbox' (a common workaround for Playwright in Docker), the scraping target is fixed to Time Doctor and does not process arbitrary user-provided URLs, mitigating the risk. No 'eval' or other obvious malicious patterns were found.
Updated: 2026-01-19GitHub→
0
0
Low Cost
baiyaoyu icon

news-mcp-server

by baiyaoyu

Sec9

An MCP server designed to scrape news headlines from Chinese (ThePaper) and Singaporean (Zaobao) news outlets, exposing them via an API.

Setup Requirements

  • ⚠️Requires Python 3.13+ (currently in beta/release candidate)
  • ⚠️Requires `uv` package manager (and `uvx` for execution)
Verified SafeView Analysis
The code uses httpx for network requests with timeouts and error handling. BeautifulSoup is used for parsing, and no eval() or direct arbitrary code execution vectors were found. The use of json.loads(body) is on a controlled, integer-derived string, mitigating risk. No hardcoded secrets. General web scraping risks (IP blocking, HTML changes) apply but are not direct security flaws in the code itself.
Updated: 2025-11-19GitHub→
0
0
Medium Cost
erold-dev icon

mcp-server

by erold-dev

Sec9

Enables AI assistants to directly manage Erold projects by interacting with tasks, projects, knowledge bases, and team contexts.

Setup Requirements

  • ⚠️Requires EROLD_API_KEY environment variable to be set.
  • ⚠️Requires EROLD_TENANT environment variable (your tenant ID or slug) to be set.
  • ⚠️AI assistants (e.g., Claude) may not expand shell variables in their MCP configuration; direct key/value assignment for environment variables within their config is often required.
Verified SafeView Analysis
The server securely handles API keys via environment variables (EROLD_API_KEY, EROLD_TENANT) and uses standard HTTPS for communication with the Erold API. It includes robust error handling, retries, and explicit logging for sensitive operations like retrieving vault secrets. No direct use of 'eval' or other highly risky dynamic code execution patterns was found in the provided source code. The core functionality relies on making authenticated HTTP requests to a defined external API, which is a common and generally safe pattern for an integration server. The primary security concern lies in the secure management of the EROLD_API_KEY by the user, which the project's documentation clearly advises on.
Updated: 2026-01-10GitHub→
0
0
Medium Cost
james116blue icon

journald-mcp-server

by james116blue

Sec9

Access and filter systemd journal logs through an MCP server.

Setup Requirements

  • ⚠️Requires systemd-journal group access for the user running the server (usermod -aG systemd-journal $USER).
  • ⚠️Requires Python 3.12+.
  • ⚠️Operates exclusively on Linux systems with systemd and journald.
  • ⚠️Requires 'uv' for dependency management and running the server.
Verified SafeView Analysis
The server uses `systemd-python` for journal access, and `dateparser` for datetime parsing. Input parameters for filtering are used safely (e.g., `add_match` for journal reader, case-insensitive string `in` comparison for messages) without direct command execution or shell injection points. No hardcoded secrets are identified. Running the server requires the user to be part of the `systemd-journal` group, which is a standard privilege configuration for journal access and not a code vulnerability itself.
Updated: 2025-12-15GitHub→
0
0
Low Cost
FeiCoder icon
Sec9

A Python MCP (Model Context Protocol) server providing current time functionality via HTTP or Stdio.

Setup Requirements

  • ⚠️Requires `uv` for installation and execution.
  • ⚠️Requires Python 3.8 or higher.
Verified SafeView Analysis
The server implements a simple JSON-RPC style protocol with predefined methods (`initialize`, `tools/list`, `tools/call`). The `tools/call` method specifically checks for a 'get_current_time' tool, preventing arbitrary code execution. Inputs are parsed as JSON, and no 'eval' or similar dangerous functions are used. The server binds to `0.0.0.0`, which is standard but requires external firewalling for production environments to restrict access if needed. Overall, the limited functionality and clear input handling make it relatively secure for its purpose.
Updated: 2025-12-11GitHub→
0
0
Medium Cost
bobatenikhil725 icon

database_mcp_server

by bobatenikhil725

Sec1

A server designed to manage and interact with a database, potentially related to a Master Control Program or Minecraft Protocol application.

Review RequiredView Analysis
CRITICAL: No source code was provided for analysis. Therefore, a comprehensive security audit could not be performed. The score is defaulted to 1 (lowest) as safety cannot be guaranteed without examining the code.
Updated: 2025-11-27GitHub→
0
0
Medium Cost
goodshileidev icon

mcp-servers

by goodshileidev

Sec3

Manages the full development lifecycle for a Next Generation System (NGS) code generation platform, including data modeling, requirement, project, UI, report, template, and delivery management.

Setup Requirements

  • ⚠️Requires an external NGS API server to be running and accessible.
  • ⚠️Python 3.8+ is required.
  • ⚠️API communication relies on the `curl` command with the `--insecure` flag, bypassing TLS certificate validation and posing a significant security risk for sensitive data.
Verified SafeView Analysis
The server makes API calls to an external NGS API server using `curl` via `subprocess.run(..., shell=True)`. This setup inherently carries risks, although the data passed to curl is JSON-encoded and quoted, mitigating simple shell injection via arguments. CRITICALLY, the curl commands consistently use the `--insecure` flag, disabling SSL/TLS certificate validation. This makes all communications vulnerable to man-in-the-middle attacks and should never be used in production or for sensitive data. Additionally, the `token: null` header suggests either unauthenticated API access or a placeholder for a token, which could be insecure if the backend API is not designed for it. The base URL for the backend API can be configured via an environment variable, which is good practice, but the default or hardcoded URLs are accessed insecurely.
Updated: 2025-12-11GitHub→
0
0
High Cost
mcorpening85 icon

neo4j-mcp-synthesis

by mcorpening85

Sec9

This MCP server ingests and parses transcripts to extract knowledge concepts (frameworks, principles, problems, relationships, insights) and stores them in a Neo4j knowledge graph.

Setup Requirements

  • ⚠️Requires Anthropic API Key (Paid API for LLM extraction).
  • ⚠️Requires a Neo4j database instance (Can be paid or self-hosted).
  • ⚠️Designed to run as a Cloudflare Worker/Durable Object, requiring a Cloudflare account and wrangler CLI for deployment.
Verified SafeView Analysis
The server uses parameterized queries for Neo4j, mitigating Cypher injection risks. Anthropic API keys are loaded from environment variables. LLM output (JSON) is parsed using a regex to isolate the JSON string before `JSON.parse`, reducing the risk of arbitrary code execution.
Updated: 2025-11-22GitHub→
PreviousPage 470 of 760Next