Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
Neophite2023 icon

barber-mcp-server

by Neophite2023

Sec8

This server provides an automated booking and information retrieval system for a barber shop, integrating with a conversational AI via the Model Context Protocol and potentially Twilio Media Streams.

Setup Requirements

  • ⚠️Requires Google Service Account credentials (`GOOGLE_CLIENT_EMAIL`, `GOOGLE_PRIVATE_KEY`) with Google Calendar API access configured for appointment management.
  • ⚠️The `src/websocket.ts` integration with Deepgram, OpenAI GPT-4o, and ElevenLabs is conceptual and requires significant additional implementation and external service setup for a complete voice assistant.
  • ⚠️The tenant data is currently a mock database and would need to be replaced with a persistent data store for production use.
Verified SafeView Analysis
The `src/websocket.ts` file performs `JSON.parse` on unvalidated WebSocket messages, which could be a denial-of-service vector if malformed or excessively large input is sent. Tool arguments are cast using `as string`, relying on the `@modelcontextprotocol/sdk`'s `inputSchema` validation for safety against injection, which is a common practice but requires trust in the SDK's validation mechanisms. Environment variables for Google Calendar are handled correctly. No `eval` or hardcoded secrets were found.
Updated: 2026-01-18GitHub→
0
0
Low Cost
AyushRaj005 icon
Sec9

Enables Claude AI to function as an SRE assistant by interacting with external systems and internal data for observability, debugging, and workflow automation.

Setup Requirements

  • ⚠️Python 3.13+ required (based on MCP_server/pyproject.toml)
  • ⚠️Manual Claude Desktop configuration required for integration
Verified SafeView Analysis
The provided code examples (Pokemon API and Leave Manager) are simple and do not exhibit obvious security vulnerabilities like 'eval' or hardcoded sensitive secrets. They make standard HTTP requests or manage in-memory data. The primary security risk in a production context would lie in the integrations with external platforms (AWS, Datadog, Sentry, etc.), which are not part of these simplified examples. Access control and authentication for the MCP servers themselves would be crucial in a real-world deployment.
Updated: 2025-11-20GitHub→
0
0
Medium Cost
circuitry-dev icon

circuitry-mcp-server

by circuitry-dev

Sec9

Provides AI coding agents with programmatic access to Circuitry, a visual workflow and diagramming platform.

Setup Requirements

  • ⚠️Requires Circuitry Server (Electron desktop application) to be installed and running locally.
  • ⚠️User must manually generate an 'Access Key' from the Circuitry Server's preferences for initial setup.
  • ⚠️Requires an MCP-compatible AI client (e.g., Claude Code, Cursor, VS Code with Copilot, Gemini CLI) to utilize its functionality.
Verified SafeView Analysis
The server acts as a proxy, forwarding requests to a local Circuitry 'EServer' Electron application, which is responsible for sensitive operations like filesystem access. It uses an access key for authentication, which is stored locally in a configuration file or provided via environment variables, and requires user approval via a dialog for initial connection. Input validation is handled by the MCP SDK using Zod schemas. No 'eval' or obvious malicious patterns found.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
akashjavalekar02 icon

MCP_Server

by akashjavalekar02

Sec6

A custom server implementation designed to interact with the Minecraft protocol, likely for hosting or developing custom game logic and player experiences.

Setup Requirements

  • ⚠️Requires specific network port(s) to be open and available (e.g., 25565 for Minecraft).
  • ⚠️Requires Python 3.x installed with potentially additional dependencies (e.g., via pip).
Verified SafeView Analysis
As a network server, MCP_Server inherently exposes ports to external connections. Without specific details on input validation, authentication, and authorization for protocol handling, potential vulnerabilities related to unvalidated input or protocol exploits cannot be fully assessed. No explicit 'eval', code obfuscation, or hardcoded secrets were identified in the truncated source code.
Updated: 2026-01-18GitHub→
0
0
Medium Cost
george7979 icon

gemini-mcp-server

by george7979

Sec9

An MCP server to integrate Google Gemini AI capabilities (text generation, web search, YouTube analysis) into Claude Code and other MCP clients.

Setup Requirements

  • ⚠️Requires Node.js 18+.
  • ⚠️Requires a Google AI API Key (free tier available, but usage limits apply).
  • ⚠️Ensure absolute path to server executable is used in MCP client configuration.
Verified SafeView Analysis
The server correctly handles the Google API key by requiring it as an environment variable (GOOGLE_API_KEY) and performing a startup check for its presence. Input validation is implemented using Zod with `.strict()` schemas, which helps prevent unexpected or malicious inputs. Error messages are actionable and do not appear to leak sensitive internal information. There is no usage of 'eval' or obvious obfuscation. The system relies on external APIs, and proper error handling is in place for common API failures.
Updated: 2025-12-18GitHub→
0
0
Low Cost
haroldcampbell icon

git-control-mcp

by haroldcampbell

Sec7

Provides Micro-Control Protocol (MCP) tools for common Git and GitHub operations, enabling automated source control management and integration with developer environments like Codex CLI.

Setup Requirements

  • ⚠️Requires 'gh' (GitHub CLI) to be installed and authenticated for pull request creation.
  • ⚠️Requires 'uv' package manager for dependency management and execution.
  • ⚠️Requires Python 3.11 or newer.
Verified SafeView Analysis
The server uses `subprocess.run` to execute `git` and `gh` commands. While the `run_git` tool enforces an allowlist of subcommands, other tools (e.g., `stage_files`, `commit_changes`, `fetch`) accept `extra_args` which are passed directly to specific git subcommands. This could potentially allow injection of additional, unintended git flags if the client providing `extra_args` is untrusted. The server primarily operates over stdio for local interaction, reducing the external attack surface. Explicit warnings are provided for destructive Git operations.
Updated: 2026-01-18GitHub→
0
0
Low Cost
bioanywhere icon

chivas13

by bioanywhere

Sec9

Accessing and processing news data from the World News API.

Setup Requirements

  • ⚠️Requires an API key from World News API (Paid service).
  • ⚠️Python client requires Python 3.7+.
  • ⚠️C++ client requires Qt for building and runtime.
Verified SafeView Analysis
This repository provides client libraries for the World News API, not a server. The code is auto-generated by OpenAPI Generator and appears to follow standard best practices for client-side API interaction. No 'eval', obfuscation, or obvious malicious patterns were found. API keys (e.g., 'apiKey', 'headerApiKey') are loaded dynamically and must be securely managed by the user of the library (e.g., via environment variables, not hardcoded). OAuth flows, if implemented in a specific language client, might involve a local callback server, which is a standard pattern but requires proper handling in the user's environment. The primary security consideration lies in the consumer's application logic for credential management and data handling.
Updated: 2025-12-13GitHub→
0
0
Low Cost

Azure-MCP

by Jason-Azure

Sec4

This project aims to collect and potentially manage Minecraft Protocol (MCP) servers, specifically those that might be leveraging GitHub Copilot.

Setup Requirements

  • ⚠️Likely requires an Azure account or specific Azure services for deployment/operation, given the 'Azure-MCP' repository name.
  • ⚠️Potential dependency on GitHub Copilot API or runtime environment for its functionality, implying a Copilot subscription or specific integration setup.
  • ⚠️Requires existing MCP (Minecraft Protocol) servers to collect and monitor.
Review RequiredView Analysis
Insufficient information to perform a thorough security audit. The provided data (truncated README) contains no code. 'Collecting servers' implies potential network activity or interaction with external systems, which always carries inherent risks if not handled securely, but no specifics can be determined from the given information.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
Son012375 icon

notion-mcp-server

by Son012375

Sec9

Automating Notion page creation, retrieval, and updates for project documentation and knowledge management, integrated with Claude Code CLI.

Setup Requirements

  • ⚠️Requires a Notion API Key and Database ID, which must be manually configured in a `.env` file.
  • ⚠️The Notion database must have specific properties (e.g., '이름' as Title, '날짜' as Date, '카테고리' as Select, '상태' as Status, '태그' as Multi-select) with exact Korean names for full functionality.
  • ⚠️Requires Claude Desktop to be configured to run this MCP server, or manual execution if used standalone.
Verified SafeView Analysis
The server primarily uses Notion's official API client and parses markdown to Notion block structures. There are no direct `eval` or `exec` calls on user input that would allow code injection into the server's runtime. Sensitive API keys are loaded from `.env` files, which is standard practice for environment variables. The primary security consideration for users is to secure their `.env` file and ensure proper Notion integration permissions are set, as the server will have write access to the specified Notion database.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
xianglq18 icon

mcp-playwright

by xianglq18

Sec1

Provides web automation capabilities, likely through an API, leveraging Playwright for browser control and testing.

Setup Requirements

  • ⚠️Source code not provided for analysis, preventing identification of specific setup requirements.
  • ⚠️Likely requires a Node.js environment and Playwright's browser dependencies to be available.
Review RequiredView Analysis
Full source code was not provided for analysis. Therefore, a comprehensive security audit could not be performed. Without inspecting the code for 'eval', hardcoded secrets, network vulnerabilities, or malicious patterns, the system must be considered unsafe to run.
Updated: 2025-12-15GitHub→
0
0
Medium Cost
mschuchard icon

vault-mcp-server

by mschuchard

Sec9

Provides an interface for managing HashiCorp Vault server resources, including secret engines, authentication engines, audit devices, and ACL policies.

Setup Requirements

  • ⚠️Requires an operational HashiCorp Vault server to connect to.
  • ⚠️Requires Docker for containerized execution (recommended in README).
  • ⚠️Requires a valid Vault authentication token (`VAULT_TOKEN`) with appropriate permissions for the actions performed.
  • ⚠️Requires Python 3.12 or newer for direct execution outside of Docker.
Verified SafeView Analysis
The server acts as a client wrapper around the 'hvac' library, which is the official Vault Python client. It explicitly retrieves VAULT_URL and VAULT_TOKEN from environment variables, validating the URL format and applying a regular expression check to the token for valid characters, which helps prevent simple injection. No 'eval', 'exec', 'os.system', or similar dynamic code execution patterns were found. The system relies on Vault's inherent security for policy and certificate parsing.
Updated: 2026-01-08GitHub→
0
0
Medium Cost
jlwainwright icon

spec-kit

by jlwainwright

Sec7

The Spec-Kit MCP Server provides a comprehensive toolkit for specification-driven development, automating workflows from feature specification and planning to task breakdown, domain analysis, and guided implementation.

Setup Requirements

  • ⚠️Requires Python 3.11+ (CLI) or 3.8+ (MCP Server)
  • ⚠️Requires 'uv' or 'pip' for package management
  • ⚠️Requires Git for version control and branch management
  • ⚠️Requires a supported AI coding agent (e.g., Claude Code, GitHub Copilot, Gemini CLI)
  • ⚠️GitHub token (GH_TOKEN/GITHUB_TOKEN) is recommended to avoid API rate-limiting for template downloads and GitHub interactions
  • ⚠️Manual configuration of Claude Desktop (or other IDE/agent) is required to register the MCP server endpoint
  • ⚠️Setting `SPECIFY_FEATURE` environment variable is needed for non-Git repositories for context
Verified SafeView Analysis
The project extensively uses `subprocess.run` for Git commands and script execution. While many calls use list-based arguments which are safer, some shell scripts (e.g., those parsing `{ARGS}` or using `eval $(...)`) could be vulnerable to command injection if malicious input bypasses internal sanitization, especially in untrusted environments. File system operations for templates and outputs are common but appear to be handled with standard Python libraries. No hardcoded secrets were found, and GitHub token handling uses environment variables or explicit arguments. It's a development tool, so some trust in the operating environment is inherent.
Updated: 2025-12-30GitHub→
PreviousPage 473 of 760Next