Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
High Cost
L0stInFades icon

Cocode-Precise

by L0stInFades

Sec9

An MCP server for precise code symbol retrieval, returning exact source code for functions, classes, and methods by name, and offering semantic search capabilities.

Setup Requirements

  • ⚠️Requires Python 3.10 or later.
  • ⚠️Requires PostgreSQL with the `pgvector` extension installed.
  • ⚠️Requires an API key for one of the following embedding providers: OpenAI (`OPENAI_API_KEY`), Jina (`JINA_API_KEY` with `USE_LATE_CHUNKING=true`), or Mistral (`MISTRAL_API_KEY`). At least one is mandatory for embeddings.
  • ⚠️Initial indexing of large codebases can be slow due to embedding generation.
Verified SafeView Analysis
The server employs robust security practices, including parameterized SQL queries to prevent injection, path validation (resolving absolute paths, checking for symlinks, verifying directory existence, and ensuring files are within the repository) to prevent directory traversal attacks, and strict environment variable usage for API keys instead of hardcoding secrets. Input length limits (e.g., symbol_name, file size) are also enforced to prevent resource exhaustion. No 'eval' or malicious patterns were identified in the provided source code. The HTTP clients for external APIs use timeouts to prevent hangs.
Updated: 2026-01-19GitHub→
0
0
Medium Cost

OECD-MCP

by KSAklfszf921

Sec9

Enables AI assistants to query and analyze OECD's comprehensive statistical data through its SDMX API.

Setup Requirements

  • ⚠️Requires Node.js and npm installed locally for development or global installation.
  • ⚠️Specific configuration within Claude Desktop's `claude_desktop_config.json` is required for local integration.
Verified SafeView Analysis
The server interacts with the public OECD SDMX API and does not require authentication. No 'eval', obfuscation, or unusual network risks are evident based on the provided README. It's a standard Node.js application.
Updated: 2025-11-23GitHub→
0
0
Medium Cost
setsail-it icon

arb-mcp-server

by setsail-it

Sec9

This server provides specialized tools for AI agents, including fetching keyword search volume from DataForSEO, managing HTML artifacts in a PostgreSQL database, retrieving client-specific information and writing rules, generating images via Google Gemini, and managing client discovery documents.

Setup Requirements

  • ⚠️Requires a PostgreSQL database to be configured and accessible via DATABASE_URL.
  • ⚠️Requires API keys for external services: DataForSEO (DATAFORSEO_API_KEY) and Google Gemini (GOOGLE_API_KEY), which may incur costs.
  • ⚠️Requires AWS credentials (AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) and an S3 bucket (AWS_S3_BUCKET) for image hosting. The S3 bucket must be configured for public read access.
  • ⚠️The image generation process (`generate_image`) implements exponential backoff, which is good for reliability but might lead to increased latency under high load or temporary API issues.
Verified SafeView Analysis
The server loads all sensitive credentials (API keys, database URL) from environment variables, which is good practice. Database interactions use parameterized SQL queries, mitigating common SQL injection risks through data values. The process for updating discovery documents correctly maps internal Python parameter names to database columns, and explicitly parses/re-dumps JSON input, further reducing injection vectors. External API calls are handled via standard HTTP requests with API keys in headers. No use of 'eval' or other obviously dangerous functions was found. The main security concern would be improper configuration of AWS S3 bucket policies (e.g., overly permissive public access) for image hosting, but this is an infrastructure concern outside the code itself.
Updated: 2025-12-18GitHub→
0
0
Low Cost
MuhammadSaadBandukda icon

mcp-server-learning

by MuhammadSaadBandukda

Sec9

A basic server component for the Minecraft Protocol, likely for learning or foundational development.

Setup Requirements

  • ⚠️Requires Python 3.14+ (currently in alpha/beta phase, may be unstable or difficult to install depending on the OS/environment).
Verified SafeView Analysis
The provided source code is extremely minimal, consisting of a print statement and project configuration. There are no direct security vulnerabilities like eval, obfuscation, hardcoded secrets, or network listeners present within this snippet. Any potential risks would originate from the 'mcp' dependency or further implementation, which are not visible here.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
Avery2 icon
Sec9

Automating personal productivity workflows in Things3 and Notion, leveraging Claude Code skills for contextual guidance and task management.

Setup Requirements

  • ⚠️Requires macOS (due to AppleScript and Things3 dependency).
  • ⚠️Requires Python 3.11+ for the tool scripts.
  • ⚠️Requires 'Claude Code' (an AI agent) and specific configuration within its MCP settings.
  • ⚠️A Notion API token ('NOTION_TOKEN') is required for Notion integration features.
Verified SafeView Analysis
The MCP server uses Node.js, running locally and communicating via standard I/O, thus not exposing any network ports directly. It executes Python scripts which, in turn, interact with Things3 via AppleScript (osascript) and Notion API (notion_client). API tokens (e.g., NOTION_TOKEN) are properly managed through environment variables. No 'eval' or obfuscation was found. The primary security consideration is the implicit trust in the AppleScript files, which are part of the repository, for controlling Things3 on the user's macOS system.
Updated: 2026-01-07GitHub→
0
0
Low Cost
jashanjitattx icon

remote-mcp-servers

by jashanjitattx

Sec9

This server provides an asynchronous API for tracking and summarizing personal or business expenses, allowing users to add new entries, list them by date range, and summarize spending by category.

Setup Requirements

  • ⚠️Requires Python 3.14 or higher as per 'pyproject.toml', which is an unreleased version of Python and likely a typo; it is more probable that it targets Python 3.8+.
  • ⚠️Database data (expenses.db) is stored in the system's temporary directory ('tempfile.gettempdir()') and may not persist across reboots or system cleanups, leading to data loss if not backed up or moved.
  • ⚠️Requires 'aiosqlite' and 'fastmcp' Python packages to be installed.
Verified SafeView Analysis
The server uses parameterized SQL queries ('?' placeholders) for all database operations, effectively preventing SQL injection vulnerabilities. No 'eval' or similar dangerous functions were found. There are no hardcoded credentials or sensitive information within the provided code. The database is stored in a temporary directory, which has implications for data persistence but doesn't inherently pose a direct security risk, assuming standard OS temporary directory permissions. The server binds to 0.0.0.0, which means it will listen on all available network interfaces, but this is a common default for local services and should be managed with network firewalls in a production setting.
Updated: 2025-12-15GitHub→
0
0
Medium Cost
cloudinary icon
Sec3

This MCP server enables AI applications to manage Cloudinary environment configurations, including transformations, upload presets, streaming profiles, webhooks (triggers), and upload mappings.

Setup Requirements

  • ⚠️Requires Cloudinary API Key, API Secret, and Cloud Name (Cloudinary service usage may incur costs).
  • ⚠️Requires Node.js v20 or higher to run.
  • ⚠️Requires an MCP-compatible AI client (e.g., Cursor, Claude Desktop, VS Code extension) to interact with the server.
Review RequiredView Analysis
The `cloudinaryAuthHook.ts` contains logic to resolve `file://` URIs by reading local files from the server's filesystem and converting them to base64. If any exposed tool or prompt allows user-controlled input for a `file` parameter (e.g., for uploading assets) to be a `file://` URI without strict validation, this creates a critical Local File Inclusion (LFI) vulnerability. An attacker could read arbitrary files from the server. Additionally, the `UploadPreset` model includes an `eval` field, which, if evaluated unsafely by the underlying Cloudinary API or any part of the server, could lead to arbitrary code execution. These are significant risks.
Updated: 2025-11-30GitHub→
0
0
Medium Cost
adrianfs98 icon

sapi-patients

by adrianfs98

Sec6

Manages patient information through a REST API and Model Context Protocol (MCP), enabling CRUD operations and integration with AI tools.

Setup Requirements

  • ⚠️Requires Anypoint Studio 7.x for development and deployment.
  • ⚠️Requires Mule Runtime 4.x to execute.
  • ⚠️MCP client functionality relies on an external CloudHub server for full interoperability demonstrations.
Verified SafeView Analysis
The provided source code is highly truncated, making a comprehensive security audit impossible. No explicit malicious patterns or dangerous functions (like 'eval') are visible in the provided snippets. The README mentions 'basic authentication and session validation', which suggests security considerations, but their implementation details are not available for review.
Updated: 2026-01-18GitHub→
0
0
Low Cost
Karthik61958 icon

mcp-server-bluesky-py

by Karthik61958

Sec8

Connects AI agents to the Bluesky social network for automated interactions, including posting, replying, liking, reposting, and monitoring.

Setup Requirements

  • ⚠️Requires Windows 10 or later (for seamless operation with wrapper, though core logic is Python cross-platform).
  • ⚠️Requires Python 3.7 or higher.
  • ⚠️Requires BLUESKY_HANDLE and BLUESKY_PASSWORD environment variables to be set for authentication.
Verified SafeView Analysis
The server uses environment variables (BLUESKY_HANDLE, BLUESKY_PASSWORD) for credentials, which is a good practice. No 'eval' or obvious obfuscation found. The 'mcp_wrapper.py' addresses Windows-specific line ending issues, which is benign. The primary security consideration is ensuring the environment variables are securely managed by the user, as the server will log in with those credentials.
Updated: 2026-01-19GitHub→
0
0
High Cost
vinnyang icon

axe-scanner-mcp

by vinnyang

Sec4

A standalone Model Context Protocol server that runs axe accessibility scans for a supplied URL using Playwright.

Setup Requirements

  • ⚠️Requires Node.js 18 or newer.
  • ⚠️Requires Playwright browser dependencies to be installed using `npx playwright install` (and `npx playwright install --with-deps` for system dependencies on macOS/Linux).
  • ⚠️MCP client configurations require absolute paths for the server command.
Review RequiredView Analysis
The server's core functionality involves navigating to arbitrary user-provided URLs using Playwright. This introduces significant security risks such as Server-Side Request Forgery (SSRF) to access internal network resources, potential browser exploits from malicious pages, and exposure of internal network details if the server is not adequately isolated. It is crucial to strictly validate input URLs and deploy this server in a highly isolated network environment or only process trusted inputs.
Updated: 2025-11-20GitHub→
0
0
Low Cost
Nubaeon icon

epistemic-dj

by Nubaeon

Sec8

Maps epistemic (cognitive) states to generative music patterns in Strudel.cc, primarily as a tool for AI agents.

Setup Requirements

  • ⚠️Requires Node.js version 18.0.0 or higher.
  • ⚠️Web UI requires 'npx serve' which may need a one-time global install or run through npx.
  • ⚠️Music playback relies on manually copying generated patterns to strudel.cc or opening the generated URL, as the server itself doesn't play audio directly.
Verified SafeView Analysis
The server primarily functions as a code generator for an external live-coding environment (Strudel.cc) and communicates via stdio using the MCP SDK, which inherently limits direct network exposure. It avoids common pitfalls like 'eval' on arbitrary user input; JSON parsing is for controlled CLI arguments. No hardcoded secrets or obvious malicious patterns are present. The primary external interaction is generating URLs for Strudel.cc, which assumes the target platform (Strudel.cc) handles code execution securely in the user's browser.
Updated: 2026-01-18GitHub→
0
0
Medium Cost
KSAklfszf921 icon

merinfo-mcp

by KSAklfszf921

Sec8

This server provides comprehensive Swedish business intelligence through web scraping (merinfo.se, allabolag.se) and intelligent caching, serving structured company data to AI assistants.

Setup Requirements

  • ⚠️Requires Node.js 18+ to run.
  • ⚠️Requires Playwright Chromium browsers, which consumes memory and CPU resources, especially if not run headless or with multiple contexts.
  • ⚠️Database initialization (`npm run setup-db`) is required once before the first use.
Verified SafeView Analysis
The server follows good security practices, utilizing environment variables for configuration, input validation with Zod, and structured logging. Web scraping operations are rate-limited and use Playwright browser isolation to mitigate risks associated with interacting with external content. There are no obvious hardcoded secrets, 'eval' statements, or obfuscation. The 'clear_cache' tool requires explicit confirmation, adding a layer of safety. The inherent nature of web scraping means reliance on external sites and potential for IP blocking, but the robust handling (rate-limiting, exponential backoff, browser restarts) addresses common issues.
Updated: 2025-11-23GitHub→
PreviousPage 474 of 760Next