Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
vic7ord1st icon

Clockify-MCP-Server

by vic7ord1st

Sec9

Integrate Clockify time tracking functionalities like starting, stopping, and viewing active timers into an MCP-compatible environment such as Claude Desktop.

Setup Requirements

  • ⚠️Requires Docker installed and running
  • ⚠️Requires a Clockify account with API access and a Workspace ID
  • ⚠️Requires Claude Desktop for integration (as per setup guide)
Verified SafeView Analysis
API keys are securely passed as environment variables and not hardcoded. All API communication uses HTTPS. The server explicitly states it runs as a non-root user in Docker and does not store sensitive data locally. Timeouts are used for network requests. No `eval` or similar dangerous functions are present. The primary security risk would be if the environment variables are exposed or the Clockify API key itself is compromised outside of this server's control.
Updated: 2025-11-24GitHub→
0
0
Low Cost
JohnnyB94 icon

mein-mcp-server

by JohnnyB94

Sec8

The server exposes specific functionalities (tools) via a Multi-Modal Compute Protocol (MCP) endpoint, allowing AI agents or other clients to discover and invoke them.

Setup Requirements

  • ⚠️Requires Node.js and npm/yarn
Verified SafeView Analysis
The server uses `Access-Control-Allow-Origin: *`, which allows requests from any domain. While common for public APIs or development, it could be a concern if sensitive information or operations were exposed without proper authentication/authorization. However, given the current tools, no immediate major vulnerability is apparent. Input validation for `calculate` handles division by zero. No `eval` or command injection vectors found.
Updated: 2025-11-26GitHub→
0
0
High Cost
Taehooon6476 icon
Sec9

This server provides video analysis, search, and subtitle processing capabilities using AWS Bedrock for media understanding.

Setup Requirements

  • ⚠️Requires an AWS account with Bedrock models (Marengo, Pegasus, Claude) enabled and configured AWS CLI.
  • ⚠️Requires manual creation of an S3 Vectors Bucket, S3 Vectors Index, and a DynamoDB table.
  • ⚠️Requires Python 3.10 or higher.
  • ⚠️The `mcp.json` configuration requires an absolute path to the project directory.
Verified SafeView Analysis
The server relies on AWS credentials and proper IAM permissions for interacting with AWS services (Bedrock, S3, S3Vectors, DynamoDB, Transcribe, STS). No hardcoded secrets or 'eval' statements were found. The use of `S3_UPLOAD_BUCKET` for local file uploads introduces a potential risk if arbitrary local file paths are processed, though the `resolve_video_path` function only checks for existing files.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
DigitalBoopLtd icon

murder-mystery-mcp

by DigitalBoopLtd

Sec9

A complete murder mystery game engine exposed as a Model Context Protocol (MCP) server, allowing AI agents to generate procedural mysteries, interrogate AI suspects, search for clues, and solve crimes.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid Service) for mystery generation, LLM responses, and RAG embeddings.
  • ⚠️Requires HF_TOKEN for image generation (HuggingFace API, free tier available but may have limits).
  • ⚠️Requires Python 3.10 or newer.
  • ⚠️The `faiss-cpu` dependency can sometimes be challenging to install on certain operating systems or environments.
Verified SafeView Analysis
The server retrieves API keys (OPENAI_API_KEY, HF_TOKEN) from environment variables, which is a good practice. It utilizes `mcp.server.stdio` for communication, meaning it operates over standard I/O streams, reducing direct network exposure. No 'eval' or obvious code obfuscation was found. The use of third-party APIs (OpenAI, HuggingFace) is standard, assuming their security practices are sound. ELEVENLABS_API_KEY is mentioned in the README configuration but not explicitly retrieved via os.getenv in the truncated source, though its expected usage as an environment variable is clear.
Updated: 2025-12-02GitHub→
0
0
Medium Cost
FlowTheTensor icon

sqlite-mcp

by FlowTheTensor

Sec9

Enables Large Language Models to query a local SQLite database for information via the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires Node.js 18+
  • ⚠️Manual configuration of Claude Desktop with an absolute path to the server executable.
  • ⚠️Requires running multiple setup scripts (`npm install`, `node create_database.js`, `npm run build`) sequentially before first use.
Verified SafeView Analysis
The server explicitly restricts `query_database` tool to only allow SQL SELECT statements, preventing any data modification, deletion, or insertion. This is enforced by a `startsWith("SELECT")` check on the input query. No `eval` functions or hardcoded secrets were found. Communication is local via stdio. The `better-sqlite3` database is initialized with `readonly: false` in the server code, but the application logic's `SELECT` check effectively mitigates the risk of unintended writes through the tool interface.
Updated: 2025-11-24GitHub→
0
0
Medium Cost

movie-metadata-mcp

by stevenaubertin

Sec9

Provides tools for fetching and analyzing movie and TV show metadata from TMDB and OMDB APIs.

Setup Requirements

  • ⚠️Requires OMDB API Key (free, email activation needed)
  • ⚠️Requires TMDB API Key (free)
  • ⚠️Requires manual JSON configuration in Claude Desktop's config file with absolute paths/Docker commands
Verified SafeView Analysis
The server runs locally and communicates via standard I/O with Claude Desktop. It makes external API calls to TMDB and OMDB. API keys are handled via environment variables, which is a standard and secure practice. No direct 'eval' or obfuscation is indicated. Running the server requires trust in the Node.js dependencies.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
Knuckles-Team icon

searxng-mcp

by Knuckles-Team

Sec8

Provides a Model Context Protocol (MCP) server and an Agent2Agent (A2A) agent for performing privacy-respecting web searches using SearXNG.

Setup Requirements

  • ⚠️Requires a running SearXNG instance (self-hosted or external) for web search functionality. Docker Compose setup assumes a co-located SearXNG service.
  • ⚠️The 'searxng-agent' component (if used) requires an LLM provider (e.g., OpenAI, Anthropic, Google) with an associated API key, or a locally running LLM like Ollama, incurring potential costs or setup overhead.
  • ⚠️Advanced authentication methods (JWT, OAuth Proxy, OIDC Proxy, Remote OAuth) demand complex configuration with external identity providers.
Verified SafeView Analysis
The server uses environment variables for sensitive configurations like API keys and credentials, which is good practice. It leverages `yaml.safe_load` to prevent arbitrary code execution from external YAML files. Authentication mechanisms (JWT, OAuth, OIDC) are provided via the `fastmcp` library, which implies robust security handling. A minor concern is the programmatic setting of `os.environ` for LLM API keys in `searxng_agent.py`, though default values point to local LLM instances (like Ollama) reducing immediate external exposure risk. External instance lists are fetched from GitHub, which is an external dependency but reasonable for its functionality.
Updated: 2026-01-19GitHub→
0
0
Low Cost
BootcampToProd icon

embabel-mongo-mcp-server

by BootcampToProd

Sec4

Enables AI agents to interact with a MongoDB database through natural language, performing operations like listing databases, querying, and inserting documents.

Setup Requirements

  • ⚠️Requires Java 21 or higher.
  • ⚠️Requires an OpenRouter API Key (free tier available).
  • ⚠️Requires a running MongoDB instance (local or Atlas).
Verified SafeView Analysis
The server directly parses and executes user-supplied JSON for complex MongoDB queries and document insertions. This allows AI agents (and potentially malicious actors if exposed without authentication) to execute arbitrary MongoDB operations. The security critically depends on the MongoDB user's permissions and strict access control for the MCP endpoint. No explicit input validation or sanitization is present for query or document JSON beyond what MongoDB's driver provides.
Updated: 2025-12-15GitHub→
0
0
Medium Cost
ShifaSiddiqui-412 icon

mcp-server-yt

by ShifaSiddiqui-412

Sec1

A server application, likely for the Minecraft game, potentially developed for a YouTube tutorial or series, enabling multiplayer gameplay.

Setup Requirements

  • ⚠️Requires Java Runtime Environment (JRE) to run the Minecraft server component.
  • ⚠️Requires port forwarding on the host network for external players to connect.
  • ⚠️Specific hardware requirements (RAM, CPU) vary significantly based on player count and installed mods for smooth operation.
Review RequiredView Analysis
Source code was not provided for analysis. It is impossible to perform a security audit for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns without the actual code. Thus, the highest risk is assumed due to the inability to verify safety.
Updated: 2025-11-24GitHub→
0
0
High Cost
mukeshmk icon
Sec8

A REST API for a conversational AI virtual agent that answers questions about movies and weather using a multi-agent LangGraph workflow.

Setup Requirements

  • ⚠️Requires Python >= 3.13.
  • ⚠️Requires an LLM provider (Ollama, OpenAI, or Groq), with `API_KEY` needed for OpenAI/Groq.
  • ⚠️Requires `python -m convai.data.ingest` to be run once to initialize the MovieLens database.
  • ⚠️The MCP Weather Server must be run separately for weather functionality (e.g., `uv run python mcp_server/weather_server.py --transport http`).
Verified SafeView Analysis
The application uses a multi-agent LangGraph architecture with an LLM-driven SQL agent. While this pattern abstracts direct SQL query execution, there's an inherent risk of prompt injection or LLM 'hallucination' leading to unexpected or potentially malicious SQL queries if not adequately guarded against by the LLM and prompt design. The MCP server can execute local Python/Node scripts based on the `MCP_SERVER` environment variable, which poses a configuration risk if an untrusted script path is provided. External API calls are made to legitimate weather and dataset sources. No hardcoded secrets were found; API keys are expected from environment variables.
Updated: 2025-11-28GitHub→
0
0
Low Cost
helloaisumo-star icon

telegram-mcp-server

by helloaisumo-star

Sec2

A server application designed to interact with the Telegram Bot API, likely providing monitoring or management capabilities for Minecraft servers.

Setup Requirements

  • ⚠️Requires a Telegram Bot Token
  • ⚠️Needs a public URL or long-polling setup for Telegram webhooks/API
  • ⚠️May require configuration for Minecraft server details (e.g., IP, port, RCON credentials)
Review RequiredView Analysis
Cannot perform a comprehensive security audit due to the absence of provided source code. Analysis is based solely on the repository name. Potential risks common to server applications (e.g., API key exposure, improper input validation, lack of rate limiting) cannot be assessed without code review.
Updated: 2025-12-11GitHub→
0
0
Low Cost
dipanshuchoudhary-data icon

Expenses-Tracker-MCP-Server

by dipanshuchoudhary-data

Sec9

Provides a backend for AI clients to manage, track, and analyze personal or business expenses through a Model Context Protocol (MCP) interface.

Setup Requirements

  • ⚠️Requires Python 3.10 or newer.
  • ⚠️The README mentions 'SQLite / PostgreSQL (based on configuration)', but the provided source code for `main.py` only implements SQLite.
  • ⚠️The default database uses a local `expenses.db` file for persistence, but if `FASTMCP_ENV` is set to 'cloud', it will use an in-memory database, losing data upon server restart.
Verified SafeView Analysis
The server primarily uses SQLite and employs parameterized queries (e.g., `?`) to prevent SQL injection for data values. While `f-strings` are used to insert column names in `removal` and `update_expense`, these column names are strictly validated against a predefined 'allowed' set, mitigating injection risks. No `eval` or `os.system` calls are present. The database path can be configured to be in-memory or a local file, controlled by `FASTMCP_ENV`. `check_same_thread=False` for SQLite connection is common but requires careful handling in highly concurrent environments, though typically acceptable for lightweight servers.
Updated: 2026-01-17GitHub→
PreviousPage 478 of 760Next