Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
sharkusmanch icon

steam-mcp-server

by sharkusmanch

Sec9

An MCP server that provides tools for interacting with the Steam Web API to access game library, achievements, and player data.

Setup Requirements

  • ⚠️Requires a Steam Web API Key (Free, but needs a Steam account).
  • ⚠️Requires Node.js >= 18.0.0.
  • ⚠️Many tools (e.g., `get_inventory`, `get_achievements`, `get_friends_list` with full info) require the target Steam profile to be public, otherwise calls may fail or return incomplete data.
Verified SafeView Analysis
The server implements strong security practices: Steam API keys are loaded from environment variables (`STEAM_API_KEY`), preventing hardcoding. Input validation is applied to sensitive parameters like Steam IDs, vanity URLs, and IP addresses, using regular expressions. Critically, the `get_servers_at_address` tool explicitly blocks private, internal, loopback, and multicast IP ranges to prevent Server-Side Request Forgery (SSRF) attacks. Error messages are sanitized by `sanitizeErrorMessage` to avoid leaking internal server details or sensitive information, replacing them with generic, actionable messages.
Updated: 2026-01-15GitHub→
0
0
High Cost
HarryReidx icon

spring-mcps

by HarryReidx

Sec3

Ingest and semantically enhance documents (PDF, Markdown) into Dify knowledge bases, with VLM for image analysis and LLM for text summarization, while monitoring task status via a web frontend.

Setup Requirements

  • ⚠️Requires PostgreSQL database for task management and image metadata persistence.
  • ⚠️Requires external MinerU service for PDF/document parsing.
  • ⚠️Requires Dify instance and API Key for knowledge base interaction.
  • ⚠️Requires external VLM and LLM services (e.g., OpenAI, Qwen, Ollama) which may incur usage costs and need specific API keys/credentials.
Review RequiredView Analysis
The `application.yml` file contains hardcoded default values for critical credentials (Dify API Key, PostgreSQL username/password, MinIO access key/secret key). While environment variables can override these, the defaults themselves are publicly visible in the repository, posing a significant security risk if used in production without being explicitly overridden. This could lead to unauthorized access to Dify, MinIO, and the database. External services (MinerU, VLM, LLM) URLs are also hardcoded to a specific IP (`117.50.75.212`) as defaults, which could expose internal network structure or lead to unintended connections if not overridden. The `RequestCleanupFilter` is a good practice for cleaning request bodies.
Updated: 2025-12-18GitHub→
0
0
Medium Cost
manutej icon
Sec8

Orchestrates multiple AI models through Crush CLI for Claude Code, enabling intelligent strategy selection based on speed, cost, and quality requirements.

Setup Requirements

  • ⚠️Requires Crush CLI installed (e.g., `brew install charmbracelet/tap/crush`).
  • ⚠️Requires API keys for AI models (Grok, Anthropic) to be configured in Crush CLI's configuration file (`~/.local/share/crush/crush.json`) for real execution, which may incur paid usage.
  • ⚠️Requires Node.js version 18 or higher to run the server.
  • ⚠️Manual configuration in Claude Code's settings file (`~/.claude/settings.json`) is needed for integration.
Verified SafeView Analysis
The server primarily uses stdio for communication, reducing direct network exposure. It spawns the external `Crush CLI` binary, delegating actual model interactions and API key management to it. Security largely depends on the `Crush CLI`'s configuration (e.g., API keys stored in `~/.local/share/crush/crush.json`) and the security of the Crush binary itself. No direct `eval` or obvious malicious patterns were found in the provided source code.
Updated: 2025-11-29GitHub→
0
0
Medium Cost
msilverblatt icon

wiki-mcp

by msilverblatt

Sec9

Provide comprehensive access to Wikipedia articles via a Model Context Protocol (MCP) server, offering tools for searching, content retrieval, summaries, categories, links, images, languages, and external references.

Setup Requirements

  • ⚠️Requires Bun runtime (version 1.2.0 or higher)
Verified SafeView Analysis
The server uses 'zod' for robust input validation, includes request timeout handling, and comprehensive error handling. It interacts with standard Wikipedia API endpoints (en.wikipedia.org/w/api.php and en.wikipedia.org/api/rest_v1). No 'eval' or obfuscation is present in the provided source. HTML stripping for search snippets is a good sanitization practice. No hardcoded sensitive secrets were found.
Updated: 2025-12-13GitHub→
0
0
Low Cost
Luis-E-Dev icon
Sec2

Connects to an MCP server to fetch account data and write it to Google Sheets.

Setup Requirements

  • ⚠️Requires a separate, locally running MCP server with a `search_accounts` tool (the server's code is not provided).
  • ⚠️The hardcoded absolute path to the MCP server (`/Users/luisescalante/Desktop/my-new-mcp-server/main.py`) in `client.py` must be updated by the user to their local server path.
  • ⚠️Requires Google Cloud project setup, Sheets API enablement, and a service account JSON key; the provided `googlecredential.json` file is incorrect for service account authentication and exposes personal credentials.
Review RequiredView Analysis
The repository includes a `googlecredential.json` file containing a plain text email and password, which is a severe security risk and exposes personal credentials. Although the `client.py` code expects a Google Service Account JSON key (as per the `creds.json` described in the README), the presence of this sensitive file in the repository is a major security flaw. Additionally, the client executes an external MCP server script via a hardcoded absolute path (`/Users/luisescalante/Desktop/my-new-mcp-server/main.py`), making its security dependent on the integrity and trustworthiness of that unprovided script and the execution environment.
Updated: 2026-01-17GitHub→
0
0
Medium Cost
dsd2077 icon
Sec1

Analysis of the server's function and purpose is not possible due to the absence of provided source code.

Setup Requirements

  • ⚠️Source code not provided, unable to identify specific setup requirements or friction points.
Review RequiredView Analysis
Source code was not provided for analysis. Therefore, a comprehensive security audit could not be performed, and the server's safety cannot be determined. All security risks are unknown, making it inherently unsafe to assume it's secure.
Updated: 2025-11-26GitHub→
0
0
Low Cost
skspyapa icon
Sec1

Provides personalized clothing suggestions based on current weather conditions.

Review RequiredView Analysis
Critical: Source code not provided beyond README.md, making it impossible to conduct a security audit for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns. Users should exercise extreme caution as safety cannot be verified without code inspection.
Updated: 2025-12-06GitHub→
0
0
High Cost
Satyampant icon
Sec8

A Python code security analyzer powered by OpenAI Agents and Semgrep MCP server, identifying vulnerabilities and recommending fixes through a web interface.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid)
  • ⚠️Python 3.12+
  • ⚠️Node.js 20+
  • ⚠️Semgrep CLI/MCP server needs to be installable/accessible (via `uvx semgrep-mcp`)
Verified SafeView Analysis
The core application (`backend/server.py`) uses `os.getenv` for API keys and securely limits AI agent tools to `semgrep_scan` via `create_static_tool_filter`, which is a strong positive. However, the `/semgrep-test` endpoint uses `subprocess.run` to execute `pip install semgrep`, which introduces a minor supply chain risk if the execution environment is compromised, though it's a fixed command. An unrelated `airline.py` file containing a direct `eval(expr)` exists in the repository but is not imported or used by the main API server.
Updated: 2025-12-02GitHub→
0
0
Medium Cost
agiprolabs icon
Sec9

An extended MCP server for AI-driven sequential problem-solving, enabling context persistence, task management, and auto-documentation of thinking sessions.

Setup Requirements

  • ⚠️Requires Node.js version 20 or higher.
  • ⚠️Relies on an MCP-compatible AI client (e.g., Claude Desktop) for interaction.
  • ⚠️Persistent storage for sessions, thoughts, and tasks is saved to a local directory defined by the `DATA_PATH` environment variable (defaults to `./data`), which needs appropriate permissions and management, especially in containerized environments.
Verified SafeView Analysis
The server uses a file-based storage mechanism (`FileStorage`) for persistence, relying on a configurable `DATA_PATH` to store JSON files. It communicates over standard I/O (`StdioServerTransport`) with the MCP client, limiting direct network exposure. No 'eval' or obvious code obfuscation was found. Potential risks are primarily related to file system access if `DATA_PATH` is misconfigured, but this is a standard risk for any file-writing application. The dependencies like `express` and `cors` are part of the broader `@modelcontextprotocol/sdk` but are not directly instantiated by this specific server's core logic which is focused on stdio transport.
Updated: 2025-12-03GitHub→
0
0
Low Cost

mcp-demo-repo

by deki18

Sec10

This file serves as a demonstration and description of a GitHub MCP Server's capabilities, focusing on repository management actions like searching, creating repositories, and creating files.

Setup Requirements

  • ⚠️The described 'GitHub MCP Server' would inherently require a GitHub API Token with appropriate permissions (e.g., repo scope) to perform repository search, creation, and file creation operations.
  • ⚠️The actual source code for the 'GitHub MCP Server' itself is not provided, making it impossible to identify its specific setup requirements or dependencies.
Verified SafeView Analysis
The provided 'SOURCE CODE' is a static markdown file (`demo.md`) and contains no executable code, scripting, or dynamic content. As such, it poses no direct security risks. The actual 'GitHub MCP Server' it describes is not part of this audit.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
VeVarunSharma icon

mcp-servers

by VeVarunSharma

Sec9

This server acts as a Model Context Protocol (MCP) server, providing weather alerts and forecasts by integrating with the National Weather Service (NWS) API.

Setup Requirements

  • ⚠️Requires Node.js version 24.x.
  • ⚠️Uses 'pnpm' as the package manager, not 'npm' or 'yarn'.
  • ⚠️A build step ('pnpm run build') is required before running the server in production mode.
Verified SafeView Analysis
The server appears well-structured with no direct use of 'eval' or other highly dangerous dynamic code execution. Input validation for API tools is implemented using Zod in the Express.js version. It makes external HTTP requests to the NWS API, handling basic HTTP errors. The 'User-Agent' is hardcoded but is not a sensitive secret. Overall, the code itself does not exhibit obvious vulnerabilities, relying on the security of the underlying MCP SDK and NWS API.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
Revenant30102000 icon

wotblitz-mcp

by Revenant30102000

Sec9

Provides AI assistants with access to detailed World of Tanks Blitz game data by parsing local game files.

Setup Requirements

  • ⚠️Requires World of Tanks Blitz game installed locally
  • ⚠️Requires WOTB_GAME_PATH environment variable set to the game's Data folder
  • ⚠️Requires Node.js >=18
Verified SafeView Analysis
The server reads data from local game files (WOTB_GAME_PATH), which are assumed to be trusted. Input validation for tool calls is enforced using Zod. No direct 'eval' or obvious malicious patterns were found. The primary security consideration would be a misconfigured WOTB_GAME_PATH pointing to sensitive directories or potential vulnerabilities in third-party parsing libraries (e.g., sharp, XML/YAML parsers) when dealing with malformed game files, though these are generally robust.
Updated: 2025-11-28GitHub→
PreviousPage 481 of 760Next