Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
johanthoren icon

parrotscribe-mcp

by johanthoren

Sec9

Enables AI agents to interact with the ParrotScribe real-time transcription service on macOS to facilitate 'Speech-to-Action' workflows such as monitoring meetings, tracking action items, or summarizing discussions.

Setup Requirements

  • ⚠️Requires macOS with ParrotScribe installed.
  • ⚠️Requires Node.js 18 or higher.
  • ⚠️The `pscribe` CLI must be available in your system PATH.
Verified SafeView Analysis
The server directly executes external `pscribe` CLI commands using `child_process.execFileSync`. While arguments are passed as an array to mitigate common shell injection, the overall security critically depends on the robustness and trustworthiness of the `pscribe` CLI itself and preventing malicious manipulation of the `PSCRIBE_PATH` environment variable. Given its local-only operation via standard I/O (stdio) and explicit 'zero-cloud' data flow, network attack surfaces are significantly reduced.
Updated: 2026-01-17GitHub→
0
0
Medium Cost
Sec8

A Cloudflare Workers server for stock screening using SBI証券 CSV data, integrated with ChatGPT for natural language queries.

Setup Requirements

  • ⚠️Requires downloading SBI証券 CSV files in a specific two-step process and placing them in the `inbox/` directory.
  • ⚠️Requires a Cloudflare account and configured Cloudflare KV for data storage.
  • ⚠️The `npm run upload-csv` command will require local Cloudflare CLI authentication or API tokens to interact with Cloudflare KV.
Verified SafeView Analysis
The example API key provided in the README for ChatGPT integration is a specific value that is likely hardcoded or configured as a secret on the deployed server. In general, API keys should be securely managed and not exposed in documentation examples if they are meant to be unique/sensitive for each deployment. The `upload-csv` script requires local Cloudflare authentication, which could be a security risk if not handled securely by the user.
Updated: 2025-11-19GitHub→
0
0
Low Cost
BigBang142 icon
Sec1

Enables anonymous web searching via the Tor network and DuckDuckGo for use with local language models.

Review RequiredView Analysis
The provided source code is an index.md file (documentation) and does not contain any executable code (e.g., Python, JavaScript, Java) for a security audit. Therefore, it is impossible to analyze for 'eval', obfuscation, hardcoded secrets, or malicious patterns. The security score reflects the inability to perform a code-level audit, not a proven vulnerability or safety concern with the described functionality itself.
Updated: 2026-01-19GitHub→
0
0
Low Cost
Pravamaya2 icon

Expenses-Tracker

by Pravamaya2

Sec8

Track and manage personal expenses with a remote API server.

Setup Requirements

  • ⚠️Requires Python 3.12 or higher.
Verified SafeView Analysis
The server generally uses parameterized queries, which effectively prevents common SQL injection vulnerabilities. Dynamic query construction in `update` is limited to trusted field names, reducing risk. No hardcoded secrets or 'eval' statements were found. The server binds to localhost (127.0.0.1) by default, limiting network exposure. Error handling for database errors provides generic messages without exposing full tracebacks to clients, though tracebacks are printed internally.
Updated: 2026-01-08GitHub→
0
0
Low Cost
Mezo1122 icon

RiMCP_hybrid

by Mezo1122

Sec5

A server-side application related to the Minecraft protocol, likely for custom game hosting or server management, with features for adapting to different Minecraft versions or platforms.

Setup Requirements

  • ⚠️Requires Java Runtime Environment (JRE)
  • ⚠️May require specific Minecraft client versions for compatibility.
Review RequiredView Analysis
A meaningful security audit cannot be performed as no source code was provided for analysis. The score of 5 reflects an inability to verify any security practices, assuming a neutral stance.
Updated: 2026-01-19GitHub→
0
0
Low Cost
mcpize icon

templates

by mcpize

Sec9

A boilerplate template for building Model Context Protocol (MCP) servers in Python using FastMCP, providing basic synchronous and asynchronous tool examples with development logging.

Setup Requirements

  • ⚠️Requires Python 3.11+
  • ⚠️Requires `uv` for dependency management (alternative to pip)
  • ⚠️Requires `make` to use the provided quick start commands
Verified SafeView Analysis
The server code itself implements good practices for logging and environment variable handling. No direct vulnerabilities like `eval`, `exec`, or hardcoded secrets were found. The `DevLoggingMiddleware` uses `json.dumps` for logging incoming parameters, which is safe. It relies on the security of the `FastMCP` SDK.
Updated: 2026-01-06GitHub→
0
0
Medium Cost
kunaldb icon

wiki_mcp_server

by kunaldb

Sec9

An MCP (Model Context Protocol) server for integrating Confluence wiki content, allowing AI models to search, retrieve, and list Confluence information.

Setup Requirements

  • ⚠️Requires a Databricks workspace with Apps enabled and Databricks CLI configured.
  • ⚠️Requires a Confluence account with API access and an API token (not a password).
  • ⚠️Confluence credentials (URL, email, API token) must be configured as environment variables or in 'app.yaml' (not committed to Git).
Verified SafeView Analysis
The code adheres to good security practices for credential management, explicitly using environment variables (CONFLUENCE_URL, CONFLUENCE_EMAIL, CONFLUENCE_API_TOKEN) and warning against committing 'app.yaml' to source control. There are no obvious `eval` or unsafe execution patterns. The deployment script uses standard Databricks CLI commands. Network risks are managed by the Databricks Apps platform and Confluence's own security (e.g., IP allowlisting).
Updated: 2025-12-02GitHub→
0
0
Low Cost
b48f8f5xg2-blip icon

dynamic-shell-server

by b48f8f5xg2-blip

Sec3

This server provides a secure Model Context Protocol (MCP) interface for executing shell commands with an external approval system and process management.

Setup Requirements

  • ⚠️Requires Python virtual environment and dependencies from `requirements.txt`.
  • ⚠️Claude Desktop integration requires manual configuration with absolute paths to Python interpreter and server script.
  • ⚠️An interactive user approval process (external to this server's code) is required for first-time command executions.
Review RequiredView Analysis
The server's `execute_command` tool defaults to `shell=True` for `asyncio.create_subprocess_shell`, and `run_in_venv` explicitly uses `/bin/bash -c`. This directly contradicts the README's claim of 'No shell execution (prevents injection attacks)'. Furthermore, the advertised '5-minute command timeout' is not implemented in `run_process_in_background`, which uses `process.communicate()` without a timeout, allowing commands to run indefinitely. While an external approval system is described, the server code itself enables highly privileged shell execution without internal safeguards against common vulnerabilities like command injection or hanging processes. The reliance on an external, unspecified approval system for security is a significant concern given the server's direct capabilities.
Updated: 2025-12-06GitHub→
0
0
Medium Cost
080bct12alex icon

ChatBot

by 080bct12alex

Sec2

Develops a versatile and interactive AI chatbot using LangGraph, featuring advanced concepts like memory, persistence, tool integration (search, calculator, stock price), multi-party communication (MCP), and retrieval-augmented generation (RAG) with a Streamlit user interface and user management.

Setup Requirements

  • ⚠️Requires Google Generative AI API Key (Paid) for ChatGoogleGenerativeAI.
  • ⚠️Requires `alexmcp.fastmcp.app` service to be running and accessible for Multi-Server MCP tools.
  • ⚠️Relies on several Python packages including `streamlit`, `langchain`, `langgraph`, `aiosqlite`, `bcrypt`, `requests`, `streamlit-cookies-manager`, `huggingface_hub`, `pypdf`, and `faiss-cpu`. Missing any could cause runtime errors.
  • ⚠️The Alpha Vantage API key is hardcoded and should be replaced with an environment variable.
  • ⚠️The Streamlit cookie manager password is hardcoded and must be replaced with a strong, securely managed environment variable.
Review RequiredView Analysis
CRITICAL: The Alpha Vantage API key is hardcoded in `agent.py` (`apikey=8S6VBWTFZH9U6HDA`). CRITICAL: The cookie encryption password for `EncryptedCookieManager` is hardcoded in `app.py` (`password="7b9561efc4a6acf95c78285418225434533f70dd609026c8ff9ba1c50a5be6c6"`). These hardcoded secrets pose significant security risks, allowing unauthorized access to API services and potential decryption of user session data. While user authentication with bcrypt is implemented for passwords, the overall system is highly vulnerable due to these critical hardcoded secrets.
Updated: 2025-11-29GitHub→
0
0
Medium Cost
danielsimonjr icon

substack-mcp

by danielsimonjr

Sec1

Unable to determine the use case as the source code was not provided.

Setup Requirements

  • ⚠️Source code was not provided, preventing analysis of specific requirements, dependencies, or setup friction.
  • ⚠️Cannot identify specific system requirements or configuration needs without access to the code.
Review RequiredView Analysis
Source code was not provided, therefore a comprehensive security audit could not be performed. Without access to the code, it is impossible to check for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns. Any server without code inspection should be considered highly insecure by default.
Updated: 2025-11-26GitHub→
0
0
Medium Cost
ValentinTorassa icon

ShellFusion-mcp-server

by ValentinTorassa

Sec3

A full-stack application for managing tickets, with a Python-based Model Context Protocol (MCP) server to enable AI assistant integration for interacting with the backend API.

Setup Requirements

  • ⚠️Docker Desktop is required to run the MongoDB database component.
  • ⚠️Separate Python 3.10+ virtual environment and the `mcp` CLI tool (`pip install fastmcp`) are required to run the AI integration server.
  • ⚠️The full local development setup requires running multiple `npm install` and `npm run dev` commands in both `backend` and `frontend` directories.
  • ⚠️Crucial environment variables (`BACKEND_API_KEY`, `TOKEN_SECRET`, `MONGODB_URI`) must be set for the backend and MCP server to function correctly.
  • ⚠️Default database credentials (`root/example` and `appuser/apppass`) are hardcoded in the Docker setup, which must be changed for production deployments.
Review RequiredView Analysis
1. **API Key Bypass:** The `apiKeyAuth` middleware (backend/src/middlewares/apiKeyAuth.ts) explicitly bypasses API key authentication if the `BACKEND_API_KEY` environment variable is not set. This could unintentionally expose protected API routes if the variable is omitted in a production environment. 2. **Hardcoded Docker Credentials:** Default hardcoded MongoDB root ('root'/'example') and application-specific ('appuser'/'apppass') credentials are used in `docker-compose.yml` and `mongo-init/001-init.js`. While common for local development, these are **critical security risks** if deployed in a production environment without immediate and strong modification. 3. **Missing Security Headers:** The `helmet` dependency is listed in `backend/package.json` but is not explicitly utilized in `backend/src/index.ts`, missing out on a straightforward way to implement crucial security headers for HTTP responses. 4. **CORS Configuration:** CORS is configured to allow `FRONTEND_ORIGIN`. Ensure this variable is strictly controlled and not set to `*` in production to prevent unintended cross-origin access. 5. **JWT Handling:** JWT tokens are signed with `process.env.TOKEN_SECRET` and expire in '8h'. The `Authorization` cookie is set with `httpOnly` and `secure` flags conditionally based on `NODE_ENV`, which is good practice. 6. **Password Hashing:** Passwords are securely hashed using `bcryptjs` with 12 salt rounds.
Updated: 2025-11-26GitHub→
0
0
Medium Cost

TerraformAI

by dinesh20025

Sec6

This repository uses Terraform to provision and manage cloud infrastructure, likely on Microsoft Azure, with a focus on deploying or supporting AI-related services.

Setup Requirements

  • ⚠️Terraform CLI must be installed and configured on the local machine or CI/CD runner.
  • ⚠️Requires an Azure subscription with authenticated credentials and appropriate permissions (e.g., Contributor role for resource provisioning).
  • ⚠️Absence of a README file means critical information regarding variables, prerequisites, and specific deployment instructions is missing, leading to friction during setup.
Review RequiredView Analysis
Without access to the actual content of the Terraform files (.tf), a comprehensive security audit is not possible. The score reflects a generic Terraform project; specific network risks or misconfigurations in the IaC cannot be assessed. No 'eval' or obfuscation is expected in declarative Terraform, but the security depends entirely on the deployed resources' configurations.
Updated: 2025-11-17GitHub→
PreviousPage 487 of 760Next