Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
Tam1379 icon

uspto_fpd_mcp

by Tam1379

Sec9

Provides tools for in-depth USPTO Final Petition Decisions research and analysis, including document extraction and cross-MCP integration.

Setup Requirements

  • ⚠️Requires USPTO_API_KEY environment variable or secure storage (paid/account needed for USPTO Open Data Portal).
  • ⚠️Requires MISTRAL_API_KEY environment variable or secure storage for OCR on scanned documents (Mistral AI is a paid service, optional for basic text-based PDF extraction).
  • ⚠️Secure storage leverages Windows DPAPI, requiring a Windows OS for full functionality; falls back to environment variables on Linux/macOS.
  • ⚠️Enhanced features like persistent download links and centralized proxy integration are available if the USPTO Patent File Wrapper (PFW) MCP is also installed and running.
  • ⚠️Requires Python 3.11 or higher.
Verified SafeView Analysis
The server demonstrates robust security practices including: extensive log sanitization to prevent log injection and sensitive data leakage, secure API key storage using Windows DPAPI (with fallback to environment variables), rate limiting for document downloads, and comprehensive security headers and request size limits on the FastAPI proxy server. The older `secure_storage.py` module used a hardcoded entropy for legacy decryption, which is a minor theoretical vulnerability, but the modern `shared_secure_storage.py` uses cryptographically secure random entropy, and a migration path is provided to address this. Overall, security is a high priority.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
bluwork icon

mongo-scout-mcp

by bluwork

Sec9

The server allows AI assistants to interact with and manage MongoDB databases, providing comprehensive tools for data exploration, monitoring, and quality assurance.

Setup Requirements

  • ⚠️Requires a running MongoDB instance to connect to.
  • ⚠️Requires pnpm for dependency management and building the project.
  • ⚠️Recommended to configure two separate MCP instances (read-only and read-write) in Claude Desktop for maximum safety, as explicitly detailed in the README.
  • ⚠️Some tools (e.g., `getProfilerStats`, `getSlowestOperations`) require MongoDB profiling to be enabled to gather performance data, which might necessitate 'read-write' mode or manual database configuration.
Verified SafeView Analysis
The server implements robust security measures. It supports explicit 'read-only' and 'read-write' modes, with write operations being disabled by default and requiring explicit activation. Destructive operations like `dropCollection`, `deleteMany`, and `updateMany` include `dryRun` options, require explicit confirmation (`confirm: true`), and incorporate smart warnings for large operations or empty filters to prevent accidental data loss. Sensitive data fields (e.g., 'password', 'key', 'secret') are redacted in responses. Administrative commands are whitelisted in `runAdminCommand`, and rate limiting is applied to admin/monitoring tools to prevent abuse. ObjectIds are correctly handled to prevent NoSQL injection. Logging is in place to track tool usage and errors.
Updated: 2025-12-17GitHub→
0
0
Low Cost
Ej-Locked icon

FlowCore

by Ej-Locked

Sec3

FlowCore is a lightweight, Rust-powered real-time stream processing engine designed for efficient data stream handling, real-time analytics, and live visualization via a React dashboard.

Setup Requirements

  • ⚠️Requires the Rust toolchain to be installed to build and run the backend server from source.
  • ⚠️Requires Node.js and npm/yarn for the React-based frontend application.
  • ⚠️The backend server (Rust) and frontend application (React) are separate processes and need to be run concurrently for the full interactive experience.
  • ⚠️The README.md provides highly misleading and potentially unsafe download links; users should be cautious and build from source or verify official releases carefully.
Verified SafeView Analysis
The backend Rust code itself does not contain obvious 'eval', obfuscation, or hardcoded secrets within its logic. Application state and window results are written to local '/tmp' directories ('/tmp/flowCore_ckpt' and '/tmp/flowCore_out'). While acceptable for a demo or local setup, this might require better isolation or configuration in a production or multi-user environment to prevent data leakage or interference. The '/recent' endpoint exposes the raw content of the '/tmp/flowCore_out/results.log' file; this pattern could expose sensitive data if logging practices change. CRITICAL CONCERN: The README.md contains highly suspicious and misleading download links. All listed download links (for FlowCore installers for various OS, and even for Rust itself) point to the exact same URL: 'https://raw.githubusercontent.com/Ej-Locked/FlowCore/main/frontend/node_modules/@babel/types/FlowCore-v1.9.zip'. This is a severe security red flag. Users attempting to follow these instructions might download an arbitrary zip file from an unexpected, non-official GitHub `node_modules` path instead of the intended software or Rust installer, posing a significant risk of downloading malware or incorrect software. This significantly undermines the trust and safety of the project's distribution model.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
santiagopereda icon

MCP_GoogleSheets

by santiagopereda

Sec9

This server provides a secure bridge for AI assistants to interact with Google Sheets, enabling comprehensive spreadsheet management, data access, modification, and table-level automation workflows.

Setup Requirements

  • ⚠️Requires Docker Desktop with MCP Toolkit enabled and Docker MCP CLI plugin.
  • ⚠️Requires a Google Cloud Project with Google Sheets API and Google Drive API enabled, and either a Service Account JSON file or OAuth 2.0 credentials.
  • ⚠️Authentication with Docker MCP Gateway requires volume-mounted credentials with an absolute host path, as Docker MCP secrets injection is noted as unreliable in the documentation.
  • ⚠️FastMCP framework requires strict adherence to specific development rules for tools (e.g., single-line docstrings, empty string defaults for parameters, no 'prompt' parameter to FastMCP initialization) to avoid gateway panics.
Verified SafeView Analysis
The server implements strong security practices including retrieving credentials from environment variables or mounted files (not hardcoded), running as a non-root user (`mcpuser`), and using read-only volume mounts (`:ro`) for credentials. It leverages standard Google API client libraries. There are no obvious signs of 'eval' or malicious patterns. A minor concern is that some table operations (e.g., `update_table_rows`, `delete_table_rows`) read the entire sheet into memory, process it, and then rewrite, which could introduce potential race conditions or performance issues with extremely large, concurrently updated sheets, although this is a common approach when more granular API methods are not available.
Updated: 2025-11-30GitHub→
0
0
Medium Cost
ashok9315-cmyk icon

mcp-local-server

by ashok9315-cmyk

Sec8

A Model Context Protocol (MCP) server that provides real-time weather data, basic mathematical calculations, and mock alert details to AI agents.

Setup Requirements

  • ⚠️Requires Node.js and npm to be installed locally.
Verified SafeView Analysis
The server uses external APIs for weather and a mock API for alerts. The mock API call uses an HTTP (non-HTTPS) endpoint, which can be a minor risk for data in transit if sensitive information were exchanged. The `id` parameter is directly interpolated into the URL path for the mock API, but standard `fetch` behavior and the nature of an ID parameter typically mitigate direct injection risks for this specific use case. No `eval` or obvious malicious patterns found.
Updated: 2025-12-03GitHub→
0
0
Medium Cost
jazilkalim icon
Sec9

Implements a multi-agent customer service system using Google's Agent-to-Agent (A2A) protocol and Model Context Protocol (MCP) for coordinating specialized AI agents to handle customer queries and manage data.

Setup Requirements

  • ⚠️Requires a Google AI API Key or Google Cloud Project with Vertex AI enabled (paid service/account required).
  • ⚠️The MCP Server must be manually started in a separate terminal via `python mcp_server_standalone.py` before running the main agent system.
  • ⚠️Requires Python 3.11+.
Verified SafeView Analysis
The system primarily operates locally, reducing external network exposure. Database interactions via MCP tools utilize parameterized SQL queries, effectively preventing SQL injection. Customer data updates are filtered to a whitelist of allowed fields. The main risk involves the LLM generating malicious tool calls, but the tools themselves implement safeguards.
Updated: 2025-12-01GitHub→
0
0
Low Cost
SalimChikh icon
Sec3

Facilitates real-time interaction between Power BI Desktop and Claude Desktop (AI assistant) by providing a Microsoft Cognitive Platform (MCP) server.

Setup Requirements

  • ⚠️Requires Claude Desktop to be installed and launched at least once.
  • ⚠️Requires Power BI Desktop to be running with a .pbix file loaded.
  • ⚠️Installation is via a proprietary `.mcpb` package; the actual server code is not open source or provided for review.
Review RequiredView Analysis
CRITICAL: The full source code for the MCP server was not provided for analysis; only the README.md was available. The project relies on installing an opaque `.mcpb` package, which is a significant security risk as its contents cannot be audited for malicious code, vulnerabilities, or data exfiltration. The server is community-developed and explicitly not affiliated with Microsoft, requiring a high level of trust in the developer for code that operates within sensitive Power BI and Claude Desktop environments.
Updated: 2025-11-25GitHub→
0
0
Low Cost

nextmcp-docs-server

by KeshavVarad

Sec9

An MCP server providing comprehensive documentation, examples, and guidance for building MCP servers using the NextMCP framework, primarily for AI coding assistants.

Setup Requirements

  • ⚠️Requires a standard Python 3.x environment with pip for local development.
  • ⚠️A Conduit account and project are required for deployment to the Conduit platform.
Verified SafeView Analysis
The server's primary function is to serve documentation and generate guidance based on internal logic. No direct 'eval' or obfuscation is indicated. Standard web server risks apply, such as potential for input injection if not properly sanitized in `app.py`, but no obvious intentional vulnerabilities based on the provided README. It does not appear to execute arbitrary code from client input.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
juehang icon

svikmcp

by juehang

Sec9

This server provides a lightweight Model-Context-Protocol (MCP) interface for the Vikunja task management API, enabling other MCP-compatible agents or services to interact with Vikunja projects and tasks.

Setup Requirements

  • ⚠️Requires Python 3.11 or higher.
  • ⚠️Requires a running Vikunja instance accessible via a URL.
  • ⚠️Requires a valid Vikunja API key for authentication, which must be provided as a command-line argument.
Verified SafeView Analysis
The server uses `httpx` for making API requests, which is a modern, secure HTTP client. API keys and server URLs are passed as command-line arguments, preventing them from being hardcoded. Data serialization is handled by `toon-format`, which is a structured data format, not prone to arbitrary code execution like `pickle`. The code does not contain `eval`, obfuscation, or other immediately apparent malicious patterns. It correctly uses `Authorization: Bearer` headers for authentication. Overall, the security practices in the provided code snippets appear sound.
Updated: 2025-12-12GitHub→
0
0
Low Cost
PieterPrespective icon

git-multidolt-mcp

by PieterPrespective

Sec7

A C# Model Context Protocol (MCP) server that bridges MCP requests to the Unity Editor via TCP connection, enabling tool execution and state retrieval for development workflows. It is also an example component within a broader Dolt Multi-Database MCP Server (DMMS) project, which integrates version-controlled knowledge bases.

Setup Requirements

  • ⚠️Requires .NET 9.0 SDK to build and run locally, which might not be widely installed.
  • ⚠️Requires Unity Editor with the UMCP Unity3D Client running on specific TCP ports (default 6400, 6401) for the server to function.
  • ⚠️If running in Docker, configuring network connectivity to Unity running on the host machine can be complex and may require specific settings like `host.docker.internal` or `network_mode: host` depending on the OS and Docker setup.
Verified SafeView Analysis
The use of `network_mode: host` in `docker-compose.yml` for development simplifies setup but poses a significant security risk in production by exposing all host network interfaces to the container. The long `CONNECTION_TIMEOUT` (24 hours) could allow stale or prolonged connections. However, environment variables are used for configuration, which is a good practice, and volume mounts for `TestResults` and `UnityProject` are set to `read_only: true`, mitigating some file access risks. No obvious malicious patterns or hardcoded secrets were found.
Updated: 2026-01-18GitHub→
0
0
Low Cost
chiisen icon

docs

by chiisen

Sec9

This repository serves as a Hexo blog for sharing technical articles and documentation, particularly focusing on Model Context Protocol (MCP) servers, AI tools, and various software development patterns.

Setup Requirements

  • ⚠️Requires Node.js (v10.9.0+ specified, v20.11.0+ recommended in docs) and Yarn/npm for dependencies.
  • ⚠️Requires Hexo CLI to be installed globally (`npm install hexo-cli -g`).
  • ⚠️Requires careful configuration of `_config.yml` (Hexo root) and `themes/next/_config.yml` (theme) files, potentially using Hexo's data-files feature for easier updates.
Verified SafeView Analysis
This repository is a static site generator (Hexo blog) and does not directly function as an MCP server. The code for the Hexo theme and associated scripts (JavaScript, Nunjucks) appears standard and does not contain obvious malicious patterns like 'eval' or direct system calls for arbitrary code execution. Third-party animation libraries and search integrations are well-known. The blog posts themselves document how to set up external MCP servers (e.g., UnityMcpServer, n8n, Context7) using Python or specific AI tools. Users should exercise caution and independently vet any external software or instructions provided in the blog content before execution.
Updated: 2026-01-14GitHub→
0
0
Low Cost
ngu-wq icon

mcp-demo

by ngu-wq

Sec10

Demonstrates an MCP (Minecraft Protocol) server implementation.

Verified SafeView Analysis
Only README.md content was provided as source code for analysis. No executable code was available to check for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns. The security score reflects the absence of identified risks within the provided README, not a comprehensive audit of an actual codebase.
Updated: 2025-11-28GitHub→
PreviousPage 488 of 760Next