Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
High Cost
riddhigupta135 icon
Sec8

Autonomous stock trading system utilizing multiple AI agents and specialized MCP servers for real-time market analysis, news sentiment, risk management, and simulated trade execution.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid)
  • ⚠️Requires Polygon API Key (Paid or with usage limits)
  • ⚠️Requires Brave API Key (Paid or with usage limits)
  • ⚠️Requires Pushover User Key and API Token (Paid)
  • ⚠️Requires outbound internet access for all API calls
Verified SafeView Analysis
API keys are properly managed via environment variables ('.env') to prevent hardcoding. Standard network calls (requests library with HTTPS and timeouts) are used for external services. No 'eval', 'exec', 'pickle', `os.system` or direct shell command injection points were found. LLM output parsing with `json.loads` is safer than `eval` but relies on LLM integrity and robust downstream handling of potential non-JSON output or unexpected structures.
Updated: 2026-01-18GitHub→
0
0
Medium Cost
CASTResearchLabs icon

mcp_scan_server_imaging

by CASTResearchLabs

Sec1

A server component for a scanning system likely involved in image acquisition, processing, or management, inferred from the repository name 'mcp_scan_server_imaging'.

Review RequiredView Analysis
No source code was provided for analysis, therefore a comprehensive security audit could not be performed. The score of 1 indicates that the safety of running this server is unverified and potential critical risks like 'eval', hardcoded secrets, or malicious patterns cannot be ruled out.
Updated: 2025-12-03GitHub→
0
0
Medium Cost
nik-kale icon
Sec8

A security-first gateway for AI agents to interact with external tools and infrastructure, enforcing policies, human approvals, and comprehensive auditing.

Setup Requirements

  • ⚠️Requires Node.js 18+ and pnpm 8+.
  • ⚠️Redis is required for persistent approval storage and is configured via `REDIS_URL`.
  • ⚠️For production, the `JWT_SECRET` must be changed from its placeholder value, and external TLS termination (e.g., via a load balancer) is required for secure communication as the gateway itself does not handle TLS.
Verified SafeView Analysis
The project emphasizes a 'security-first' design with comprehensive input validation (Zod), automatic PII/secret redaction in logs, policy-based access control, human-in-the-loop approvals, and structured audit logging. It utilizes security middleware like Helmet.js and `express-rate-limit`. Authentication with JWT and API keys is implemented, alongside OIDC integration. Key security considerations for deployment include an explicitly noted placeholder `JWT_SECRET` that *must* be changed in production, and a statement in `SECURITY_MODEL.md` that internal TLS/encryption is out of scope, relying on external transport (e.g., a reverse proxy). The provided Docker Compose setup for Redis lacks explicit authentication configuration, which can be a risk if not deployed in a trusted network or with additional Redis security measures.
Updated: 2025-12-27GitHub→
0
0
High Cost
robbgatica icon

memory-lane

by robbgatica

Sec9

AI-powered memory forensics analysis using Volatility 3 and an LLM.

Setup Requirements

  • ⚠️Requires Python 3.8+
  • ⚠️Requires Volatility 3 installed and accessible
  • ⚠️Requires a separate LLM runtime (e.g., Ollama server or Claude Code) to be installed and running.
  • ⚠️Initial processing of memory dumps is time-consuming (5-15 minutes for 2-3 GB) and may require significant temporary disk space.
Verified SafeView Analysis
The server integrates Volatility 3 for memory analysis and exposes its capabilities via the Model Context Protocol (MCP). It handles memory dumps (potentially malicious data) for analysis. No direct 'eval' or 'exec' calls were found in the provided source. Network communication from the Ollama client to the Ollama server is localhost by default, reducing external network risks. Sensitive configurations like API keys are expected as environment variables. Provenance tracking (`provenance.py`) provides an audit trail. The primary security considerations involve the inherent risks of handling potentially malicious memory dumps in a forensic context, and the security of the underlying Volatility 3 framework. The parsing of LLM responses for tool calls introduces a potential, but mitigated, risk if the JSON parsing or tool argument mapping is flawed. Recommendations for running in isolated environments are present in the documentation.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
sepal7 icon

mcp-ado

by sepal7

Sec9

An MCP server enabling AI assistants to access and manage Azure DevOps services, including wikis, repositories, work items, pull requests, builds, releases, and test plans, with multi-project support and WIQL queries.

Setup Requirements

  • ⚠️Requires an Azure DevOps Personal Access Token (PAT) with specific read/write scopes for various services (Code, Work Items, Wiki, Build, Pull Requests, Release, Test Plans).
  • ⚠️Requires Node.js version 18 or higher to run locally.
  • ⚠️Requires specific configuration within an MCP-compatible IDE (e.g., Cursor, VS Code with GitHub Copilot Chat) by modifying its settings.json to point to the server and provide environment variables.
Verified SafeView Analysis
The server's design explicitly addresses sensitive data handling, particularly Azure DevOps Personal Access Tokens (PATs). It leverages environment variables, which are recommended for local setup, and Azure Key Vault for cloud deployments, preventing hardcoding secrets in the repository. Extensive documentation guides users on secure PAT management, including required scopes and updating expired tokens. No direct use of 'eval' or other highly dangerous functions was found. Network interactions are confined to Azure DevOps APIs via HTTPS, which is inherent to its function.
Updated: 2025-12-11GitHub→
0
0
Low Cost
Azure-Samples icon
Sec9

Provides a remote Model Context Protocol (MCP) server implemented with Azure Functions in Java to enable custom AI tool integrations, such as saving/retrieving code snippets and executing simple commands.

Setup Requirements

  • ⚠️Requires JDK 17 (or newer)
  • ⚠️Requires Azure Developer CLI (azd) for deployment
  • ⚠️Requires Docker (or VS Code Azurite extension) for local storage emulation (Azurite)
  • ⚠️Requires Azure Functions Core Tools v4 (≥ 4.0.7030) for local execution
Verified SafeView Analysis
The Java source code is straightforward and does not contain 'eval', code obfuscation, or immediately apparent malicious patterns. Input parameters are handled via annotations and Java types. The infrastructure uses Azure's native security features, including Managed Identities for storage and monitoring access, HTTPS, and supports VNet isolation with private endpoints for the storage account, avoiding hardcoded credentials. It also allows for OAuth via EasyAuth or API Management as next steps.
Updated: 2025-12-10GitHub→
0
0
High Cost
shenghuofei icon

eino-mcp-agent

by shenghuofei

Sec8

An intelligent chat agent built on CloudWeGo Eino, designed to integrate with various tools via the Model Context Protocol (MCP), exemplified by a file counting utility.

Setup Requirements

  • ⚠️Requires LLM API Key (e.g., OpenAI, Volcengine ARK) which may incur costs.
  • ⚠️Requires Go 1.21+ to compile and run the main agent.
  • ⚠️Requires Python 3.7+ for the default file counting MCP server (Node.js 16+ is an alternative if using the JavaScript version).
  • ⚠️Conversation history is sent in full with each LLM request, potentially leading to high token costs and exceeding token limits in long dialogues, as no history length management is implemented.
Verified SafeView Analysis
The project uses standard libraries for file operations and JSON parsing, avoiding direct 'eval' or similar dangerous functions. Hardcoded secrets are avoided by using environment variables (e.g., OPENAI_API_KEY, GITHUB_TOKEN). The primary risks involve potential for LLM-generated malicious inputs to tools if not properly constrained, or if the configuration (config.yaml) were to specify a malicious command for an MCP server, which is a configuration-level risk rather than a code vulnerability.
Updated: 2026-01-19GitHub→
0
0
Low Cost
Jammy2005 icon
Sec7

Deploys a remote Model Context Protocol (MCP) server on Cloudflare Workers, providing custom AI tools (a calculator in this case) accessible via Server-Sent Events (SSE) without authentication.

Setup Requirements

  • ⚠️Requires a Cloudflare account for deployment and execution.
  • ⚠️Deployment is specific to the Cloudflare Workers environment.
  • ⚠️The server is intentionally 'authless', which means no authentication is required to use the tools.
Verified SafeView Analysis
The server is explicitly designed to be 'Authless,' meaning it does not require authentication to access its tools. While this is a stated design choice, it implies that anyone with the URL can invoke the provided calculator tools. No explicit 'eval' or other highly dangerous patterns were found. Cloudflare Workers generally provide a secure execution environment.
Updated: 2025-11-26GitHub→
0
0
High Cost
Sec6

Provides AI assistants with tools to interact with Bitbucket Cloud repositories via the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires a Bitbucket API Token with specific permissions (repository:read, pullrequest:read, pullrequest:write)
  • ⚠️Requires Docker for recommended usage (containerized stdio or HTTP transports)
  • ⚠️HTTP transports (SSE, HTTP Stream) currently lack native HTTPS/TLS support, requiring a reverse proxy for secure deployment.
Verified SafeView Analysis
Requires sensitive Bitbucket API tokens (BITBUCKET_API_TOKEN, BITBUCKET_EMAIL, BITBUCKET_WORKSPACE) as environment variables, which must be secured. HTTP transports (SSE, HTTP Stream) currently lack native HTTPS/TLS support, posing a risk if exposed over an untrusted network without a reverse proxy. The stdio transport mitigates this by avoiding HTTP.
Updated: 2025-11-17GitHub→
0
0
Low Cost
SalesforceDiariesBySanket icon

mcp-router

by SalesforceDiariesBySanket

Sec8

This server acts as an MCP (Model Context Protocol) Host, bridging Salesforce (Apex/Flow) with remote MCP servers via a REST API, translating requests and managing connections.

Setup Requirements

  • ⚠️Requires `API_KEY` environment variable to be set for production authentication; otherwise, it runs without authentication in 'development mode'.
  • ⚠️For MCP servers configured with OAuth 2.1 (Authorization Code flow), the initial connection will require a manual browser-based authorization step by opening a provided `authorizationUrl`.
  • ⚠️The `MCP_SERVERS` environment variable must be a valid JSON string, which can be challenging to manage with escaping in some deployment environments.
Verified SafeView Analysis
The server employs API key authentication, `helmet` for security headers, and configurable CORS. Sensitive configurations like MCP server URLs and OAuth credentials are managed via environment variables or dynamically registered via API endpoints that are themselves protected by the main API key. OAuth 2.1 with PKCE is implemented for secure authorization flows. A potential concern is the `authMiddleware` explicitly bypassing authentication in development mode if `API_KEY` is not set, which could be a risk if deployed improperly to production. Dynamic server registration with sensitive OAuth secrets in the request body requires the API endpoint to be sufficiently secured.
Updated: 2025-12-10GitHub→
0
0
Medium Cost
foyst icon
Sec8

Provides Retrieval Augmented Generation (RAG) capabilities by integrating an AWS Bedrock Knowledge Base with the Model Context Protocol (MCP) for various AI agent clients.

Setup Requirements

  • ⚠️Requires AWS credentials configured for Pulumi/SST deployment.
  • ⚠️Requires deployment of AWS resources (Bedrock Knowledge Base, S3 bucket, IAM roles, OpenSearch Serverless) using SST/Pulumi.
  • ⚠️The `AWS_BEDROCK_KNOWLEDGE_BASE_ID` is a required environment variable derived from the SST deployment output.
Verified SafeView Analysis
The source code appears to be well-structured and does not contain obvious malicious patterns or hardcoded secrets. It correctly distinguishes between local execution (requiring explicit AWS credentials via environment variables) and Lambda execution (relying on IAM roles). However, the default Lambda function URL configuration sets `cors.allowOrigins` to `["*"]`, which permits requests from any origin. While convenient for development, in a production scenario, this should be restricted to known client origins for better security, as explicitly noted in the project's README.
Updated: 2025-11-24GitHub→
0
0
Low Cost
ShubhamChougale01 icon

bigquery-mcp-server

by ShubhamChougale01

Sec4

Provides a secure, authenticated, and rate-limited Model Context Protocol (MCP) server for AI agents and clients to interact with Google BigQuery.

Setup Requirements

  • ⚠️Requires a Google Cloud Project with BigQuery enabled.
  • ⚠️Requires creating a Google Cloud Service Account with 'BigQuery Data Editor' and 'BigQuery Job User' roles.
  • ⚠️Requires manual download and placement of the service account JSON key file (`bigquery-credentials.json`) or specifying its path via an environment variable.
  • ⚠️Mandatory `PROJECT_ID` environment variable configuration.
Review RequiredView Analysis
The server allows direct execution of client-provided SQL queries via the `bq.run_query` tool. Given that the required service account roles include 'BigQuery Data Editor', an untrusted or compromised AI agent could potentially perform SQL injection attacks, leading to unintended data modification, deletion, or extraction within the BigQuery project. While authentication, rate limiting, and session management are in place, the direct execution of arbitrary SQL without sanitization by the server itself presents a significant risk with powerful BigQuery permissions.
Updated: 2025-12-11GitHub→
PreviousPage 494 of 760Next