Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
alestmej icon

mcp-stdio-server

by alestmej

Sec8

This server acts as a Model Context Protocol (MCP) tool provider, allowing AI chats to query and potentially control Electrolux smart home appliances by integrating with the Electrolux Cloud API.

Setup Requirements

  • ⚠️Requires Electrolux API Key and JWT Token from the Electrolux Developer Portal (requires signup).
  • ⚠️Requires Java and Maven to build/run standalone, or Docker for containerized deployment.
  • ⚠️Integration is currently only explicitly verified for Claude Desktop.
Verified SafeView Analysis
The server design is straightforward, primarily acting as a proxy for Electrolux API GET requests. It handles API keys and JWT tokens dynamically passed from the AI assistant, rather than hardcoding them or reading them from the environment. No 'eval' or obfuscation is present. Input validation for `applianceId` is not explicitly shown, but for GET requests, this is typically less critical than for write operations. The primary security consideration lies in the secure handling of API keys and JWT tokens by the AI assistant and the robustness of the Electrolux API itself.
Updated: 2025-12-29GitHub→
0
0
High Cost

marqeta-diva-mcp

by zvika-finally

Sec7

Provides an MCP server for programmatic access to the Marqeta DiVA API, enabling AI assistants to retrieve aggregated production financial data for analytics and reporting.

Setup Requirements

  • ⚠️Requires Marqeta DiVA API credentials (Application Token, Access Token, and Program Name) which must be obtained separately from Marqeta.
  • ⚠️Enabling RAG features (local storage, semantic search) necessitates installing additional '[rag]' dependencies and explicitly setting the 'ENABLE_LOCAL_STORAGE=true' environment variable.
  • ⚠️The 'uv' package manager is recommended for streamlined dependency management and execution using 'uvx'.
Verified SafeView Analysis
The project is an unofficial community effort, not officially supported by Marqeta, which introduces a higher risk profile for official support. It processes aggregated production financial data, necessitating careful handling of Marqeta API credentials and secure deployment. No 'eval' or code obfuscation is apparent in the provided information. The primary security considerations are the sensitive nature of the data handled and the secure management of third-party API keys.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
sabariaz94 icon

mcp-server-yt

by sabariaz94

Sec1

Cannot determine use case as the source code was not provided for analysis.

Setup Requirements

  • ⚠️Source code required for analysis was not provided.
  • ⚠️Functionality, dependencies, and setup steps cannot be determined without source code.
Review RequiredView Analysis
Source code was explicitly requested for analysis but not provided. Therefore, a comprehensive security audit for 'eval', obfuscation, network risks, hardcoded secrets, or malicious patterns is impossible. The score reflects an inability to verify safety, defaulting to the lowest possible due to lack of visibility. Running this software without code review is inherently risky. Without the source code, use case, tags, efficiency metrics, specific setup requirements, exact categorization, required environment variables, and the precise run command cannot be determined accurately.
Updated: 2025-11-23GitHub→
0
0
Low Cost
balochshees icon

Claude-Monitor

by balochshees

Sec9

Tracks Claude API token usage and limits in real-time on macOS via a menu bar application.

Setup Requirements

  • ⚠️Requires macOS 10.15 or above.
  • ⚠️Requires a Claude OAuth token (starts with `sk-ant-oat...`); regular Claude API keys (`sk-ant-api...`) will not work.
  • ⚠️Installation involves downloading a `.dmg` file and dragging the app to the Applications folder.
Verified SafeView Analysis
The application securely stores API tokens in the macOS Keychain. It does not use `eval` or similar dangerous functions. Network communication uses HTTPS. The privacy policy explicitly states that no personal information is collected, and usage statistics are stored locally. The Sentry DSN for crash reporting is hardcoded but is not a sensitive secret and is disabled in debug builds.
Updated: 2026-01-19GitHub→
0
0
Low Cost
NaetheraS icon
Sec1

This application simplifies the setup and enhancement of a Claude Code development environment by installing a pack of skills and plugins.

Setup Requirements

  • ⚠️Requires users to download and execute an installer from an external GitHub Releases page, which is not provided for security vetting.
  • ⚠️Requires a stable internet connection for download.
  • ⚠️Assumes basic user comfort with running commands in a terminal or command prompt.
Review RequiredView Analysis
The provided 'SOURCE CODE' is solely a `README.md` file (index.md) and does not contain any executable server code. Therefore, a security audit of an 'MCP Server' itself is impossible with the given information. The README describes downloading and running an installer from GitHub Releases. Running external executables (like `claude-skills-pack-installer.exe`, `.dmg`, or a script) from an unverified source carries inherent risks, as their contents are unknown and could potentially contain malicious patterns, use 'eval', or exploit system vulnerabilities. No hardcoded secrets or network risks could be identified from the documentation alone.
Updated: 2026-01-19GitHub→
0
0
Low Cost

mcp-pentest

by baguskto

Sec9

A comprehensive Model Context Protocol (MCP) server for penetration testing with educational guidance, making security testing accessible while providing powerful capabilities.

Setup Requirements

  • ⚠️Node.js 18+ is required.
  • ⚠️Manual installation of multiple external pentesting tools (e.g., nmap, nikto, gobuster, sqlmap, jadx) is necessary, often with OS-specific commands (brew, apt-get).
  • ⚠️Requires manual configuration within Claude Code's `claude_desktop_config.json` including an absolute path to the server's entry point.
Verified SafeView Analysis
The MCP server explicitly addresses security concerns by implementing an authorization system (token-based), rate limiting, comprehensive input validation to prevent command injection (via `input-validator.ts`), and detailed audit logging. It leverages `command-executor.ts` for safe command execution. However, as a penetration testing tool, it is designed to interact with target systems and execute powerful external binaries (Nmap, Nikto, SQLMap, etc.). Users must adhere strictly to the legal disclaimers and 'AUTHORIZED USE ONLY' warnings, obtaining written permission before testing any target, as misuse can have severe legal consequences.
Updated: 2025-11-16GitHub→
0
0
Medium Cost
feamster icon

paymo-mcp

by feamster

Sec9

Integrate Paymo time tracking, invoicing, and project management with Claude Desktop via Model Context Protocol.

Setup Requirements

  • ⚠️Requires Python 3.8+.
  • ⚠️Requires a Paymo account with API access, and manual generation of an API key.
  • ⚠️Requires `fastmcp` to be installed (`pip install fastmcp`).
  • ⚠️Configuration files (`~/.mcp-config/paymo/config.json` and `~/.mcp-auth/paymo/auth.json`) must be manually created and populated before first use.
Verified SafeView Analysis
The code follows good security practices by storing the API key in a separate, sensitive configuration file (`~/.mcp-auth/paymo/auth.json`) rather than hardcoding it or relying solely on a main config. It uses `yaml.safe_load` for parsing YAML input, mitigating YAML injection risks. API requests are made over HTTPS, and basic rate limiting handling with retries is implemented. Descriptions for CSV exports are cleaned of HTML tags and entities. No 'eval' or other obviously dangerous functions are used without strong justification. File system interactions are limited to config files, temporary files for YAML processing, and user-specified output directories for CSV exports, or an optional file_path for expense uploads, all within reasonable bounds for the application's functionality.
Updated: 2026-01-15GitHub→
0
0
Medium Cost
openpharma-org icon

ct-gov-mcp

by openpharma-org

Sec9

This MCP server provides a unified API interface to search, suggest terms, and retrieve detailed information from ClinicalTrials.gov for clinical trial research and discovery.

Setup Requirements

  • ⚠️Requires Node.js version 18.0.0 or higher.
  • ⚠️If not using the default stdio transport, `USE_HTTP=true` or `USE_SSE=true` environment variables, along with `PORT`, must be explicitly set.
  • ⚠️The TypeScript source code must be compiled (`npm run build`) before the server can be run.
Verified SafeView Analysis
Input validation is robust for all tool parameters (e.g., NCT ID format, date ranges, numerical limits). All external API calls are directed exclusively to the official ClinicalTrials.gov API (https://clinicaltrials.gov), limiting external attack surface. No 'eval' or direct command injection vulnerabilities were found. Environment variables for configuration are loaded securely, and the server provides a warning for wide-open CORS origins ('*') in production environments. No hardcoded secrets were identified, as ClinicalTrials.gov is a public API.
Updated: 2025-12-22GitHub→
0
0
Medium Cost
dgaida icon

robot_mcp

by dgaida

Sec8

Control robotic arms using natural language commands via multiple large language models and a web-based GUI.

Setup Requirements

  • ⚠️Requires Redis server running (e.g., via Docker).
  • ⚠️Requires at least one LLM API Key (OpenAI, Groq, or Gemini) or a locally running Ollama server.
  • ⚠️Relies on external GitHub repositories (`llm_client`, `robot_environment`, etc.) which are installed during setup.
Verified SafeView Analysis
The project uses environment variables (`.env` file) for sensitive API keys, which is good practice. Input validation is extensively applied using Pydantic models for all server-side tool calls, significantly mitigating risks from malformed inputs. Network communication occurs over HTTP/SSE and Redis, which can be exposed if not properly secured, but the server defaults to localhost. The system relies on external LLM APIs (OpenAI, Groq, Gemini, Ollama) and other GitHub repositories (`llm_client`, `robot_environment`, etc.); the security of these external dependencies is critical. A legacy client (`mcp_groq_client.py`) can launch the server via a `subprocess` call, which carries inherent risks if the script path were to be manipulated, though it defaults to a known project path. The recommended universal client connects to a pre-running server, avoiding this direct subprocess launch.
Updated: 2025-12-24GitHub→
0
0
High Cost
pwnies-peru icon

ai-api

by pwnies-peru

Sec3

An AI-powered e-commerce sales agent that uses product search tools to assist users with queries, recommendations, and purchase guidance.

Setup Requirements

  • ⚠️Requires an AI_GATEWAY_API_KEY (for OpenAI-compatible services like Vercel AI Gateway) which likely incurs costs.
  • ⚠️Requires Docker to run Typesense and DragonflyDB instances.
  • ⚠️Requires Python 3.11 or higher.
Review RequiredView Analysis
The `docker-compose.yml` file explicitly sets the Typesense API key to 'xyz' (and this is the default in `typesense_service.py` if not overridden by an environment variable). This hardcoded default API key is a severe security vulnerability, especially if the Typesense instance is exposed externally. Additionally, the FastAPI application uses `CORSMiddleware` with `allow_origins=["*"]`, which permits cross-origin requests from any domain, posing a potential security risk in a production environment by allowing unauthorized access if not properly secured otherwise. The direct passing of AI-generated arguments to internal functions, while currently constrained by simple types, is a pattern to watch for in more complex scenarios.
Updated: 2025-11-30GitHub→
0
0
Medium Cost
Swissbit92 icon

MCP_Catalog

by Swissbit92

Sec7

A local AI companion server that provides conversational chat with multiple personas, enhanced by RAG (Retrieval-Augmented Generation) using web search and MongoDB data, and featuring advanced memory management and emotional state tracking.

Setup Requirements

  • ⚠️Requires Docker to be installed and running for MCP services (Brave Search, MongoDB).
  • ⚠️Requires Ollama to be installed and running, with specified models pulled (e.g., dolphin-llama3:8b, nomic-embed-text:latest).
  • ⚠️Brave Search functionality requires a `BRAVE_API_KEY` environment variable.
  • ⚠️MongoDB integration requires a `MONGODB_URI` environment variable and an accessible MongoDB instance.
Verified SafeView Analysis
The system runs FastAPI with Ollama, Brave Search MCP (ephemeral Docker containers), and MongoDB MCP (long-running Docker container). Resource limits (memory, CPU, PIDs) are applied to spawned MCP containers, and MongoDB operations are explicitly restricted to read-only via a blacklist. CORS is configured for localhost, which is appropriate for development. CRITICAL NOTE: The `docker-compose.yml` mounts `/var/run/docker.sock` into the backend container, granting it root access to the Docker daemon. While this is a common pattern for local developer tools that manage other containers, it is a significant security risk in production or multi-tenant environments. The code attempts to mitigate risks by hardening spawned containers with limits and labels for orphan detection, but the underlying exposure of the Docker socket remains. For its stated 'local personal use' context, these mitigations are reasonable, but for broader deployment, this would need re-evaluation.
Updated: 2026-01-19GitHub→
0
0
Medium Cost

mcp-server-stdio

by praveenkumar09

Sec7

This project likely implements a simplified Minecraft server or a component thereof, primarily designed for interaction via standard input/output (console), possibly for testing, scripting, or local development within the Mod Coder Pack (MCP) ecosystem.

Setup Requirements

  • ⚠️Requires Java Development Kit (JDK) to build and run.
  • ⚠️Requires Maven for dependency management and building the project.
  • ⚠️Interaction is likely via standard input/output (console), not a graphical interface or typical server control panel.
Verified SafeView Analysis
Being a server, it inherently involves processing external input, which always carries potential risks. The 'stdio' implies a console-based or local interaction, possibly limiting direct network exposure compared to a full-fledged server, but still requiring scrutiny of input handling. No obvious obfuscation or direct 'eval' equivalent is indicated by the file list for a Java project.
Updated: 2025-11-17GitHub→
PreviousPage 504 of 760Next