Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
trilogy-group icon

brainlift-mcp-server

by trilogy-group

Sec8

An agent-facing server that provides tools to manage and query a user's BrainLift knowledge base, primarily by interacting with the BrainLift API via Google OAuth.

Setup Requirements

  • ⚠️Requires Python 3.14 or newer.
  • ⚠️Requires a Google Cloud Project OAuth 2.0 Client ID setup for authentication. The `setup.sh` script automates this if specific environment variables (`API_KEY`, `API_BASE_URL`, `HIVE_INSTANCE_ID`) are provided, otherwise, manual OAuth setup and initial authentication flow are required.
  • ⚠️The `BRAINLIFT_API_URL` environment variable must be set.
Verified SafeView Analysis
The server uses standard Python libraries for HTTP requests (`requests`) and Google OAuth (`google-auth-oauthlib`). It handles OAuth credentials by storing them in local files (`client-secrets.json`, `.gcp-saved-token.json`), with paths configurable via environment variables. The `setup.sh` script retrieves and formats OAuth credentials from an external API (`$API_BASE_URL`) using `curl` and `jq`. The main security considerations are the trustworthiness of the `API_BASE_URL` and `API_KEY` provided to the `setup.sh` script, as well as the secure storage of the generated OAuth credential files in the deployment environment. No 'eval', code obfuscation, or obvious malicious patterns were found. Input validation for tool parameters (`brainlift_id`, `dok_levels`) is present. Network requests have timeouts.
Updated: 2025-12-03GitHub→
0
0
High Cost
darthvader3010 icon
Sec2

An image classification system using EfficientNet-B7 for categorizing images and providing predictions via a Flask API and an MCP server.

Setup Requirements

  • ⚠️Requires Node.js 14+ for the MCP server.
  • ⚠️EfficientNet-B7 model weights (~250MB) are downloaded on the first run, leading to a longer initial startup.
  • ⚠️GPU is highly recommended for faster inference; CPU performance can be 1-2 seconds per image.
  • ⚠️Python 3.8+ is required.
Review RequiredView Analysis
CRITICAL VULNERABILITY: The /classify endpoint in `app.py` directly uses user-provided `image_path` from `request.json` to open files (`Image.open(image_path)`). This is a severe Local File Inclusion (LFI) vulnerability, allowing an attacker to attempt to read arbitrary files on the server's filesystem. There is also no sanitization for uploaded filenames, though `os.path.join` offers some protection. The Flask server is exposed on `0.0.0.0`, which is risky if not behind a firewall.
Updated: 2025-11-30GitHub→
0
0
Low Cost
mtrmarko icon

cat-facts-mcp

by mtrmarko

Sec3

Provides an API endpoint for retrieving random cat facts.

Review RequiredView Analysis
Only README.md was provided as source code. The actual server implementation code is missing, making a comprehensive security audit impossible. Cannot assess for 'eval', network risks, hardcoded secrets, or malicious patterns within the server's logic.
Updated: 2025-12-02GitHub→
0
0
Low Cost
arunshenoy99 icon

mcp-http-bridge

by arunshenoy99

Sec9

Bridges STDIO-based Model Context Protocol (MCP) clients to HTTP(S)-based MCP server endpoints, enabling integration with tools like Cursor and Claude Desktop.

Setup Requirements

  • ⚠️Requires Node.js >= 18.0.0
  • ⚠️Requires MCP_ENDPOINT environment variable to be set
Verified SafeView Analysis
The project explicitly states 'Zero dependencies - uses only Node.js built-ins', which significantly reduces supply chain attack surface. Sensitive configuration (custom headers) is managed via environment variables. No 'eval' or obfuscation found. As a bridge, its security is primarily dependent on the upstream MCP endpoint it connects to.
Updated: 2025-11-27GitHub→
0
0
Low Cost
yuu-git icon
Sec9

Provides integrated GitHub/local file operations, Git management, and knowledge base access (via Notion/Docusaurus) to multiple IDEs and AI clients through a C#/.NET Model Context Protocol (MCP) server.

Setup Requirements

  • ⚠️Requires .NET 8.0 SDK, Git, and a GitHub Personal Access Token (PAT) for full GitHub/Git functionality.
  • ⚠️Claude Desktop integration requires absolute paths in its configuration, unlike VS Code/Visual Studio which support relative paths.
  • ⚠️Visual Studio 2026 Preview requires manual approval for third-party MCP servers due to enhanced security.
Verified SafeView Analysis
The server implements good security practices, such as recommending `appsettings.local.json` for secrets and explicitly discouraging hardcoding. It also explicitly disables `AutoPull/AutoPush` by default to prevent unwanted Git history pollution, requiring explicit Git commands from the user/AI. Visual Studio 2026 Preview integration includes an additional security layer requiring manual approval for third-party MCP servers. The primary risks are inherent to giving an AI programmatic access to file systems and Git operations if misconfigured or misused by the AI itself.
Updated: 2025-12-04GitHub→
0
0
Low Cost
UnitVectorY-Labs icon

mcp-shopping-list-firestore

by UnitVectorY-Labs

Sec9

A lightweight, Firebase-backed MCP server for management of a grocery list via simple CRUD operations.

Setup Requirements

  • ⚠️Requires a Google Cloud Project ID.
  • ⚠️Requires a Firestore Database name.
  • ⚠️Requires Google Cloud authentication credentials (e.g., via `gcloud` CLI, environment variables, or a credentials JSON file specified with the `--credentials` flag) to access Firestore.
Verified SafeView Analysis
The server demonstrates good security practices for its scope: it avoids hardcoded secrets by relying on environment variables, uses context with timeouts for external calls, and performs basic input validation. There are no 'eval' or similar dangerous patterns detected. As with any network service, external deployment security (firewalls, access control) would be necessary.
Updated: 2026-01-17GitHub→
0
0
Low Cost
Sec7

Provides a containerized development environment for TypeScript and JavaScript with integrated language server support via MCP.

Setup Requirements

  • ⚠️Requires Docker to be installed and running.
  • ⚠️Exposes port 81, ensure no conflicts or firewall issues.
  • ⚠️Requires host directory to be mounted for workspace access (`-v $(pwd):/workspace`).
Verified SafeView Analysis
The container exposes an HTTP API on port 81 for MCP clients, which is a potential network entry point. It also mounts the host's current directory, giving the container write access to local files. While standard for development containers, these features inherently involve trust and potential risks if the container or host environment is compromised. No direct 'eval' or obfuscation is evident from the provided information. Alpine base reduces attack surface.
Updated: 2025-11-17GitHub→
0
0
Low Cost
AnoushkaScaria icon

atlass-mcp-server

by AnoushkaScaria

Sec9

Provides a Model Context Protocol (MCP) server to automate interactions with Jira and Confluence.

Setup Requirements

  • ⚠️Requires active Jira and Confluence accounts with API access.
  • ⚠️Requires generation of Jira and Confluence API tokens for authentication.
  • ⚠️Python dependencies must be installed via `pip install -r requirements.txt`.
Verified SafeView Analysis
The server correctly uses environment variables for storing API keys and other sensitive credentials, preventing hardcoded secrets. There are no 'eval' statements, obfuscation, or immediately apparent malicious patterns. Network requests are made to specified Jira and Confluence URLs using standard authentication methods. Security primarily relies on the secure handling of the `.env` file and the security of the Atlassian platform.
Updated: 2026-01-18GitHub→
0
0
Medium Cost
scho-to icon
Sec9

Provides a Message Communication Protocol (MCP) server for fetching Jira ticket information.

Setup Requirements

  • ⚠️Requires Node.js (recommended version: >= 20.x.x) and npm.
  • ⚠️Requires access to a Jira Cloud instance and a generated Jira API Token.
  • ⚠️Critical environment variables (JIRA_URL, JIRA_USER_EMAIL, JIRA_API_TOKEN) must be correctly configured.
Verified SafeView Analysis
The server correctly retrieves sensitive credentials (Jira URL, user email, API token) from environment variables, preventing hardcoding. It includes input validation for tool arguments, ensuring that client-provided data types match expected schema before API calls. Error handling uses the MCP protocol's `McpError` for clear communication of issues. No direct usage of 'eval' or similar dangerous patterns was identified. The use of StdioServerTransport suggests it's designed to run as a local process managed by an orchestrator, limiting network attack surface.
Updated: 2026-01-14GitHub→
0
0
Medium Cost
Crosspiecedryingoil127 icon

k8s-observability-mcp

by Crosspiecedryingoil127

Sec6

Provides a comprehensive observability toolkit for monitoring and understanding Kubernetes environments, focusing on microservice performance and health.

Setup Requirements

  • ⚠️Requires Python 3.13 or newer, which is a very specific and potentially challenging version requirement for many environments.
  • ⚠️Requires a running Kubernetes cluster with `kubeconfig` configured for access.
  • ⚠️Requires a running Prometheus instance (defaults to http://localhost:9090) for metrics.
  • ⚠️Requires a running Jaeger instance (defaults to http://localhost:16686) for tracing.
  • ⚠️Requires a running Neo4j instance (defaults to bolt://localhost:7687) with the service graph data loaded (e.g., from `hotel-reservation-datagraph.txt`).
Verified SafeView Analysis
The Prometheus API client connects with `disable_ssl=True`, which is a significant security risk if connecting to untrusted or public Prometheus instances. The Neo4j driver uses default credentials ('neo4j', 'neo4j') if environment variables are not set, which should be changed for production use. The application uses `kubernetes.config.load_kube_config()` which grants it the same access as the user's kubeconfig, requiring careful permission management. No `eval` or obvious malicious patterns were found.
Updated: 2026-01-19GitHub→
0
0
Medium Cost

headless-ide-mcp

by dazinator

Sec9

Provides an ASP.NET Core-based Model Context Protocol (MCP) server for AI assistants to analyze .NET codebases and execute sandboxed shell commands.

Setup Requirements

  • ⚠️Docker is highly recommended/integrated for quick start and full development experience (e.g., VS2022 debugging).
  • ⚠️Requires .NET 8.0 SDK for local development and building.
  • ⚠️Git Personal Access Tokens (PATs) are required for remote git operations.
Verified SafeView Analysis
The project demonstrates robust security measures including API key authentication, command allowlist/denylist, path restrictions, error sanitization, audit logging, resource limits, container hardening (non-root, capability dropping, no-new-privileges), and sensitive data redaction. It also highlights comprehensive integration testing with security-specific tests and claims no critical/high/medium vulnerabilities. While shell execution tools inherently carry some risk, the extensive sandboxing and controls significantly mitigate this, making it one of the most security-conscious projects of its type.
Updated: 2025-11-17GitHub→
0
0
Low Cost
KasunJ1984 icon

odoo-crm-mcp-server

by KasunJ1984

Sec8

An MCP server for analyzing Odoo CRM data with intelligent context management, designed for Claude's context window efficiency.

Setup Requirements

  • ⚠️Requires Odoo instance credentials (URL, DB, Username, Password) via environment variables.
  • ⚠️For browser-based Claude.ai, the server must be accessible via HTTPS, potentially requiring additional setup (e.g., ngrok, cloud deployment with TLS).
  • ⚠️Requires Node.js version 18.0.0 or higher.
Verified SafeView Analysis
The server explicitly relies on environment variables for Odoo credentials, preventing hardcoding. Input validation is performed using Zod schemas. File export operations write to a designated directory (`/mnt/user-data/outputs` by default), preventing arbitrary file writes. Cross-Origin Resource Sharing (CORS) is configured to allow all origins (`Access-Control-Allow-Origin: *`) for browser-based Claude.ai compatibility, but the README advises implementing proper authentication and IP whitelisting in production deployments for enhanced security. Uncaught exceptions and unhandled promise rejections are logged but do not crash the server, prioritizing resilience.
Updated: 2026-01-14GitHub→
PreviousPage 508 of 760Next