Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
bioanywhere icon

night

by bioanywhere

Sec8

This repository provides client libraries for interacting with the World News API, allowing applications to access and process news data from various sources.

Setup Requirements

  • ⚠️Requires Python 3.7+ (for Python client), CMake 3.2+ and Qt (for C++ client), or a compatible Java environment (for Java client).
  • ⚠️Requires an API key from World News API for service access.
  • ⚠️The client libraries are for integrating with an external API; an active internet connection is needed for functionality.
Verified SafeView Analysis
The repository contains client libraries for multiple programming languages, generated from an OpenAPI specification. OAuth2 flows are implemented in the C++ client using a local TCP server for redirects, which is a standard approach but relies on the host system's security configuration. API keys are handled by the client libraries and are expected to be provided by the user, preventing hardcoding. No 'eval', obfuscation, or direct malicious patterns were observed in the truncated code snippets. General network communication relies on standard HTTP/HTTPS protocols. The overall security profile is strong for client libraries, with typical considerations for API key management by the end-user application.
Updated: 2025-12-13GitHub→
0
0
Low Cost
Sena1996 icon

sena-mcp-server

by Sena1996

Sec9

An AI intelligence enhancement system for Claude Desktop and Claude Code CLI, providing advanced tools for code analysis, security, performance, knowledge retrieval, and automated formatting with transparent execution.

Setup Requirements

  • ⚠️`uv` (Python package manager) is required, although the installer attempts to install it automatically.
  • ⚠️`Python 3.10+` is needed for the `uv` tool.
  • ⚠️Requires Claude Desktop or Claude Code CLI environment for full functionality and integration with its hooks and MCP tools.
Verified SafeView Analysis
The project explicitly documents and resolves several critical security vulnerabilities in its `docs/OPTIMIZATION_SUMMARY.md`, including command injection, code injection, and unvalidated command execution. It now uses `shlex.split()` and `shell=False` for `subprocess.run()`, disables dangerous methods like `intercept_tool()`, and handles user input via stdin in scripts to prevent injection. The primary MCP server (`src/sena_mcp/server.py`) runs locally and does not appear to perform external network requests from its core tools, relying on other MCP servers for integrations like GitHub or web search. Bash scripts, while inherently carrying some risk, are actively secured and transparently documented. The overall system is designed for local execution, reducing external attack surface.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
TokaMohsen icon

mcp-slack

by TokaMohsen

Sec9

Enables AI assistants to interact with a Slack workspace by exposing Slack Web API functionalities as tools.

Setup Requirements

  • ⚠️Requires Node.js 22+
  • ⚠️Requires a Slack Bot Token with specific OAuth scopes (e.g., channels:history, chat:write)
  • ⚠️Requires a Slack Team ID
  • ⚠️Requires creating and configuring a Slack App within your workspace
Verified SafeView Analysis
The server correctly reads sensitive information (Slack Bot Token, Team ID) from environment variables. There is no usage of 'eval' or other patterns that suggest arbitrary code execution. All network requests are made to the legitimate Slack API. The use of SLACK_CHANNEL_IDS for limiting access is a positive security feature. The primary security considerations involve properly configuring the Slack App's permissions, which is external to the server's code but well-documented.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
Rotbarsch icon
Sec7

Enables AI agents (like GitHub Copilot) to query ReqnRoll binding information and documentation directly to simplify feature file creation and minimize AI hallucinations.

Setup Requirements

  • ⚠️.NET 10 SDK is required.
  • ⚠️Manual configuration of 'inputs.json' with correct DLL and XML documentation paths is necessary and critical for functionality.
  • ⚠️Ensuring all runtime dependencies of the configured assemblies are discoverable by the server can be complex.
  • ⚠️Requires GitHub Copilot extension in Visual Studio Code or Visual Studio to function as intended.
Verified SafeView Analysis
The server loads user-specified DLLs dynamically from 'inputs.json'. Loading untrusted or malicious DLLs could lead to code execution vulnerabilities. Users should only configure DLLs from trusted sources and ensure their dependencies are correctly placed. No direct 'eval' or obvious malicious patterns are present in the provided truncated source.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
abhayagarwalonline icon

mule-beta-mcp-server

by abhayagarwalonline

Sec8

Provides status and transaction details for an enterprise integration process, specifically tracking Purchase Order (PO) processing from JDE to SAP via MuleSoft.

Setup Requirements

  • ⚠️Requires Mule Runtime 4.9.3+ (specific Mulesoft licensing might apply)
  • ⚠️Requires Java 17 SDK
Review RequiredView Analysis
The provided source code snippets (test.json, mule-artifact.json) are configuration and test data, and do not contain executable logic from the server itself. Therefore, it is not possible to perform a meaningful security audit of the 'mule-beta-mcp-server' application based on this limited information. There are no patterns like 'eval', obfuscation, network risks, or hardcoded secrets visible in the provided files. Without access to the actual Mule flows, connectors, and any custom code, a comprehensive assessment of the server's security cannot be made.
Updated: 2025-12-07GitHub→
0
0
Low Cost
cgjdparashar icon

mcp-server-and-prompts

by cgjdparashar

Sec7

This repository provides MCP prompt definitions for orchestrating Azure DevOps, Playwright testing, and MySQL queries, enabling AI assistants to automate common development workflows.

Setup Requirements

  • ⚠️Requires an MCP-enabled client (e.g., VS Code with GitHub Copilot and MCP extension).
  • ⚠️Application code for Playwright and MySQL prompts MUST be located in the `/project/src/` folder.
  • ⚠️Requires setting multiple environment variables for Azure DevOps integration (e.g., AZDO_ORG_URL, AZDO_PROJECT, AZDO_TEAM, AZDO_USER_EMAIL).
Verified SafeView Analysis
The system design explicitly uses environment variables for sensitive credentials (Azure DevOps, MySQL) rather than hardcoding. It also includes safety features like 'CONFIRM_ASSIGN' for dry-run mode in Azure DevOps prompts and 'READ_ONLY' flags for MySQL queries, reducing accidental destructive operations. The primary security risk comes from the powerful access granted to external services via AI-driven prompts, requiring careful configuration and oversight by the user and secure hosting of the underlying MCP servers (which are external to this repo). No 'eval' or obfuscation is apparent in the provided README.
Updated: 2025-12-02GitHub→
0
0
Low Cost

MCP.Server

by AL4255

Sec5

A custom server application, likely implemented in Python, for managing or proxying specific functionalities, possibly related to code development or a specialized service.

Setup Requirements

  • ⚠️Python interpreter required.
  • ⚠️Specific server configuration (e.g., port number, host) might be needed, details unknown without source code.
  • ⚠️Potential dependencies (e.g., specific libraries) are unknown without source code.
Review RequiredView Analysis
A comprehensive security audit is not possible as the actual code content of `Mcp`, `focus.py`, and `main.py` files was not provided. Without access to the source code, it's impossible to check for `eval` usage, obfuscation techniques, specific network vulnerabilities, or insecure dependencies. The score reflects an unknown state.
Updated: 2025-11-18GitHub→
0
0
Medium Cost
makesh-kumar icon

spotify-mcp-server

by makesh-kumar

Sec9

Enables AI assistants to control Spotify playback and manage playlists through the Model Context Protocol.

Setup Requirements

  • ⚠️Requires a Spotify Premium account for full playback control features.
  • ⚠️Requires creating and configuring a Spotify Developer Application (Client ID, Client Secret, Redirect URI).
  • ⚠️Manual creation and initial editing of 'spotify-config.json' is necessary before running the 'npm run auth' script.
Verified SafeView Analysis
The server correctly handles Spotify OAuth 2.0 authorization with client secrets stored in a local config file, not hardcoded. It explicitly enforces localhost redirect URIs during authentication to prevent token interception. The `@spotify/web-api-ts-sdk` is used for API interactions, which is a reputable library. There are no 'eval' statements or obfuscation. A minor note is that `handleSpotifyRequest` might suppress specific JSON parsing errors as successful operations, which could hide API response issues but is not a direct security vulnerability.
Updated: 2025-12-06GitHub→
0
0
High Cost
ryan-lingle icon

farm-os

by ryan-lingle

Sec6

Provides AI assistant integration for a farm management system, enabling natural language interaction to manage farm assets, logs, locations, and tasks.

Setup Requirements

  • ⚠️Requires OpenAI API Key (Paid): Uses OpenAI's `gpt-4o` model by default, necessitating a paid API key via `OPENAI_API_KEY`.
  • ⚠️Docker recommended: While possible to run standalone, the provided `docker-compose.yml` orchestrates the entire multi-service application (DB, API, Client, MCP Server) for seamless setup.
  • ⚠️High token usage potential: Tool outputs can be up to 10,000 characters and chat history up to 20 messages, leading to substantial token consumption per complex interaction.
Review RequiredView Analysis
The server exposes an API endpoint with `CORSMiddleware(allow_origins=['*'])` set in `http_server.py`. This allows requests from any origin, posing a significant security risk in a production environment where client origins should be restricted to known domains. Hardcoded default PostgreSQL password 'password' in `docker-compose.yml` is a common development anti-pattern that needs to be secured for production.
Updated: 2026-01-18GitHub→
0
0
High Cost
atlanssia icon

mcp-simulator

by atlanssia

Sec6

Simulate Model Context Protocol (MCP) servers with dynamic configuration and AI-powered mock data generation, facilitating MCP client development, API prototyping, and integration testing.

Setup Requirements

  • ⚠️Requires an LLM API Key (e.g., OpenAI, SiliconFlow, ModelScope) for AI-powered features, which can incur costs.
  • ⚠️Go 1.22+ and Node.js 18+ (with npm) are prerequisites for building the application from source.
  • ⚠️Virtual servers cannot currently be deleted via the API or Web UI, which can lead to accumulation if not managed manually in the `./data` directory.
Verified SafeView Analysis
The server uses environment variables for LLM API keys (e.g., OPENAI_API_KEY) and masks them when exposed via the `/config/llm` API endpoint. However, the default `AccessLog` middleware captures full request and response bodies for most API traffic (excluding `/sse` endpoints). This poses a significant risk of logging sensitive data (e.g., API requests, AI prompts, generated mock data) if not properly secured at the operational level. Frontend uses `JSON.parse` with error handling. No `eval` or obvious malicious patterns found in the provided code.
Updated: 2025-11-27GitHub→
0
0
Low Cost
toms74209200 icon

mcp-maven-deps

by toms74209200

Sec9

Provides a Model Context Protocol (MCP) server for searching Maven and Gradle dependencies.

Setup Requirements

  • ⚠️Requires Deno 2.0.0 or later.
  • ⚠️Requires network permission (`--allow-net`) when run with Deno.
  • ⚠️Pre-built binary usage is currently Linux-specific and requires manual installation steps.
Verified SafeView Analysis
The server makes external network requests to Maven Central and Gradle Plugin Portal, which is its core functionality and requires the '--allow-net' Deno permission, explicitly stated in the README. Input parameters for the 'search_dependencies' tool are validated using Zod, mitigating potential injection risks. No 'eval' or other dynamic code execution, obfuscation, or hardcoded secrets were found in the provided source code.
Updated: 2025-12-12GitHub→
0
0
Low Cost
noahw345 icon

property-MCP

by noahw345

Sec9

Connects Claude AI to real estate data via the ATTOM Data API to fetch property information for a given address.

Setup Requirements

  • ⚠️Requires an ATTOM_API_KEY, which typically involves a paid subscription or registration with ATTOM Data Solutions.
  • ⚠️Requires Python 3.12+ (implied by Claude Desktop configuration example).
Verified SafeView Analysis
Secrets (ATTOM_API_KEY) are loaded from environment variables using python-dotenv, which is a good practice. There are no 'eval' calls or obfuscation found. Network requests use the 'requests' library with a timeout, and errors are robustly handled at the API client and tool layer, preventing raw exception leakage. The API key is sent in standard HTTP headers.
Updated: 2025-11-26GitHub→
PreviousPage 512 of 760Next