Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
alepoblador icon

mcp-demo

by alepoblador

Sec5

An AI-powered recruiting assistant that automates fetching applications, evaluating them against job descriptions, drafting emails, and updating a tracker spreadsheet.

Setup Requirements

  • ⚠️Requires a Google Service Account configured with 'credentials.json' containing appropriate permissions for Google Forms (read) and Google Sheets (read/write).
  • ⚠️Requires the Google Forms API and Google Sheets API to be enabled in your Google Cloud Project.
  • ⚠️The application_form_id, sheet_id, and various question IDs for the Google Form are hardcoded in the script and must match your actual Google Form and Sheet setup.
Review RequiredView Analysis
The primary security risk is the direct reliance on a 'credentials.json' file for Google API access, hardcoded in the script ('credentials.json'). This file contains sensitive service account keys. If compromised or improperly secured (e.g., committed to a public repository), it could grant unauthorized access to Google Forms and Sheets. For production use, a more secure method of secret management (e.g., environment variables, KMS, or secure vaults) should be used instead of a direct file path. The prompt instructions for the LLM could potentially lead to data quality issues if the LLM hallucinates or deviates from the expected output format for 'initial_evaluation', although input validation in 'sheets.py' helps mitigate direct exploitation.
Updated: 2025-12-02GitHub→
0
0
Low Cost
Sec8

This is a modern TypeScript-based frontend web application, likely built with Vite and Tailwind CSS, potentially used for training, simulation, or interactive content display.

Setup Requirements

  • ⚠️Node.js runtime and npm/yarn package manager required for dependency management and execution.
Verified SafeView Analysis
Files suggest a standard frontend development setup. No immediate indicators of server-side code, obfuscation, or high network risks beyond typical client-side web application vulnerabilities. The presence of `eslint.config.js` indicates linting is used, which can help maintain code quality and catch some issues.
Updated: 2025-11-18GitHub→
0
0
Medium Cost

signals-agent

by no0ktheali3n

Sec6

An agent designed to collect signals and events from systems, likely within a multi-cloud environment, and forward them to a central server.

Setup Requirements

  • ⚠️Python 3.x required (managed via pyproject.toml)
  • ⚠️Just build system must be installed (`just`)
  • ⚠️Full functionality might require a Windows environment due to the `powershell` directory.
Review RequiredView Analysis
The presence of `agent` and `server` components implies network communication, a common attack surface. The `powershell` directory suggests potential execution of OS-level scripts, which requires careful security practices (e.g., execution policies, script signing, least privilege) to prevent arbitrary code execution vulnerabilities. No specific 'eval' or obfuscation found from file names alone.
Updated: 2025-11-18GitHub→
0
0
Low Cost
gkerensky icon

mcpinabox

by gkerensky

Sec9

Builds a Model Context Protocol (MCP) server to expose weather data as tools for AI models like OpenAI's Responses API.

Setup Requirements

  • ⚠️Requires Node.js v18 or higher.
  • ⚠️Requires ngrok for tunneling the local server to a public URL, necessary for integration with external APIs like OpenAI.
  • ⚠️Requires an OpenAI API Key for testing with OpenAI's Responses API, which may incur costs.
  • ⚠️The enhanced version (server-enhanced.js) optionally requires an OpenWeatherMap API Key to fetch real weather data, otherwise, it uses mock data.
Verified SafeView Analysis
The server uses `zod` for input schema validation, which is a good practice for security. Environment variables (`process.env.PORT`, `process.env.OPENWEATHER_API_KEY`) are used for configuration. CORS is set to allow all origins (`*`), which is acceptable for a tutorial/lab but might require stricter configuration for production. No 'eval' or other directly dangerous patterns are observed.
Updated: 2025-12-10GitHub→
0
0
Low Cost
Abelin101 icon
Sec8

Reproduce and debug a specific 'Error in message stream' bug in ChatGPT's HTTP MCP message streaming pipeline using a minimal server.

Setup Requirements

  • ⚠️Requires Python 3.10+.
  • ⚠️Requires ngrok for public exposure to ChatGPT.
  • ⚠️The `uvicorn.run` command specifies `ops.mcp.slim_server:app`, which requires the file to be correctly placed within a Python package structure (e.g., in `ops/mcp/slim_server.py`) relative to the execution context, or the path adjusted.
  • ⚠️Requires `fastapi-mcp`, `FastAPI`, `uvicorn`, and `pydantic` Python packages.
Verified SafeView Analysis
The server uses a wide-open CORS policy (`allow_origins=["*"]`), which is a security risk for general production applications. However, in the context of a minimal bug reproduction server, often exposed via temporary tunnels like ngrok, this is a common and sometimes necessary configuration to ensure connectivity and is not indicative of malicious intent or a fundamental flaw in the minimal code itself. No 'eval' or other dangerous patterns found. No hardcoded secrets.
Updated: 2025-11-19GitHub→
0
0
Low Cost
renuo icon
Sec3

This server acts as an MCP interface for the 'nctl' command-line tool, exposing its functionality to allow external clients to query application statistics, retrieve logs, and list application resources.

Setup Requirements

  • ⚠️Requires 'nctl' CLI tool to be installed and configured on the host system where the MCP server runs.
  • ⚠️Requires a Ruby environment (e.g., Ruby 3.x) to be installed.
  • ⚠️Requires the `mcp` Ruby gem to be installed (`gem install mcp`).
Review RequiredView Analysis
The server directly interpolates user-provided string inputs (`project`, `app`) into shell commands executed via `nctl`. While `input_schema` provides basic type validation, it does not sanitize or escape malicious characters within string inputs. This creates a significant risk of command injection if a malicious string (e.g., `myproject; rm -rf /`) is passed as `project` or `app` to the `GetAppsStatsTool` or `GetAppLogsTool`.
Updated: 2025-11-20GitHub→
0
0
Medium Cost
Sec6

This project appears to be a server-side component for integrating or controlling Manim animations, likely via a Manim Control Protocol.

Setup Requirements

  • ⚠️Requires a Python environment.
  • ⚠️Likely requires Manim and its external dependencies (e.g., FFmpeg, LaTeX, specific graphics libraries) to be installed and configured.
  • ⚠️As a server, it will require specific port availability and potential firewall configuration.
Review RequiredView Analysis
Source code for the 'src' directory is unavailable, preventing a thorough security audit. As a server application, potential network vulnerabilities and risks related to remote control of Manim animations exist, requiring caution and code review during deployment.
Updated: 2025-11-18GitHub→
0
0
Low Cost
nickweedon icon

mcp_server_template

by nickweedon

Sec9

A template for building Model Context Protocol (MCP) servers, providing a robust foundation with best practices, Docker support, and example API implementations for AI agent integration.

Setup Requirements

  • ⚠️Python 3.10 or higher is required.
  • ⚠️Requires API credentials (API_KEY) configured in a .env file for integration with a real backend; otherwise, mock data is used for the example API.
  • ⚠️While optional for local development, Docker is highly recommended for containerized deployment and consistent development environments via Dev Containers.
Verified SafeView Analysis
Uses environment variables for API keys, following best practices. No obvious hardcoded secrets, 'eval' usage, or malicious patterns found in the provided code snippets. The recommended 'mcp-mapped-resource-lib' for handling large files explicitly mentions security features like path traversal prevention and MIME validation. The client module loads .env files from standard locations, including the user's home directory, which is a common pattern but requires users to manage their local environment files carefully.
Updated: 2025-12-25GitHub→
0
0
Medium Cost
vic7ord1st icon

Buxfer-MCP-Server

by vic7ord1st

Sec8

Manages Buxfer financial transactions and accounts, enabling users to add transactions, list accounts with balances, and query transaction history via natural language.

Setup Requirements

  • ⚠️Requires Docker to be installed and running.
  • ⚠️Requires a Buxfer API token, obtained by a manual POST request with email and password.
  • ⚠️Requires the Claude Desktop application for integration.
Verified SafeView Analysis
The server retrieves the Buxfer API token from an environment variable, preventing hardcoding. It runs in an isolated Docker container, uses HTTPS for all Buxfer API communications, and logs no sensitive data. The token is passed as a query parameter as per Buxfer's API design, which is generally less secure than a header but is an external API constraint rather than an internal flaw.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
valentinozegna icon

netlist-mcp

by valentinozegna

Sec8

Serves EDA netlist data to AI/ML coding assistants for circuit analysis and connectivity tracing.

Setup Requirements

  • ⚠️Requires 'curl' or 'wget' to be installed on the system for the initial installation script to function.
  • ⚠️Requires manual configuration within specific AI coding assistants (e.g., Claude, VS Code, Cursor) by adding a JSON snippet to a configuration file.
  • ⚠️User must open a new terminal or manually source their shell's RC file after installation for the 'netlist-mcp' command to be available in their PATH.
Verified SafeView Analysis
The installation script downloads and executes a binary from GitHub releases via 'curl | bash', which carries inherent risks if the remote source or release assets are compromised. Checksum verification is utilized, but the checksums are also sourced from the same GitHub release. No 'eval' commands, obfuscation, or hardcoded secrets were found within the provided 'install.sh' script. The script modifies the user's PATH variable, which is standard for CLI tool installations.
Updated: 2026-01-16GitHub→
0
0
Low Cost
Sec7

A Spring Boot MCP server providing AI agents with self-healing web automation capabilities using Healenium.

Setup Requirements

  • ⚠️Requires Java 21 or higher.
  • ⚠️Requires a separate Healenium Web Server to be running locally on port 8000 for self-healing functionality.
  • ⚠️Requires executing an external `start_healenium.sh` script to set up the Healenium Web Server; the script's contents are not provided and must be trusted.
Review RequiredView Analysis
The project itself doesn't appear to have critical vulnerabilities, but its core function is to provide powerful browser automation tools to AI agents. This inherently carries a risk, as a compromised or malicious agent could use these tools for unintended web interactions (e.g., navigating to arbitrary URLs, entering data, clicking elements). A critical dependency is the `start_healenium.sh` script for setting up the Healenium web server; executing external shell scripts without auditing their content is a security risk. The MCP server will also expose an API over the network.
Updated: 2025-11-17GitHub→
0
0
Low Cost
kbedford icon
Sec6

Centralized execution of Junos CLI commands on routers via an MCP server hosted on a Linux bastion.

Setup Requirements

  • ⚠️Requires Python 3.11 specifically.
  • ⚠️Requires `git`, `curl`, and `jq` to be installed on the bastion host.
  • ⚠️The `MCP_SESSION` environment variable must be manually set and re-set every time the MCP server (`jmcp.py`) is restarted.
  • ⚠️The `jmcp_cli` helper function is hardcoded to interact with a single router (`vmx101`) and requires manual modification to support multiple Junos devices.
Verified SafeView Analysis
The server, by default, runs without authentication (`.tokens` file missing), making it 'open to all clients' on `127.0.0.1:30030`. While bound locally, this is a risk if other processes on the bastion are compromised or if the binding is changed to `0.0.0.0` without tokens. The `devices.json` example includes a hardcoded password (`junos123`), which, if not replaced, poses a significant security vulnerability. The `jmcp_token_manager.py` script is provided to configure tokens for enhanced security.
Updated: 2025-12-03GitHub→
PreviousPage 521 of 760Next