Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
Vani2130 icon

mcp_ctl

by Vani2130

Sec7

Manages and simplifies the deployment and operation of various Model Context Protocol (MCP) servers across different platforms using a command-line interface.

Setup Requirements

  • ⚠️Requires Node.js (v12 or higher) and npm for installation and operation.
  • ⚠️Requires Docker to be installed on the system for managing the 'github' MCP server package.
  • ⚠️Requires 'uvx' (a Python package installer, often used for Python virtual environments) for managing the 'semgrep' MCP server package.
Verified SafeView Analysis
The tool stores sensitive information like API tokens (e.g., GitHub, Unleash) in a local JSON configuration file (`claude_desktop_config.json`). While this is typical for CLI tools, users should ensure proper local file system security. The Figma API key is passed directly as a command-line argument to the spawned process, which is generally less secure than using environment variables, as command-line arguments can sometimes be visible in process listings. The `spawn` command is used for executing server processes, but the commands and arguments are constructed from predefined package configurations and validated user inputs, mitigating risks of arbitrary command injection.
Updated: 2026-01-19GitHub→
0
0
Low Cost
g1ddy icon
Sec9

Enables AI models and development tools to interact with Raindrop.io bookmarks and collections using natural language via the Model Context Protocol.

Setup Requirements

  • ⚠️Requires .NET 10 SDK (preview) for the recommended DNX setup, or .NET 8 SDK for development/global tool installation.
  • ⚠️A Raindrop.io API token is mandatory and must be securely configured via environment variables (`Raindrop__ApiToken`) or .NET user secrets.
  • ⚠️Client-side configuration (e.g., in VS Code's `settings.json` or `mcp.json`) is required to connect to the MCP server.
Verified SafeView Analysis
The project emphasizes secure handling of the Raindrop.io API token via environment variables or .NET user secrets, explicitly guiding users away from hardcoding. No 'eval' or obfuscation detected. Network communication is with the official Raindrop.io API. The `setup.sh` script includes checksum verification for downloaded packages, indicating a focus on supply chain security. The `AllowedHosts: *` in `appsettings.json` is a minor consideration, but given the server is designed for local stdio communication with an MCP client, it is not a direct web exposure risk.
Updated: 2026-01-19GitHub→
0
0
Low Cost
OpenAF icon

mini-a

by OpenAF

Sec8

A goal-oriented autonomous agent for orchestrating LLMs, shell commands, and MCP servers to achieve user-defined objectives.

Setup Requirements

  • ⚠️Requires OpenAF to be installed and available in PATH.
  • ⚠️`OAF_MODEL` environment variable (or `model=` argument) is mandatory for LLM configuration.
  • ⚠️Specific environment variables are needed for certain LLM providers (e.g., AWS credentials, Gemini JSON prompt flags).
  • ⚠️External tools like Docker or Ollama might be required for specific sandboxing or local model configurations.
Verified SafeView Analysis
Mini-A is designed for powerful autonomous execution, including shell commands and filesystem modifications. It has robust built-in safety features: shell access and write operations are disabled by default (`useshell=false`, `readwrite=false`), dangerous commands are banned by default (e.g., `rm`, `sudo`, `curl`), and interactive confirmation (`checkall=true`) is available. Model API keys are stored encrypted. The system's power necessitates careful configuration, but defaults are secure. Client-side evaluation for charts includes basic pattern filtering.
Updated: 2026-01-17GitHub→
0
0
Medium Cost
agentic-forge icon

mcp-weather

by agentic-forge

Sec9

Provides current weather, forecast, air quality, and geocoding services by integrating with the Open-Meteo API.

Setup Requirements

  • ⚠️Requires Python 3.12+ (Python 3.13+ is explicitly tested/recommended)
  • ⚠️Requires `uv` for dependency management and execution (`uv sync`, `uv run`)
  • ⚠️Relies on external Open-Meteo APIs (requires internet access)
Verified SafeView Analysis
The server does not handle sensitive user data or require API keys. It uses `httpx` for external API calls and has no obvious use of `eval`, `exec`, or direct shell command execution of user input. CORS is set to `*` for HTTP transport, which is acceptable for serving public data but could be tightened if restricted access is ever required. `detect-secrets` is included in development dependencies, indicating awareness of secret management.
Updated: 2026-01-12GitHub→
0
0
Medium Cost
mamarche icon

chuckai

by mamarche

Sec7

A serverless AI-powered chatbot that demonstrates the Model Context Protocol (MCP) using Azure Functions to discover and invoke tools for interacting with a Chuck Norris joke database.

Setup Requirements

  • ⚠️Requires .NET 10 SDK
  • ⚠️Requires Azure Functions Core Tools v4
  • ⚠️Requires Azure SQL Database or SQL Server (with manual script execution)
  • ⚠️Requires an Azure AI Foundry account with an OpenAI deployment (paid service)
Verified SafeView Analysis
The project configures CORS with `*` for local development in `ChuckAI.Database.Api/local.settings.json`, which is a security risk in production environments and should be restricted to specific origins. Placeholder values for API keys and connection strings (`your-azure-openai-api-key`, `your-username`, `your-password`) are correctly used in `local.settings.json` examples, indicating that sensitive information should not be hardcoded or committed to source control. No obvious 'eval' or malicious patterns were found.
Updated: 2025-12-02GitHub→
0
0
Medium Cost
greatgitsby icon

ynab-mcp

by greatgitsby

Sec9

Exposes YNAB (You Need A Budget) financial data to LLMs via the Model Context Protocol (MCP) for querying budget information.

Setup Requirements

  • ⚠️Requires YNAB_API_TOKEN environment variable, obtainable from YNAB developer settings.
  • ⚠️Requires Python 3.12 or higher.
  • ⚠️Requires the 'uv' package manager for dependency management and execution.
Verified SafeView Analysis
The server securely handles the YNAB API token by requiring it via an environment variable (YNAB_API_TOKEN) and using it for Bearer authentication with the YNAB API via the httpx library. There are no hardcoded secrets, 'eval' usage, or obvious malicious patterns. Input parameters for resources/tools are validated or used in API calls, reducing direct injection risks. Output is formatted into human-readable text, which is generally safer for LLM consumption than raw JSON.
Updated: 2026-01-19GitHub→
0
0
Medium Cost
gaikwadsantosh icon

RemoteMCP

by gaikwadsantosh

Sec8

AI-powered financial assistant for tracking expenses and food card actions through natural language interaction.

Setup Requirements

  • ⚠️Requires GOOGLE_API_KEY (Paid service for Google Gemini API).
  • ⚠️Requires 'uv' for dependency management if following README setup instructions.
  • ⚠️Multiple services need to be run concurrently: at least one FastMCP server (ExpenseTracker or FoodCardTracker) and an AI-enabled client/backend (FastAPI or LangChain based).
Verified SafeView Analysis
The server uses parameterized SQL queries to prevent injection vulnerabilities. API keys (GOOGLE_API_KEY) are correctly fetched from environment variables. No 'eval' or obvious malicious patterns were found. The use of '0.0.0.0' for server binding is standard for development/containerized environments but requires proper network isolation (firewalling) in production to prevent unintended exposure.
Updated: 2025-11-27GitHub→
0
0
Low Cost
vipulpathak113 icon
Sec8

A backend server for tracking and managing personal expenses using the Model Context Protocol (MCP) as an API.

Setup Requirements

  • ⚠️Requires Python 3.12 or newer.
Verified SafeView Analysis
The server uses parameterized queries for SQLite operations, effectively preventing SQL injection. File paths are handled safely with `os.path.join`. No explicit hardcoded secrets or dangerous functions like `eval` or `os.system` are present. Security relies on the underlying `fastmcp` framework's robustness and appropriate network configuration when exposed via HTTP. Future enhancements for user authentication and authorization would be critical for production use in a multi-user environment.
Updated: 2026-01-18GitHub→
0
0
High Cost
Digital-Defiance icon

vscode-mcp-screenshot

by Digital-Defiance

Sec7

Provides a VSCode extension and Language Server Protocol (LSP) integration to enable AI agents to capture, analyze, and document application visuals through full screen, window, or region screenshots with PII masking and multi-format support.

Setup Requirements

  • ⚠️Requires Node.js and npm/npx to install and run the underlying MCP screenshot server.
  • ⚠️The underlying MCP screenshot server likely has OS-specific dependencies related to screen capturing (e.g., graphical environment, Xvfb for headless Linux).
  • ⚠️Primarily designed as a VSCode extension, not a standalone server for direct programmatic access without VSCode environment.
Review RequiredView Analysis
The system relies on spawning an external 'mcp-screenshot' server process (via npx or node), which introduces a supply chain risk. While the 'savePath' parameter is tested for path traversal vulnerabilities, external process execution and file system interactions always warrant careful consideration. Communication with the server happens via secure IPC, and no direct 'eval' or hardcoded secrets are apparent.
Updated: 2026-01-17GitHub→
0
0
Medium Cost
dSchulenburg icon

mcp-imap-manager

by dSchulenburg

Sec8

A Model Context Protocol (MCP) server for managing IMAP email operations (list, move, delete) across multiple accounts.

Setup Requirements

  • ⚠️Requires a .env file with configured IMAP account credentials and server settings.
  • ⚠️Docker and Docker Compose are required for simplified deployment.
  • ⚠️App passwords must be set up for GMX and Gmail accounts, requiring 2FA.
  • ⚠️Production deployment requires an external 'proxy' Docker network and Traefik configured for automatic HTTPS.
Verified SafeView Analysis
The server uses environment variables for all sensitive credentials (IMAP passwords, API keys), which is good practice. The /mcp endpoint can be protected with an API key. TLS is enforced for IMAP connections and a production Docker Compose setup with Traefik is provided for secure HTTPS access. No 'eval' or malicious patterns are evident. Potential risks would involve improper API key management or weak IMAP account passwords (app passwords are recommended).
Updated: 2026-01-19GitHub→
0
0
Low Cost
hsiangjenli icon

python-mcp-template

by hsiangjenli

Sec9

A DevOps-friendly template for building Multi-Agent Communication Protocol (MCP) servers using FastAPI and fastmcp.

Setup Requirements

  • ⚠️Requires uv for dependency management and running scripts.
  • ⚠️Requires Docker installed to build and run the containerized server.
  • ⚠️Requires Python 3.12 or newer.
  • ⚠️Specific setup is required to address CORS middleware conflicts when running the HTTP server directly via uvicorn.
Verified SafeView Analysis
The template uses a permissive CORS configuration (allow_origins=['*']) in `mcp_tools/main_http.py`, which is common for development but might require stricter configuration for production deployments to prevent potential cross-site scripting vulnerabilities. No other critical security risks like hardcoded secrets, 'eval' usage, or obvious malicious patterns were identified in the provided code.
Updated: 2025-12-08GitHub→
0
0
Low Cost
Mahmoud-Khater icon

mcp-server-demo

by Mahmoud-Khater

Sec8

This project demonstrates running an MCP (Model Control Protocol) server with a simple calculator tool, deployed via Docker.

Setup Requirements

  • ⚠️Docker is required for deployment as per the primary demonstration method.
  • ⚠️Python 3.12 or newer is required as specified in `pyproject.toml`.
Verified SafeView Analysis
The server binds to `0.0.0.0`, making it broadly accessible; ensure proper firewall rules are in place for production environments. Environment variables are loaded from a `.env` file, which is good practice for managing secrets, though the relative path `../.env` could lead to issues if the execution context changes. No direct malicious patterns or dangerous functions like `eval` were observed in the provided source.
Updated: 2025-11-26GitHub→
PreviousPage 526 of 760Next