Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost

zafari-mcp-server

by anthonylimo90

Sec9

Serves as a security-hardened Model Context Protocol (MCP) server for Zafari CRS API, enabling secure remote access for managing safari property operations, primarily for Claude Desktop.

Setup Requirements

  • ⚠️Requires a Zafari CRS API Key.
  • ⚠️Mandatory strong passwords for ADMIN/DEMO users (12+ chars) and JWT_SECRET (32+ chars) for server startup.
  • ⚠️Redis for token storage and HTTPS for the server are required for production deployments.
Verified SafeView Analysis
Extensive security features implemented including bcrypt password hashing, Redis token storage, rate limiting, security headers (Helmet.js), OAuth 2.1 with PKCE, JWT enforcement, and client validation. Claims 0 npm vulnerabilities and includes a dedicated security testing script. Requires careful environment variable configuration for full security, especially strong passwords and secret generation.
Updated: 2025-11-18GitHub→
0
0
Low Cost
dlmpx icon
Sec7

A demo implementation of an MCP (Model Context Protocol) server for handling WebSocket communication, message dispatching, and executing registered tools.

Setup Requirements

  • ⚠️Requires Java 21 SDK.
  • ⚠️Requires Maven for building and running.
  • ⚠️For development, an IDE with Lombok plugin/annotation processor is recommended.
Verified SafeView Analysis
The server handles dynamic tool execution with generic 'Object' parameters, which could pose deserialization vulnerabilities if additional tools are implemented without strict input validation. The WebSocket endpoint allows all origins ('*'), which should be restricted in a production environment.
Updated: 2025-11-24GitHub→
0
0
Low Cost
Hrishikesh-Gaikwad-GG icon

expense_tracking_remote_mcp_server

by Hrishikesh-Gaikwad-GG

Sec9

Manages and tracks personal or business expenses through an API.

Setup Requirements

  • ⚠️Python 3.12+ only
  • ⚠️Data stored in a temporary directory (`tempfile.gettempdir()`), meaning expenses will not persist across server restarts or system cleanups by default.
Verified SafeView Analysis
The server uses parameterized SQL queries via `aiosqlite`, effectively preventing SQL injection vulnerabilities. No 'eval', 'exec', or direct shell commands are used. File paths for the database are within a temporary directory, and category files are relative to the script, limiting path traversal risks. No hardcoded secrets were identified.
Updated: 2025-12-01GitHub→
0
0
Low Cost
Sec6

Implements a server for the Multiplayer Combat Protocol (MCP), likely for demonstration or testing purposes.

Setup Requirements

  • ⚠️Requires Node.js and npm/yarn installed.
  • ⚠️May require port configuration if the default server port is in use by another application.
Verified SafeView Analysis
Standard Node.js server risks apply (e.g., open ports, potential for DoS or application-level attacks). Without source code access, specific vulnerabilities cannot be assessed. As a 'demo' project, it might prioritize clarity over production-level security hardening.
Updated: 2025-11-18GitHub→
0
0
Low Cost
Nasreen1717 icon

Gemini-cli-mcp-server

by Nasreen1717

Sec10

The provided files serve as informational documentation detailing GitHub's advanced AI integration updates and a biographical profile.

Verified SafeView Analysis
The provided 'source code' consists solely of two static Markdown files, `github.md` and `Report.md`. These files are informational documents and contain no executable code, server logic, or dynamic elements. Therefore, they inherently pose no security risks related to 'eval', obfuscation, network access, hardcoded secrets, or malicious patterns typically found in server-side code. There is nothing to 'run' as a server.
Updated: 2025-11-26GitHub→
0
0
Low Cost

forge-mcp

by scottfeltham

Sec7

A server environment likely used for developing or hosting applications related to game modding, specifically for a 'forge' compatible platform such as Minecraft Forge.

Setup Requirements

  • ⚠️Requires Node.js and npm/yarn installed on the host system.
  • ⚠️Specific Forge-related tooling or environment setup may be necessary, depending on the server's interaction with the Forge ecosystem.
Review RequiredView Analysis
Based solely on the file list, there are no immediate indicators of 'eval' usage or obfuscation. The presence of `.eslintrc.js` suggests linting practices, which can help maintain code quality and prevent some common issues. However, without access to the actual code and its dependencies (from `package.json`), a full security audit for vulnerabilities or network risks is not possible. External dependencies always pose potential risks.
Updated: 2025-11-18GitHub→
0
0
High Cost
prasoon-21 icon

Binary-Asesino

by prasoon-21

Sec5

An all-in-one platform providing job/internship discovery, resume building, MCP server management, and PDF editing, leveraging AI for workflow enhancement to simplify professional and tech workflows.

Setup Requirements

  • ⚠️Requires LLM API Key (potentially paid) for AI features
  • ⚠️Requires Java Development Kit (JDK) for backend setup
  • ⚠️PDF libraries need to be configured on the backend (details unknown)
Review RequiredView Analysis
The provided source code consists only of a React frontend UI. It does not contain server-side logic, AI implementations, or database interactions mentioned in the README (MCP Server Management, LLM interaction, finance, job finding, resume building, PDF editing). A comprehensive security audit is impossible without the backend (SpringBoot, Java) code. The frontend itself shows no obvious 'eval' usage, obfuscation, or hardcoded secrets in the provided snippets. However, the described features imply significant security considerations on the missing backend, especially concerning LLM interaction, financial data, and server management.
Updated: 2025-12-10GitHub→
0
0
Low Cost

bias-detector

by claudette-mcp

Sec1

A tool designed to identify and analyze biases, potentially within data, algorithms, or textual content.

Review RequiredView Analysis
No repository content (README.md returned 404) was provided for analysis, therefore a security audit for 'eval', obfuscation, or network risks could not be performed. The score reflects an inability to assess any potential risks.
Updated: 2025-11-18GitHub→
0
0
Low Cost
FangliangWong icon

mcp-demo-repo

by FangliangWong

Sec3

Provides a framework and base for developing and modding Minecraft servers.

Setup Requirements

  • ⚠️Requires Java Development Kit (JDK) 8 or higher
  • ⚠️Requires a compatible Minecraft server JAR file
  • ⚠️Specific Minecraft version compatibility may be required for modding
Review RequiredView Analysis
No source code was provided for analysis, making it impossible to perform a security audit. Without code visibility, potential risks related to network exposure, malicious patterns, or hardcoded secrets cannot be assessed. Therefore, a low score is assigned due to the lack of verifiable safety.
Updated: 2025-11-20GitHub→
0
0
High Cost
ilvolodel icon

trustysign

by ilvolodel

Sec4

Provides Infocert digital signature capabilities for PDF documents via AI agents, supporting AcroForm detection and various positioning strategies.

Setup Requirements

  • ⚠️Requires Infocert `CLIENT_ID`, `CLIENT_SECRET`, and `TENANT` credentials.
  • ⚠️Requires an `MCP_API_KEY` environment variable for server authentication.
  • ⚠️Requires a running TrustyVault instance for OAuth tokens and user PIN management.
  • ⚠️PDF parsing libraries (`PyPDF2`, `pdfplumber`, `pyhanko`) can have complex dependencies and may require specific versions.
Review RequiredView Analysis
CRITICAL: The `README.md` explicitly instructs to use `sshpass -p 'Fr3qu3nc1.' ssh root@161.35.214.46` for deployment. Using `sshpass` with a hardcoded password, especially for `root` access, is an extreme security risk and should NEVER be done in a production environment. This indicates severe operational security vulnerabilities. Potential Server-Side Request Forgery (SSRF) exists due to downloading PDFs from arbitrary `pdf_url` without explicit validation to prevent access to internal network resources. The `save_signed_document` function uses `unquote(attach_name)` for filenames. While it handles URL encoding, using `os.path.basename` would provide stronger protection against directory traversal attacks for saved files. PDF parsing libraries (`pyhanko`, `PyPDF2`, `pdfplumber`) are inherently complex and could be attack vectors, although standard libraries are used. Authentication relies on a single API key stored in an environment variable (`MCP_API_KEY`). While simple, this offers less robust key management (e.g., dynamic rotation, revocation for individual agents) compared to a database-backed system. If this key is compromised, all access is lost.
Updated: 2025-12-13GitHub→
0
0
Low Cost
ettysekhon icon

mcp-server-gke

by ettysekhon

Sec8

A weather service providing interactive forecasts via the Model Context Protocol (MCP) designed for AI agents and deployed on GKE.

Setup Requirements

  • ⚠️Requires 'uv' as the Python package manager for development.
  • ⚠️Requires Google Cloud CLI and an active GCP project with billing enabled for deployment.
  • ⚠️Requires Docker for building container images locally and for the CI/CD pipeline.
Verified SafeView Analysis
The project demonstrates a robust security model for deployment using Workload Identity Federation, avoiding hardcoded secrets in the CI/CD pipeline. The application code itself makes external HTTP requests to Open-Meteo APIs. HTML generation for MCP-UI responses directly interpolates user-provided city names; while MCP-UI clients are expected to render in a sandboxed iframe, basic input sanitization on the server side would enhance robustness against potential XSS if the client sandbox were to be bypassed or misconfigured.
Updated: 2025-12-10GitHub→
0
0
High Cost
Deejpotter icon

my-mcp-server

by Deejpotter

Sec9

This MCP server provides a comprehensive suite of development tools and API integrations designed to empower AI agents with capabilities for file management, command execution, web search, documentation lookup, project management, image processing, grocery price comparison, and PDF data extraction.

Setup Requirements

  • ⚠️Requires Node.js 18 or higher.
  • ⚠️Full functionality depends on multiple external API keys, some of which are paid or have stringent free-tier rate limits (e.g., OpenAI, SerpAPI, Hugging Face, Coles, ClickUp).
  • ⚠️Image processing tools (sharp) and PDF parsing tools (pdf-parse-new) may have native dependencies that require specific system libraries (e.g., libvips for sharp) for optimal performance and functionality, depending on the operating system.
Verified SafeView Analysis
The server demonstrates robust security practices through strict command allowlisting, comprehensive dangerous pattern detection (e.g., 'rm -rf', fork bombs), and path validation that prevents directory traversal and access to sensitive system/project files (.git, .env, .ssh, node_modules). All external API keys are configured via environment variables, adhering to best practices. Command mapping for Windows also re-validates the transformed command, adding an extra layer of safety. This makes the server highly secure against common injection and file access vulnerabilities.
Updated: 2026-01-18GitHub→
PreviousPage 533 of 760Next