Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
High Cost
administrativetrick icon

etsy-mcp-server

by administrativetrick

Sec9

Integrates with the Etsy API v3 to enable AI assistants to search for products, shops, listings, trending items, and reviews.

Setup Requirements

  • ⚠️Requires a free Etsy API Key from the Etsy Developer Portal.
  • ⚠️Requires Node.js 18 or higher.
Verified SafeView Analysis
The server correctly uses environment variables for the Etsy API key, preventing hardcoding. It uses `axios` for secure external API calls to Etsy. No `eval` or obfuscation found. As with any tool interfacing with an external API, the security relies partially on the robustness of the external service (Etsy API).
Updated: 2025-12-12GitHub→
0
0
Low Cost

todopomo-mcp

by PratyayRajak

Sec9

Integrates AI-powered task management and Pomodoro timing capabilities into an MCP-compatible AI assistant, primarily Claude Desktop.

Setup Requirements

  • ⚠️Requires Node.js runtime environment to install and run.
  • ⚠️Requires Claude Desktop application (or another MCP-compatible AI client) to function as intended.
  • ⚠️Manual editing of Claude Desktop's configuration file ('claude_desktop_config.json') is necessary for integration.
Verified SafeView Analysis
Operates as a local Model Context Protocol (MCP) server. Data is stored locally in JSON format. No indications of external network calls, obfuscation, or 'eval' usage mentioned. Security relies on the integrity of the Node.js runtime and MCP SDK, and responsible AI usage.
Updated: 2025-11-17GitHub→
0
0
Low Cost

OHFMCPServer

by shrubs21

Sec9

This project provides an MCP server designed to interact with an Oracle ATP database.

Setup Requirements

  • ⚠️Requires Oracle ATP database credentials.
  • ⚠️Requires Python 3.13+.
Verified SafeView Analysis
The project seems to be a standard Python application interacting with a database. No obvious security risks like 'eval', obfuscation, or hardcoded secrets are apparent from the provided files. Network risks are inherent to any server but not explicitly highlighted as a vulnerability here.
Updated: 2025-11-24GitHub→
0
0
Low Cost
TrueAquarius icon

Hello.MCP

by TrueAquarius

Sec7

A simple demonstration of a Model Context Protocol (MCP) server for basic name setting and greeting functionality.

Setup Requirements

  • ⚠️Requires the .NET runtime to be installed.
  • ⚠️Requires the Hello.MCP.dll to be compiled and its path correctly configured.
  • ⚠️Requires manual configuration in `mcp_settings.json` within the Roo Code global storage.
Verified SafeView Analysis
The provided content is only the README, not the actual C# source code of the .NET console application. A thorough security audit cannot be performed without the source code. Based solely on the description, there are no immediate red flags like 'eval', network operations, or hardcoded secrets mentioned. However, without inspecting the compiled DLL, the actual security posture is unknown.
Updated: 2025-11-30GitHub→
0
0
Low Cost
mideind icon
Sec9

Provides Icelandic word inflection lookups for LLMs using the Model Context Protocol.

Setup Requirements

  • ⚠️Requires Python 3.10 or newer.
Verified SafeView Analysis
The server wraps a well-established linguistic library (BinPackage/islenska) and exposes its functionality via MCP tools. No direct use of 'eval', 'exec', 'subprocess', or other high-risk functions. No hardcoded credentials or significant network vulnerabilities are evident in the provided source code. Relies on the security of the underlying BinPackage and MCP frameworks.
Updated: 2025-12-12GitHub→
0
0
High Cost
Sec4

This server is designed for hosting, managing, and potentially finetuning open-source Large Language Models, integrating DevOps practices for deployment and runtime.

Setup Requirements

  • ⚠️Requires Python dependencies as specified in `requirements.txt`.
  • ⚠️Demands significant computational resources (e.g., GPUs, large RAM) for effective LLM hosting and finetuning operations.
  • ⚠️Likely requires downloading and configuring specific open-source LLM models prior to use.
Review RequiredView Analysis
Without access to the actual code or a comprehensive README, it's impossible to thoroughly audit for 'eval' usage, obfuscation, or specific network vulnerabilities. As a host server, it inherently presents network exposure risks that require careful configuration and security practices. Score reflects high uncertainty.
Updated: 2025-11-18GitHub→
0
0
Low Cost
Sec8

Provides a REST API to fetch real-time weather information for a given city, likely intended for integration with a Minecraft Pocket Edition (MCP) server or client to display in-game weather.

Setup Requirements

  • ⚠️Requires an OpenWeatherMap API Key (free tier available) to be set as the 'OPENWEATHER_API_KEY' environment variable.
  • ⚠️Requires Python 3.9+ and the dependencies listed in 'requirements.txt' (fastapi, uvicorn, requests, python-dotenv).
Verified SafeView Analysis
The server acts as a proxy to the OpenWeatherMap API. It relies on a securely provided 'OPENWEATHER_API_KEY' environment variable. Input validation for the 'city' parameter is handled by the underlying requests library for URL encoding, and FastAPI's path parameters offer some level of sanitization. No direct code injection or command execution vulnerabilities are apparent.
Updated: 2025-11-18GitHub→
0
0
Medium Cost
andrewtubman icon

logseq-mcp

by andrewtubman

Sec9

Enables AI assistants to programmatically interact with a Logseq graph for reading, searching, and modifying content.

Setup Requirements

  • ⚠️Requires Ruby 3.4+
  • ⚠️Requires Logseq desktop app with HTTP API enabled and an Authorization token manually configured in Logseq settings.
  • ⚠️Requires Bundler for dependency management.
Verified SafeView Analysis
The project securely handles API authentication via a Bearer token supplied as an environment variable, preventing hardcoded secrets. It acts as a client to the local Logseq API, not exposing additional network surfaces directly. No 'eval' or malicious patterns were found. The README includes an 'Early Build Warning' advising users to back up their graphs, which is a prudent general caution for early-stage software.
Updated: 2025-12-01GitHub→
0
0
Low Cost
npelloux icon

jira-mcp-server

by npelloux

Sec9

Provides a basic Model Context Protocol (MCP) server with a 'hello_world' tool, serving as a template for more complex tool integrations, potentially with Jira.

Setup Requirements

  • ⚠️Requires Node.js (version 18+ recommended)
Verified SafeView Analysis
Input validation is performed using Zod, which helps mitigate injection risks for the 'hello_world' tool. The server uses StdioServerTransport, indicating local process communication rather than direct network exposure. No 'eval' or other dynamic code execution found. The server's functionality is minimal, reducing the attack surface.
Updated: 2025-11-22GitHub→
0
0
High Cost
ARJ999 icon
Sec9

Provides AI agents with comprehensive control and automation capabilities over the Fivetran data integration platform.

Setup Requirements

  • ⚠️Requires Fivetran API Key and Secret (a Fivetran account is necessary, paid subscription recommended for full functionality).
  • ⚠️Requires Python 3.11 or higher.
  • ⚠️Optimal performance and resilience features (L2/L3 caching, Sentry, Prometheus) rely on optional external services like Redis and a database, which need separate setup.
Verified SafeView Analysis
Robust security design with Pydantic input validation, environment variable-based secrets management, structured error handling, and documented prevention for common vulnerabilities (SQL/Command Injection, XSS). HTTPS enforcement and rate limiting are also in place. While documentation mentions OAuth 2.1, the provided API client implementation uses HTTP Basic Auth. No direct 'eval' or malicious patterns were observed.
Updated: 2025-12-03GitHub→
0
0
High Cost
WhytcardAI icon
Sec9

A cognitive AI engine acting as an MCP server for IDE integration, designed to enhance developer experience through a triple memory system and continuous learning.

Setup Requirements

  • ⚠️Requires TAVILY_API_KEY for web search capabilities (Tavily is a paid service).
  • ⚠️Requires CONTEXT7_API_KEY for specific library documentation (likely a paid service).
  • ⚠️Initial model download for FastEmbed (BAAI/bge-small-en-v1.5, ~120MB) may be required if not cached, potentially leading to slower startup or reduced functionality if `CORTEX_OFFLINE_MODE` is true and no internet access.
  • ⚠️Requires Python 3.11+.
Verified SafeView Analysis
The project explicitly addresses security concerns such as hardcoded credentials and SQL injection in its `INTERDICTIONS.md`. Sensitive API keys (Tavily, Context7) are loaded via environment variables. Input validation is performed using Pydantic schemas and custom logic for content and tags. The MCP server operates over standard I/O, minimizing direct network exposure for the core server. No obvious 'eval' or other dynamic code execution vulnerabilities are present. Logging uses structured `structlog` which can be configured for JSON output in production to prevent sensitive data exposure.
Updated: 2025-12-03GitHub→
0
0
Low Cost
EPortman-Ping icon

remote-mcp-ping-federate

by EPortman-Ping

Sec9

A Cloudflare Workers MCP server secured with PingFederate, enabling AI agents to call protected downstream APIs on behalf of an authenticated end user via OAuth 2.0 token exchange.

Setup Requirements

  • ⚠️Requires a PingFederate server with extensive manual configuration steps (IdP Adapters, Policy Contracts, OAuth Scopes, Access Token Managers, Token Processors, etc.).
  • ⚠️Dependent on a separately deployed 'Todo API' Cloudflare Worker, which itself requires specific environment variables and Cloudflare KV storage setup.
  • ⚠️Requires a Cloudflare account and Wrangler CLI for deployment and managing environment variables, including updating `wrangler.jsonc` with KV namespace IDs after creation.
Verified SafeView Analysis
The server implements robust OAuth 2.0 and OIDC practices, including JWT validation using the `jose` library (fetching JWKS from the issuer), and secure token exchange. All sensitive configurations are managed through environment variables, preventing hardcoding. A least-privilege approach is used by filtering scopes during token exchange. Cloudflare Durable Objects provide secure and isolated session state. While debugging tools exposing tokens exist in this demo, they would require strict access controls or removal in a production environment.
Updated: 2025-12-15GitHub→
PreviousPage 542 of 760Next