Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
pankaj891 icon

remote-mcp-server

by pankaj891

Sec9

An MCP server for tracking, listing, and summarizing personal or business expenses, designed to be interacted with via an LLM tool-calling interface.

Setup Requirements

  • ⚠️Requires Python 3.13 or newer, which is currently in pre-release (alpha/beta) and not widely adopted, posing a significant compatibility challenge for most users.
  • ⚠️The SQLite database is stored in a temporary directory (`tempfile.gettempdir()`), meaning all expense data will likely be lost upon system reboot or temporary file cleanup.
Verified SafeView Analysis
SQL queries are properly parameterized, effectively mitigating common SQL injection vulnerabilities. No 'eval', code obfuscation, or hardcoded secrets are present. The server binds to 0.0.0.0, which is standard for accessibility but in production environments would ideally be restricted or placed behind a firewall/reverse proxy. The database resides in a temporary directory, which is safe from a security standpoint but implies non-persistence.
Updated: 2025-11-22GitHub→
0
0
Medium Cost
jmstone617 icon

brewfather-mcp

by jmstone617

Sec8

Provides an MCP server to connect LLMs with BrewFather, allowing retrieval of brewing data and basic calculations like ABV.

Setup Requirements

  • ⚠️Requires Node.js v18 or higher.
  • ⚠️A BrewFather account with API access is required (Premium subscription needed for BrewFather API access).
  • ⚠️BrewFather API credentials (BREWFATHER_USER_ID, BREWFATHER_API_KEY) must be provided in a .env file or environment variables.
Verified SafeView Analysis
The server correctly retrieves API keys from environment variables. It makes external HTTP requests to the BrewFather API. Input validation for tool arguments relies on the Model Context Protocol SDK's Zod schemas and basic JavaScript type coercion (e.g., parseFloat, type casting), which is generally sufficient but could be hardened with more explicit numeric validation before calculations or URL parameter usage. No 'eval' or direct arbitrary command execution found.
Updated: 2026-01-16GitHub→
0
0
Low Cost
Tocky14 icon
Sec9

Fetches trending articles from the Qiita API based on specified tags, intended as a component of a larger Microservice Composer Platform (MCP) server.

Setup Requirements

  • ⚠️Requires Node.js environment (version 18+ recommended based on package-lock.json).
  • ⚠️Requires `npm install` to resolve dependencies like axios and development tools (TypeScript, ts-node).
  • ⚠️The provided code is a service class, not a complete executable server application. An additional entry point (e.g., `index.ts`) would be needed to instantiate and expose this service as a functional server within an MCP.
Verified SafeView Analysis
The code primarily involves making HTTP GET requests to the public Qiita API using axios. User input for 'tag' and 'per_page' is passed as query parameters, which is handled safely by axios and the Qiita API, reducing direct injection risks. No 'eval', 'child_process', or direct execution of untrusted input is observed. No hardcoded secrets are present. Error logging is implemented.
Updated: 2025-12-07GitHub→
0
0
Medium Cost
Sec6

A backend server implemented with Hono and Bun for orchestrating sequential operations across multiple cloud platforms.

Setup Requirements

  • ⚠️Bun runtime must be installed.
  • ⚠️Requires configuration for specific cloud providers (e.g., API keys, environment variables) to function as a multi-cloud platform.
Review RequiredView Analysis
Code inspection is required to verify the absence of 'eval', obfuscation, or specific vulnerabilities related to cloud credential handling and API interactions. The nature of an 'MCP Server' inherently involves higher security considerations for sensitive data and access control.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
selvanayaki678 icon

k8s-ai-agent

by selvanayaki678

Sec4

An AI agent that allows users to query and manage their Kubernetes cluster using natural language questions.

Setup Requirements

  • ⚠️Requires an AWS Account with configured credentials (paid services will be incurred for EKS and Bedrock).
  • ⚠️Requires a Docker Hub account to build and push the MCP Server image.
  • ⚠️Manual configuration updates needed in `deployment.yaml` (Docker Hub username) and `k8s-ai-agent.py` (LoadBalancer URL).
Review RequiredView Analysis
The MCP Server deployment configuration (`deployment.yaml`) grants extremely broad ClusterRole permissions, including 'create', 'update', 'patch', 'delete' on core Kubernetes resources (pods, services, deployments, etc.) and 'get', 'list', 'watch' on ALL resources in ALL API groups. This level of access is explicitly noted as 'full read/write access for troubleshooting' but presents a critical security risk if the MCP server is compromised. Furthermore, the MCP server is exposed to the internet via a LoadBalancer service. The internal source code for the MCP server Docker image itself is not provided, preventing a full audit of its implementation and potential vulnerabilities that could exploit these excessive permissions.
Updated: 2025-11-27GitHub→
0
0
High Cost
beamuu icon

kubscan-mcp

by beamuu

Sec2

The MCP server acts as an intermediary, exposing a suite of tools to interact with the Kubscan blockchain explorer API, enabling agents to query blockchain data such as addresses, blocks, transactions, and statistics.

Setup Requirements

  • ⚠️Requires the Bun runtime environment.
  • ⚠️Communicates with kubscan.com/api/v2, an external API. While no API key is specified in the code, external API dependencies always carry potential rate limiting or availability issues.
  • ⚠️Disables TLS certificate verification, which is a critical security risk and not suitable for production deployments without significant modification.
Review RequiredView Analysis
The KubscanClient explicitly disables TLS certificate verification (`tls: { rejectUnauthorized: false }`) when making `fetch` requests to `kubscan.com/api/v2`. This is a critical security vulnerability that exposes the application to man-in-the-middle attacks, allowing attackers to intercept or alter communication between the server and the Kubscan API. This should never be used in a production environment. Additionally, error logging includes stack traces, which could expose internal paths and details if not properly managed.
Updated: 2025-11-24GitHub→
0
0
Medium Cost
Sec1

Unable to determine server's specific use case due to missing README content (404: Not Found).

Review RequiredView Analysis
Cannot perform a security audit for 'eval', obfuscation, or network risks as the README content was not found (404: Not Found). No analysis possible.
Updated: 2025-11-18GitHub→
0
0
Low Cost
dmarsters icon
Sec9

Generate structured compositional parameters and thematic guidance from astronomical constellation patterns for AI image generation.

Setup Requirements

  • ⚠️Requires Python 3.10 or higher.
  • ⚠️Relies on external network access to 'cdn.jsdelivr.net' to fetch optional constellation geometry data; functionality for this specific feature may be impacted if the CDN is unreachable.
Verified SafeView Analysis
The code is generally clean, well-structured, and does not use dangerous functions like 'eval' or contain hardcoded secrets. It makes a single external HTTP request to 'cdn.jsdelivr.net' to fetch constellation geometry data. While this is a standard CDN, reliance on external network resources always carries a minor inherent risk of unavailability or, in a highly unlikely scenario, compromise of the CDN serving malicious data. Input validation with Pydantic is robust.
Updated: 2025-11-29GitHub→
0
0
Medium Cost
alibahadircoskun icon

ansible-network-mcp

by alibahadircoskun

Sec5

Manages Ansible environments and executes network automation tasks on network devices via conversational AI (Claude Desktop).

Setup Requirements

  • ⚠️Requires Python 3.10 or higher.
  • ⚠️Requires Claude Desktop application for primary use case.
  • ⚠️Default installation (via `install.sh`) creates hardcoded root credentials, which must be immediately changed.
  • ⚠️Disables SSH host key checking by default, making it susceptible to MITM attacks.
Review RequiredView Analysis
CRITICAL: The `install.sh` script creates `group_vars/qfx_switches.yml` with hardcoded default credentials (`ansible_user: root`, `ansible_password: Admin123_`). This is a severe security risk, as these are exposed and may be forgotten. Users are strongly advised to change these immediately and consider Ansible Vault for sensitive data. CRITICAL: The server explicitly sets `ANSIBLE_HOST_KEY_CHECKING=False` in its subprocess calls and recommends it in `ansible.cfg` and Claude Desktop configuration. This disables host key verification, making it vulnerable to Man-in-the-Middle (MITM) attacks during SSH/NETCONF connections. POSITIVE: Input sanitization functions (`sanitize_input`, `sanitize_filename`) and path traversal checks (`safe_path_join`, `full_path.startswith(ANSIBLE_DIR)`) are implemented, which helps mitigate command injection and file system access vulnerabilities within the tool's operations. File operations are restricted to the configured Ansible directory.
Updated: 2025-11-26GitHub→
0
0
Medium Cost
tokligence icon

mcp-server

by tokligence

Sec5

A server application designed to host or manage a game, likely Minecraft, facilitating multiplayer interaction and custom server functionalities.

Setup Requirements

  • ⚠️Requires Java Runtime Environment (JRE) if it's a Java-based server (common for Minecraft).
  • ⚠️Requires appropriate network configuration and port forwarding for external access.
Review RequiredView Analysis
Source code was not provided, preventing a detailed security audit. Consequently, specific checks for 'eval', obfuscation, hardcoded secrets, or malicious patterns could not be performed. General server application risks regarding network exposure and input validation are assumed to exist but unverified.
Updated: 2025-11-19GitHub→
0
0
Low Cost
SiinXu icon

devtools

by SiinXu

Sec9

A static website for a Google DevFest workshop about Chrome DevTools MCP Server.

Setup Requirements

  • ⚠️Requires Node.js (for `npm start`) or Python 3 (for `python3 -m http.server`)
Verified SafeView Analysis
The project is a static React application served locally. No dynamic server-side logic, API calls, or sensitive data handling is observed in the provided code. It is generally safe for its intended use, noting that a local HTTP server (Python's `http.server` module) is used for serving files.
Updated: 2025-11-22GitHub→
0
0
Medium Cost
DawnReaverWOWS icon

TheFinalDiscordMCP

by DawnReaverWOWS

Sec8

A Discord bot for AI-powered chat, voice TTS, World of Warships stats, moderation, server management, and Model Context Protocol (MCP) integration for AI assistants.

Setup Requirements

  • ⚠️Requires Node.js 18+.
  • ⚠️Requires a Discord bot token and Discord server ID (guildId).
  • ⚠️Voice features require FFmpeg to be available in the environment.
  • ⚠️AI features are optional but highly recommended; they require an OpenRouter API key, though many models are free.
Verified SafeView Analysis
The project demonstrates good security practices, especially in handling external inputs for file paths and URLs. The `read_images` function prevents SSRF by strictly validating and reconstructing Discord CDN URLs. File upload paths are restricted to allowed directories. Network calls to external APIs (e.g., Wargaming, Pollinations.AI) use whitelisted domains. CORS is configured to avoid wildcard origins in non-development environments, explicitly allowing specified origins or private VCN IPs. Command arguments are sanitized, and rate limiting is in place. Overall, a commendable effort in security for a bot interacting with external services and user content. Some areas like more granular input validation for all Discord IDs passed to core Discord.js functions (though Discord.js often handles this internally) could further enhance robustness.
Updated: 2026-01-11GitHub→
PreviousPage 559 of 760Next