Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
High Cost
080bct12alex icon

ChatBot_Development

by 080bct12alex

Sec3

A LangGraph-based AI chatbot with a Streamlit UI, featuring conversation memory, tool integration (search, calculator, stock price), RAG capabilities for document analysis, Multi-Agent Collaboration (MCP), user authentication, and persistent storage.

Setup Requirements

  • ⚠️Requires Google Generative AI API Key (Paid).
  • ⚠️Requires Alpha Vantage API Key (for stock price tool), currently hardcoded in `agent.py` files.
  • ⚠️Requires the Multi-Agent Collaboration (MCP) server `https://alexmcp.fastmcp.app/mcp` to be accessible for MCP tools to function.
  • ⚠️Significant Python dependencies including `langchain`, `langgraph`, `streamlit`, `streamlit-cookies-manager`, `aiosqlite`, `PyPDFLoader`, `FAISS`, `HuggingFaceEmbeddings` (which may download a large model locally), and `langchain-mcp-adapters`.
  • ⚠️Creates and manages a local `vectorstores` directory for FAISS indices, requiring local disk space.
Review RequiredView Analysis
Critical security risks identified: The Alpha Vantage API key is hardcoded in multiple `agent.py` files. More severely, the Streamlit `EncryptedCookieManager` password is hardcoded as `7b9561efc4a6acf95c78285418225434533f70dd609026c8ff9ba1c50a5be6c6` or a placeholder `YOUR_RANDOM_SECRET_KEY_HERE` in `app.py` files. This hardcoded cookie password allows anyone with access to the codebase to decrypt user session data, posing a significant risk of session hijacking and data exposure. Although user passwords are hashed with bcrypt, this cookie vulnerability is critical. External network calls (search, stock, MCP) depend on the security of third-party services.
Updated: 2025-11-29GitHub→
0
0
Low Cost
wiznikvibe icon

mcp-cc

by wiznikvibe

Sec2

Exposes basic terminal functionalities like command execution, file creation, and arithmetic operations as tools via Server-Sent Events (SSE) for programmatic interaction, often by AI agents.

Setup Requirements

  • ⚠️Requires `uvicorn` and `starlette` for SSE transport.
  • ⚠️The default workspace `~/repo/mcp-cc/artifacts` must exist and be writable by the server process for file operations to succeed.
  • ⚠️Requires Python 3.13 or newer.
Review RequiredView Analysis
The `run_command` tool uses `subprocess.run(command, shell=True)` directly with user-provided input, creating a critical remote code execution vulnerability. Any client can execute arbitrary system commands. The `create_text_file` tool allows writing arbitrary content to the `DEFAULT_WORKSPACE`, posing risks of file manipulation or overwriting if not tightly controlled, despite basic path traversal mitigation for the filename.
Updated: 2025-12-03GitHub→
0
0
Low Cost
Sec8

Provides an MCP server interface to query real-time data from Euler Finance lending vaults across multiple blockchain networks.

Setup Requirements

  • ⚠️Node.js 22.x is required.
  • ⚠️Requires manual update of the MCP client configuration path to the 'index.js' file.
Verified SafeView Analysis
The server executes a Node.js script locally to retrieve data. It will make external network requests to Euler Finance APIs and blockchain nodes. No 'eval' or obfuscation is apparent from the provided README. Security is dependent on the integrity and quality of the 'index.js' source code, which is not provided for direct review. As a read-only data retrieval tool, direct exploitable vulnerabilities from its function are less likely.
Updated: 2025-11-18GitHub→
0
0
Medium Cost

monta-mcp

by nickknissen

Sec8

Provides LLM-friendly access to the Monta EV charging API by wrapping its Python SDK as an MCP server.

Setup Requirements

  • ⚠️Requires Monta API credentials (Client ID and Client Secret) from the Monta Public API Portal.
  • ⚠️Requires Python 3.11 or higher.
  • ⚠️Integration with Claude Desktop requires specific JSON configuration in its settings file.
Verified SafeView Analysis
The server handles sensitive Monta API credentials (client ID and client secret) and performs state-changing operations on an EV charging platform. It leverages environment variables for secrets, uses connection pooling, and includes input validation and error handling for robust operations. The primary security considerations involve securing the environment where credentials are stored and ensuring the MCP server is not exposed beyond its intended local scope for LLM integration.
Updated: 2025-11-17GitHub→
0
0
Low Cost
Bin4yi icon
Sec7

AI-powered pet care chatbot leveraging an MCP server and LangGraph agent for authenticated access to veterinary tools and pet management.

Setup Requirements

  • ⚠️Requires Python 3.12 or higher
  • ⚠️Requires an Asgardeo account and manual application setup (Client ID, Tenant Name, Redirect URLs, Scopes)
  • ⚠️Requires an OpenAI API Key (a paid service)
Verified SafeView Analysis
The server implements robust JWT token validation using JWKS, and the agent uses OAuth2 Authorization Code Flow with PKCE for secure authentication. Sensitive credentials are correctly managed via environment variables. However, the agent's `aiohttp_cors` is configured with a highly permissive `*` origin allowing credentials, which is a significant security risk for production deployments. Additionally, the `JWTValidator` has a `ssl_verify=False` option (commented as for dev/testing) that, if used in production, would compromise security.
Updated: 2025-12-02GitHub→
0
0
Medium Cost
bioanywhere icon

kiko

by bioanywhere

Sec8

A Model Context Protocol (MCP) server that provides onchain tools for AI applications like Claude Desktop and Cursor, enabling them to interact with the Base Network, Coinbase API, and other Web3 protocols.

Setup Requirements

  • ⚠️Requires Coinbase API credentials (API Key Name and Private Key) with sufficient permissions for blockchain interactions.
  • ⚠️Requires a wallet seed phrase (`SEED_PHRASE`) in environment variables for any write operations (e.g., transfers, contract deployments), granting the server full control over the associated wallet.
  • ⚠️Dependent on several external API keys for full functionality: Coinbase Project ID (for onramp), Alchemy API Key (for NFTs), OpenRouter API Key (for credits), Neynar API Key (for Farcaster), and potentially Pinata JWT (for Flaunch, if enabled).
Verified SafeView Analysis
The server's design inherently requires access to sensitive information such as Coinbase API keys (with transaction signing capabilities) and a wallet seed phrase, granting it full control over the associated crypto assets. While the codebase itself leverages established libraries (Viem, AgentKit) and follows good practices for handling these credentials (via environment variables), the primary security risk lies in the user's responsibility to securely manage their environment variables and protect the system running the server. There are no obvious 'eval', command injection, or obfuscation patterns observed directly within the provided source that would introduce additional vulnerabilities beyond the high-privilege nature of its intended function.
Updated: 2025-12-10GitHub→
0
0
High Cost
techmad220 icon
Sec9

A Rust-based server for managing short-term and long-term memory, featuring semantic search, memory consolidation, and LLM-powered reasoning capabilities, interacting via MCP protocol.

Setup Requirements

  • ⚠️Requires PostgreSQL 14+ with the pgvector extension installed and enabled.
  • ⚠️Requires Ollama installed and running locally, with the 'nomic-embed-text' model (and potentially a large language model like 'llama3.2') pulled for embeddings and reasoning.
  • ⚠️Correct configuration of environment variables (DATABASE_URL, OLLAMA_URL, EMBEDDING_MODEL, LLM_MODEL) is crucial for functionality.
Verified SafeView Analysis
The server uses Rust, which provides strong memory safety. Database interactions are handled securely with sqlx's parameterized queries, preventing SQL injection. External LLM calls are made to a configurable Ollama endpoint, defaulting to localhost, and URLs are not constructed from unsanitized user input, mitigating command injection risks. No hardcoded sensitive credentials were found; configuration uses environment variables. The primary interaction is via stdio, relying on the invoking process for external network security. The overall design appears robust against common web vulnerabilities.
Updated: 2025-12-14GitHub→
0
0
Low Cost
ankit48365 icon

portsage

by ankit48365

Sec10

A basic template for a Python project.

Setup Requirements

  • ⚠️Requires Python environment
Verified SafeView Analysis
The provided source code consists solely of a README and an empty design document. No executable code was available for security analysis, thus no vulnerabilities were detected in the given files.
Updated: 2025-11-21GitHub→
0
0
Low Cost
Tasfiul-Hedayet icon

mcp-server

by Tasfiul-Hedayet

Sec7

This server logs authorized client connection events as part of an MCP (Multi-Agent Communication Protocol) system.

Setup Requirements

  • ⚠️Requires Python 3.10 or newer.
Verified SafeView Analysis
The actual server logic (specifically the `server:server.run` function and its event handling) is not provided, making a full security audit impossible. The `record_event` tool accepts a 'message' string, which, if not properly sanitized before logging or display, could lead to log injection or Cross-Site Scripting (XSS) vulnerabilities. No 'eval', obfuscation, hardcoded secrets, or obvious malicious patterns were found in the provided configuration files.
Updated: 2025-11-30GitHub→
0
0
High Cost
Sec4

Enables an AI agent, via an MCP client like Claude Desktop, to fully control and automate tasks on a remote macOS system.

Setup Requirements

  • ⚠️Requires Docker Desktop to run the server.
  • ⚠️Requires manual enablement and configuration of Screen Sharing on the target macOS machine.
  • ⚠️Requires Claude Desktop application for integration and interaction.
  • ⚠️WebRTC features require a separate LiveKit server setup.
Review RequiredView Analysis
The server explicitly states support for VNC Protocol 30, which uses Diffie-Hellman with a 512-bit prime. This protocol is considered weak and vulnerable to modern attacks, especially when connecting to older macOS clients (OS X 10.11 or earlier from macOS 11-12). While it mentions stronger protocols for newer macOS versions, the presence of a weak default/fallback is a significant risk. Environment variables for credentials can also be a security concern if not handled carefully. Use with extreme caution and only on trusted, isolated networks.
Updated: 2025-11-17GitHub→
0
0
Low Cost
Dhruta25 icon
Sec9

The server provides an API for tracking and managing personal expenses, allowing users to add, list, delete, update, and query expense records.

Setup Requirements

  • ⚠️Python 3.10+ required
  • ⚠️fastmcp library needs to be installed (`pip install fastmcp`)
Verified SafeView Analysis
The SQLite database operations use parameterized queries, effectively preventing SQL injection vulnerabilities. No 'eval' or similar dangerous functions are used, and no hardcoded secrets or sensitive network configurations are present. The database path is relative to the script, enhancing portability and security.
Updated: 2025-12-03GitHub→
0
0
Medium Cost

netpay-mcp-server

by jacoboencinas

Sec4

This server likely functions as a Master Control Program (MCP) or central orchestrator for a payment processing system, handling API requests related to financial transactions or network management.

Setup Requirements

  • ⚠️Requires a relational database (e.g., PostgreSQL, MySQL) for transaction and user data persistence.
  • ⚠️Needs configuration for specific payment gateway API keys and credentials (e.g., Stripe, PayPal, custom payment rails).
  • ⚠️Requires a specific runtime environment (e.g., Java, Python, Node.js, Go) which is not specified.
Review RequiredView Analysis
Due to the complete lack of source code or a README, a comprehensive security audit is impossible. The score reflects a high-risk profile inherent to any payment-related server, which typically handles sensitive financial data and network communications. Without code review, it's impossible to check for 'eval', obfuscation, unpatched vulnerabilities, or specific network configuration risks. Running any payment server without thorough code inspection and security best practices is highly discouraged.
Updated: 2025-11-17GitHub→
PreviousPage 560 of 760Next