Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
High Cost

limbo.club

by jaimepaslart

Sec6

An AI-assisted development environment leveraging Claude Code agents for complex tasks and MCP servers to provide extended capabilities like filesystem access, web searching, and GitHub interaction.

Setup Requirements

  • ⚠️Requires Claude API keys and specific configuration in `.claude/mcp_config.json`, which may be paid or require specific accounts.
  • ⚠️Requires setup and understanding of 'MCP Servers' (Managed Computing Platforms or a custom framework providing agent capabilities, details likely in `.claude/README.md`).
  • ⚠️Requires a Node.js environment and installation of project dependencies (e.g., via `npm install` or `yarn`).
Verified SafeView Analysis
The project integrates powerful AI agents with access to the filesystem, web, and GitHub via MCP servers, posing potential risks if API keys are exposed or agent permissions are misconfigured. The `server` directory and `SETUP_RESEND.md` indicate backend logic and email functionality, which require standard security practices. API keys are correctly noted as ignored by Git in `.claude/mcp_config.json`, but local handling and environment security remain critical.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
JanGoebel icon

labview_assistant

by JanGoebel

Sec4

Enables LLMs to programmatically control and generate LabVIEW code through an MCP server.

Setup Requirements

  • ⚠️Requires a LabVIEW development environment or runtime to execute `main.vi`.
  • ⚠️Requires an MCP client application (e.g., Claude Desktop) to connect and utilize the server.
Review RequiredView Analysis
The provided source code is severely truncated, consisting only of `config.json` and `readme.md`. The actual server logic, likely implemented in LabVIEW VIs and potentially a `mcp-remote` wrapper, is not available for review. Therefore, a comprehensive security audit for vulnerabilities such as command injection, `eval` usage, or hardcoded secrets within the core server implementation is impossible. The `config.json` does include an 'Allowed Paths' whitelist (`C:\Temp\`), which is a positive security measure for restricting file system interactions, but its effectiveness depends entirely on the server's internal logic that consumes this configuration. Safety cannot be guaranteed without full code visibility.
Updated: 2025-12-18GitHub→
0
0
Medium Cost
Sec8

Extracts politician stock, ETF, mutual fund, and bond trades with prices and related analytics from Capitol Trades.

Setup Requirements

  • ⚠️Requires Node.js 18+ runtime.
  • ⚠️Requires manual configuration in Cursor/VS Code MCP Settings (JSON), including an absolute path if installed from source.
Verified SafeView Analysis
The server makes external HTTP requests to capitoltrades.com using axios and cheerio for HTML parsing. While no immediate security vulnerabilities like 'eval' or obfuscation are apparent, the security depends on the integrity of the external data source and standard network request best practices. It runs locally as a Node.js application, so standard runtime security applies.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
luiscarone icon
Sec9

Provides comprehensive access to Autodesk Fusion 360 Python API documentation, code generation, and API querying with an auto-updating index for AI-assisted development.

Setup Requirements

  • ⚠️Requires Python 3.10+ and specific dependencies from requirements.txt.
  • ⚠️Requires an MCP-compatible client (e.g., Claude Desktop, Cline) and specific JSON configuration for the client.
  • ⚠️Windows users must use WSL with specific bash commands for optimal setup.
  • ⚠️Initial API index update requires internet access and can take 10-30 minutes for a full scrape.
Verified SafeView Analysis
The server implements URL filtering to restrict web scraping to 'help.autodesk.com', includes input validation for all tools, and uses request timeouts. Code generation uses predefined templates, preventing arbitrary code execution. The primary risk is with manual API index building which may require local file path configurations, but the recommended auto-update method mitigates this. No hardcoded sensitive information was found.
Updated: 2025-11-19GitHub→
0
0
Medium Cost
enarha icon
Sec9

Provides a Model Context Protocol (MCP) server for accessing historical Tekton PipelineRun and TaskRun data stored in Tekton Results.

Setup Requirements

  • ⚠️Requires Go 1.24.3 or later for building the server.
  • ⚠️Requires access to a Kubernetes cluster with Tekton Pipelines and Tekton Results installed.
  • ⚠️When running outside a cluster and the Tekton Results aggregated API is not exposed, manual configuration via environment variables (e.g., TEKTON_RESULTS_BASE_URL) is required.
Verified SafeView Analysis
The server uses standard Kubernetes client libraries for authentication and API interaction, which is a secure approach. Input parameters for tools are validated and sanitized (e.g., `labelSelector`, CEL string escaping), reducing injection risks. Sensitive information like bearer tokens is sourced from environment variables or kubeconfig, avoiding hardcoding. The `TEKTON_RESULTS_INSECURE_SKIP_VERIFY` option, while a security risk if misused in production, is explicitly opt-in for development/testing scenarios and properly documented.
Updated: 2026-01-14GitHub→
0
0
Medium Cost
JarrodAI icon
Sec9

This server integrates Microsoft's Pylance and Pyright to provide advanced Python code intelligence (type checking, refactoring, code navigation, completions) to AI coding assistants via the MCP protocol.

Setup Requirements

  • ⚠️Requires Python 3.11+
  • ⚠️Requires Node.js 18+
Verified SafeView Analysis
The server explicitly states strong security measures including path validation, subprocess sandboxing, read-only default operations, and input validation on all endpoints. It leverages well-established and hardened tools like Pylance and Pyright. No 'eval' or malicious patterns are evident in the provided source code.
Updated: 2026-01-12GitHub→
0
0
Low Cost

mcp-server

by rlakenvelt

Sec5

This repository likely hosts a server application, developed with TypeScript and Node.js, designed to handle custom protocols or serve as a backend service.

Setup Requirements

  • ⚠️Requires Node.js and npm/yarn for dependency management.
  • ⚠️Requires TypeScript to be compiled or run via ts-node.
Review RequiredView Analysis
A full security audit for 'eval', obfuscation, or network risks is not possible as code content (beyond file names) was not provided. The score reflects an unknown state.
Updated: 2025-11-18GitHub→
0
0
Low Cost

mcp-server-example

by Les-Schtroumpfs

Sec6

Provides an example of a Python-based server application, likely demonstrating a specific protocol or backend functionality.

Setup Requirements

  • ⚠️Requires the Python environment management tool `uv` for dependency installation and execution.
  • ⚠️A specific Python version, indicated in the `.python-version` file, is likely required for compatibility.
Verified SafeView Analysis
Cannot inspect `main.py` content for specific vulnerabilities (e.g., 'eval', insecure network practices, lack of input validation). As an example server, it may lack production-grade security hardening.
Updated: 2025-11-18GitHub→
0
0
High Cost
Ariel-Fam icon
Sec7

An AI agent application that leverages Firecrawl for web scraping and data extraction, providing a Streamlit-based chat interface for user interaction and specialized analysis of developer tools.

Setup Requirements

  • ⚠️Requires OpenAI API Key for 'gpt-4.1' model (Paid Service)
  • ⚠️Requires Firecrawl API Key (Paid Service)
  • ⚠️Requires Node.js and npm/npx installed for 'firecrawl-mcp'
  • ⚠️The 'main.py' application runs as a Streamlit server, requiring 'streamlit' to be installed and run via 'streamlit run'.
Verified SafeView Analysis
The application uses Firecrawl for web scraping, which by its nature involves making requests to arbitrary external URLs. This capability, especially when driven by an LLM agent, could potentially be misused for SSRF or other network-based attacks if user input is not carefully constrained or validated by the LLM's guardrails. No hardcoded secrets or 'eval' statements were found. API keys are loaded from environment variables, which is good practice.
Updated: 2025-11-28GitHub→
0
0
Low Cost
Blacol icon
Sec6

Manages personal calendar events and to-do items on a CalDAV server, enabling automation and interaction through large language models.

Setup Requirements

  • ⚠️Requires access to a CalDAV server and its credentials (URL, username, password).
  • ⚠️Credentials must be stored in 'config.json' file.
  • ⚠️The server listens on port 20002; this port needs to be opened/forwarded for external access.
  • ⚠️Requires Python 3.11+ and 'uv' for dependency management and execution.
Verified SafeView Analysis
The CalDAV server credentials (URL, username, password) are read from a 'config.json' file, which is less secure than using environment variables, especially for production deployments. Direct 'json.loads' is used on model inputs, which could be a concern if malicious JSON strings can be crafted, though the subsequent usage of these parsed values in CalDAV operations appears to mitigate direct code injection risks. The server binds to '0.0.0.0' and listens on port 20002, requiring the user to manage network exposure.
Updated: 2025-12-22GitHub→
0
0
Low Cost
FranklynChimobi icon

locusts_mcp

by FranklynChimobi

Sec9

A dynamic performance testing application using Locust for simulating user traffic and API load, with a roadmap to become an MCP-ready server.

Setup Requirements

  • ⚠️Requires Python 3.11+ for execution, as specified in the plan.md.
  • ⚠️Requires Locust 2.x to be installed as a dependency (`pip install "locust>=2.23,<3"`).
  • ⚠️Relies on JSON configuration files for test scenarios; understanding their structure is crucial.
Verified SafeView Analysis
The core `locustfile.py` is well-structured and avoids obvious direct security vulnerabilities like `eval`. Configuration is loaded from JSON files and environment variables, with precedence for CLI overrides. The primary security consideration is the trustworthiness of the configuration files (`data/config.json`, `data/config.example.json`, or a path specified by `CONFIG_PATH`). A malicious configuration could direct the load test to unintended targets or send harmful payloads, but this is inherent to the nature of a configurable load testing tool. Example config files contain a 'test-token', which is appropriate for examples. The `seed` is redacted in logs, showing good practice for sensitive configuration values.
Updated: 2026-01-19GitHub→
0
0
Low Cost
Victors081 icon

obsidian-mcp-server

by Victors081

Sec9

Enables Model Context Protocol (MCP) clients, such as Claude Desktop, to seamlessly interact with Obsidian vaults for knowledge management and automation.

Setup Requirements

  • ⚠️Requires Node.js version 18 or higher.
  • ⚠️Advanced Obsidian integration features (e.g., executing commands, opening files in UI) require the 'Obsidian Local REST API' plugin to be installed and enabled in your Obsidian vaults.
  • ⚠️Currently requires installation from source via 'git clone', 'npm install', and 'npm run build', as it's not yet published to npm.
Verified SafeView Analysis
The server demonstrates strong security practices. It includes robust path validation to prevent traversal attacks and ensures symlink targets are within allowed directories. REST API commands are limited to an explicit allowlist. API keys are discovered from Obsidian plugin configuration, cached in memory, and not serialized to disk. Rate limiting is implemented globally, per-vault, and per-operation to prevent abuse. File locking is used to ensure data integrity during concurrent access. Auto-configuration logic is designed to add safe parent paths (under user home directory) to allowed locations, avoiding system directories. The primary communication channel is stdio, limiting external network attack surface directly from this server process.
Updated: 2026-01-17GitHub→
PreviousPage 565 of 760Next