Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Low Cost
HermeticOrmus icon
Sec10

Provides a personalized greeting message via a simple MCP tool, serving as the simplest possible example for new MCP server developers.

Setup Requirements

  • ⚠️Requires Python 3.9 or higher.
  • ⚠️Requires 'fastmcp' library to be installed (`pip install fastmcp`).
  • ⚠️Requires absolute path configuration in `~/.claude/mcp.json`.
Verified SafeView Analysis
The server exposes a single tool `say_hello` which takes a string `name`. Input validation for `name` ensures it's a non-empty string. The response is a simple f-string interpolation of the validated input. No external system calls, network requests, file I/O, or dynamic code execution are present, minimizing attack surface. No hardcoded secrets. It is extremely safe for its intended purpose.
Updated: 2025-11-20GitHub→
0
0
Low Cost
shaik2025 icon

MCP-server-example

by shaik2025

Sec9

Provides a Micro-Agent Compute Protocol (MCP) server exposing basic arithmetic operations (add, subtract, multiply, divide) as callable tools.

Setup Requirements

  • ⚠️Requires Python 3.13 or newer, which is currently a pre-release version.
  • ⚠️Requires `mcp` and `httpx` Python packages to be installed.
Verified SafeView Analysis
The source code implements simple arithmetic operations without any discernible security risks. There are no uses of 'eval', obfuscation, direct network risks (as it defaults to stdio transport), or hardcoded secrets. The mathematical operations are inherently safe.
Updated: 2025-12-06GitHub→
0
0
Medium Cost
TheClusterFlux icon
Sec9

Enables AI assistants to discover, inspect, and safely interact with services deployed in a Kubernetes cluster via a Model Context Protocol (MCP) server.

Setup Requirements

  • ⚠️Requires access to a Kubernetes cluster API (either in-cluster or via kubeconfig).
  • ⚠️API keys must be securely configured via a Kubernetes secret (mcp-server-api-keys) before deployment.
  • ⚠️For HTTP API mode, an Ingress controller, a designated hostname (e.g., mcp-cluster-services.theclusterflux.com), and TLS certificates are required for HTTPS access.
Verified SafeView Analysis
The server demonstrates strong security practices including read-only Kubernetes RBAC, API key authentication (fail-safe by default), rate limiting, robust SSRF protection (restricting requests to cluster-internal *.svc.cluster.local domains and allowed ports), HTTPS enforcement, comprehensive input validation, error sanitization to prevent sensitive data leakage, and request size limits. A 'DEV_MODE' exists to bypass authentication, which should only be enabled in isolated development environments. Overall, the security implementation is well-considered and robust.
Updated: 2025-11-23GitHub→
0
0
Low Cost

local-mcp-server

by fancier21

Sec5

Provides a local backend server primarily for development environments like Zed and Cursor, enabling custom calculations or context-aware features.

Setup Requirements

  • ⚠️Requires Python and the 'uv' package installer/runner for dependency management and execution.
  • ⚠️Configuration requires updating absolute file paths (e.g., for `main.py`, `run.sh`) to match the local repository location.
Review RequiredView Analysis
A full security audit is not possible without inspecting the contents of `run.sh`, `main.py`, and `main-calculation.py`. Running arbitrary local scripts (especially `run.sh`) always carries inherent risk as they can execute any command on the host system. The server likely binds to a local port for IPC with development tools, limiting external network exposure but not removing local execution risks.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
BootcampToProd icon
Sec8

Acts as an intelligent MCP client that translates natural language commands into file operations orchestrated through an AI agent.

Setup Requirements

  • ⚠️Requires OpenRouter (or OpenAI-compatible) API Key
  • ⚠️Requires a separate MCP server running at http://localhost:8080
  • ⚠️Java Development Kit (JDK) required
  • ⚠️Maven required to build and run
Verified SafeView Analysis
The application uses an AI agent to interpret natural language commands and invoke file operation tools provided by an external MCP server. It explicitly uses an API key (OPENAI_API_KEY) for the OpenRouter AI service, expected to be passed as an environment variable, preventing hardcoding. There are no direct uses of 'eval' or arbitrary code execution within the client. Logs can expose prompts and LLM responses if Verbosity is set to show them (as it is in the FileOperationsController), which could be a concern for sensitive data in production environments. The primary security considerations shift to the security of the connected MCP server and the trustworthiness of the LLM outputs. The client's role is primarily orchestration and natural language interpretation.
Updated: 2025-12-22GitHub→
0
0
Medium Cost
JAI0705 icon
Sec9

An MCP server for tracking personal expenses, storing them in a local SQLite database and providing tools to add, list, and summarize expenses.

Setup Requirements

  • ⚠️Requires Python 3.13 or higher.
  • ⚠️Manual configuration of `~/.cursor/mcp.json` is needed, including the absolute path to `main.py` for integration with Cursor IDE.
Verified SafeView Analysis
The server uses parameterized SQL queries via `sqlite3.connect` for all database operations (INSERT and SELECT), which effectively prevents SQL injection vulnerabilities. There is no usage of `eval`, `exec`, `subprocess.run`, `os.system`, or direct execution of unsanitized user input. File paths are handled with `os.path.join`. No hardcoded secrets or sensitive external network interactions are evident. The `categories()` resource reads a local, static JSON file.
Updated: 2025-11-20GitHub→
0
0
Low Cost
JB181-test icon
Sec1

Serves as an edge-based proxy or server utilizing Cloudflare's network infrastructure, likely for routing requests or providing application logic.

Setup Requirements

  • ⚠️Requires a Cloudflare account for deployment.
  • ⚠️Requires `wrangler` CLI installed for development and deployment.
  • ⚠️Requires domain and DNS configuration for production deployment.
Review RequiredView Analysis
Source code was not provided, therefore a comprehensive security audit could not be performed. Running unverified code carries inherent risks, including the potential for 'eval' usage, hardcoded secrets, or malicious patterns that could not be checked.
Updated: 2025-11-26GitHub→
0
0
Low Cost
bioanywhere icon

central

by bioanywhere

Sec8

The World News API client provides easy access to thousands of news sources for integration into various applications.

Setup Requirements

  • ⚠️Requires a World News API Key (likely paid service for extensive use).
  • ⚠️Python client requires Python 3.7+ and pip installation.
  • ⚠️C++ client requires CMake 3.2+ and Qt for building applications that use it.
Verified SafeView Analysis
This project is an API client library, not a server. API keys are expected to be provided by the user and are not hardcoded in the library. File handling in the C++ client (OAIHttpRequestWorker::process_response) might be vulnerable to directory traversal if filenames from Content-Disposition headers are not properly sanitized by the consuming application, but this risk pertains to library usage rather than the library's inherent maliciousness.
Updated: 2025-12-13GitHub→
0
0
Low Cost
sasanka0212 icon

test-mcp-server

by sasanka0212

Sec1

A placeholder for a test server application, likely intended for simulating or interacting with a specific network protocol, possibly related to Minecraft Protocol (MCP) development or testing.

Review RequiredView Analysis
No source code was provided for analysis, making a security audit impossible. Running this project without reviewing its code is highly risky, as it could contain arbitrary malicious patterns, backdoors, or critical vulnerabilities. Therefore, a score of 1 is assigned.
Updated: 2025-11-29GitHub→
0
0
High Cost
sbayer2 icon
Sec8

A production-ready medical document analysis platform offering AI-powered insights and secure Stripe payment processing for various analysis tiers, deployed on FastMCP Cloud.

Setup Requirements

  • ⚠️Requires Anthropic API Key (Paid) for primary AI analysis.
  • ⚠️Requires Stripe API Key (Paid) for payment processing.
  • ⚠️Requires Python 3.12+.
  • ⚠️Requires Node.js/NPM locally if utilizing FastAgent's embedded MCP servers (filesystem, fetch, stripe).
Verified SafeView Analysis
The server uses `os.getenv` for API keys, which is good practice. It explicitly claims HIPAA compliance and PHI protection (no data persistence/logging of medical content) and uses TLS encryption. No `eval` or blatant obfuscation is present. Potential minor risks: 1. `docker-compose.yml` mounts `~/.zshrc:ro` for keys during local development, which, if unencrypted, could expose sensitive information (though read-only and for dev only). For FastMCP Cloud, keys are managed via dashboard environment variables, mitigating this. 2. Reliance on `npx` to fetch and run MCP servers (e.g., `server-filesystem`, `@stripe/mcp`) introduces a supply chain risk if these external packages were ever compromised.
Updated: 2025-11-19GitHub→
0
0
Medium Cost
Sec9

Demonstrate Gilhari's implicit attributes for automatic foreign key management in contained JSON objects via a RESTful microservice.

Setup Requirements

  • ⚠️Requires Docker installed to build and run the application.
  • ⚠️For development or modifications, requires Java Development Kit (JDK 1.8+).
  • ⚠️For development or modifications, requires Gilhari SDK and setting the JX_HOME environment variable.
  • ⚠️The default service configuration uses `jdx_force_create_schema: true`, which recreates the database schema on each run, potentially losing existing data (useful for development, requires caution in production).
  • ⚠️The `jdbc_driver_path` in `gilhari_service.config` needs to be correctly set for your chosen database (defaults to SQLite but configurable for others).
Verified SafeView Analysis
The server is a standard Dockerized Java microservice. Standard microservice security practices apply for deployment and input validation. The `jdx_force_create_schema: true` setting is for development and can wipe data, so it should be used with caution in production. The system loads JDBC drivers dynamically from a specified path, which is a standard Java practice but relies on the integrity of the driver JAR.
Updated: 2025-11-18GitHub→
0
0
Medium Cost
mcsacca icon

2pay-mcp-server

by mcsacca

Sec9

Enables AI assistants to interact with 2Checkout/Verifone payment processing, subscription management, and order operations through natural language.

Setup Requirements

  • ⚠️Requires a 2Checkout/Verifone merchant account.
  • ⚠️API credentials (TWOCHECKOUT_MERCHANT_CODE, TWOCHECKOUT_SECRET_KEY) must be configured as environment variables.
  • ⚠️Requires Node.js 18 or higher.
Verified SafeView Analysis
The server correctly leverages environment variables for API credentials (merchant code and secret key), which is a strong security practice. It uses HMAC-SHA256 for authenticating REST API calls and manages JSON-RPC sessions securely over HTTPS. No 'eval', obfuscation, or other obvious malicious patterns were found in the truncated source code. The project's README explicitly highlights important security considerations such as never exposing secret keys, using environment variables, and PCI DSS compliance awareness, indicating a good understanding of security best practices. However, the nature of handling payment-related data inherently carries risk, requiring strict operational security and compliance from the deployer.
Updated: 2025-11-21GitHub→
PreviousPage 566 of 760Next