Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse Directory Why Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:

SORT:

Vetted Servers(9120)

Low Cost

nextjs-mcp-server

by jpeseWang

Sec5

A Next.js-based web interface or proxy for managing an existing Minecraft server instance.

Setup Requirements

⚠️Requires Node.js (and npm/yarn/pnpm) to install dependencies and run the server.
⚠️Requires an existing Minecraft server instance (or setup) for this application to connect to or manage.

Review RequiredView Analysis

Cannot perform a comprehensive security audit without inspecting the actual code. A server application inherently involves network risks (open ports, potential vulnerabilities). Default score assumes no immediate red flags but lacks verification.

Updated: 2025-11-17GitHub→

Medium Cost

mcp-server-lemonsqueezy

by RickyCompagny

Sec8

Manage Lemon Squeezy e-commerce and subscription data (stores, products, webhooks) via a Model Context Protocol (MCP) server, primarily for interaction through LLMs like Cursor/Claude.

Setup Requirements

⚠️Requires a Lemon Squeezy API Key (free with a Lemon Squeezy account, but Lemon Squeezy itself is a payment platform that may involve costs for transactions/features).
⚠️Requires Node.js runtime environment for `npx` execution.
⚠️Designed for integration with Model Context Protocol clients like Cursor/Claude.

Verified SafeView Analysis

The Lemon Squeezy API key is a critical secret. It can be passed via `--api-key` command-line argument or `LEMON_SQUEEZY_API_KEY` environment variable. Passing sensitive keys as command-line arguments can expose them in process listings on multi-user systems. While less ideal than environment variables, for a local MCP server setup, the risk might be acceptable to some users. No 'eval' or malicious patterns were found in the provided source code. External API calls are exclusively to Lemon Squeezy's official API.

Updated: 2025-12-01GitHub→

Medium Cost

3AmigosMCP

by honestlai

Sec5

Provides a comprehensive containerized environment for AI coding agents by combining browser automation (Playwright), file system access, and database operations.

Setup Requirements

⚠️Requires Docker and Docker Compose installed.
⚠️Requires Cursor or VS Code with Model Context Protocol (MCP) support.
⚠️The `Network-Bridge` Docker network must be created externally if not already present (e.g., `docker network create Network-Bridge`).

Review RequiredView Analysis

The container is configured with significant permissions that introduce security risks if not understood and managed properly. Specifically: 1. Playwright runs with `--no-sandbox`, disabling Chrome's security sandbox, which is a known risk for browser automation, especially when interacting with untrusted web content. 2. The container mounts the host's `/workspace` directory with read/write (`rw`) permissions. This means the container and any process within it (including the MCP servers) have full access to modify or delete files in that host directory. A compromise of any MCP server or the container itself could lead to host filesystem manipulation. 3. The recommended 'Command-Based Mode' for client configuration uses `docker exec`, which grants the client (e.g., Cursor/VS Code) direct execution capabilities within the container. While this eliminates persistent HTTP connections, it means the client effectively controls command execution inside the highly-privileged container. 4. The HTTP wrappers for Filesystem and Database MCPs (on ports 8082/8083 internal, 8092/8093 external) use `Access-Control-Allow-Origin: *`, which is broadly permissive if these ports were exposed beyond localhost to an untrusted network. However, the recommended usage is `docker exec` (stdio) or local HTTP access. It is crucial for users to understand these risks, particularly the `rw` volume mount and `--no-sandbox` flag, and only run this in a trusted development environment.

Updated: 2025-12-02GitHub→

Medium Cost

github-mcp-mod

by mixelpixx

Sec9

Connects AI tools (agents, assistants, chatbots) to GitHub's platform to read repositories, manage issues/PRs, analyze code, and automate workflows through natural language interactions.

Setup Requirements

⚠️GitHub Personal Access Token (PAT) required for authentication with appropriate scopes (e.g., 'repo').
⚠️Docker required for local containerized deployment.
⚠️Requires Go 1.21+ (for client tool) or Go 1.24+ (for server source build).

Verified SafeView Analysis

The project explicitly documents and emphasizes secure handling of GitHub Personal Access Tokens (PATs) using environment variables, avoiding hardcoding, and recommending least-privilege scopes. It utilizes standard authentication flows (PATs, OAuth) and GitHub's native permission model. No 'eval' or obvious malicious code patterns were found. The error handling mechanism stores detailed error information for middleware analysis without exposing sensitive data in logs, promoting observability and debugging while maintaining privacy. Lockdown mode offers an additional layer of content filtering for public repositories.

Updated: 2025-12-12GitHub→

Medium Cost

DS-MCP-FLOWISE

by dtsoden

Sec9

This MCP server enables AI assistants to design, build, and deploy Flowise chatflows and agentflows by providing deep knowledge of Flowise nodes, their configurations, and connection rules.

Setup Requirements

⚠️Direct deployment to Flowise requires configuring FLOWISE_API_URL and FLOWISE_API_KEY environment variables.
⚠️For non-npx installations (e.g., global npm install or build from source), the node database must be prepared manually by running `npm run extract && npm run prepare-db`.
⚠️Requires Node.js version 18.0.0 or higher.

Verified SafeView Analysis

The server uses standard practices for handling environment variables (`FLOWISE_API_URL`, `FLOWISE_API_KEY`) for Flowise API integration. It loads node definitions and templates from local JSON files, generated by internal scripts from (presumably) trusted Flowise source code. Database queries use prepared statements, which mitigates SQL injection risks. There is no evidence of `eval` or dynamic code execution from untrusted sources. The main security consideration is ensuring users correctly configure their Flowise API credentials and target URL, as misconfiguration could lead to unintended actions on their Flowise instance.

Updated: 2026-01-18GitHub→

Low Cost

mcp-stock-server

by gaforov

Sec9

A real-time stock price retrieval system that supports natural language queries with Yahoo Finance and CSV fallback.

Setup Requirements

⚠️Requires Python 3.10+.
⚠️Internet connection is needed for real-time data from Yahoo Finance (CSV fallback is available offline).
⚠️The `mcp_client.py` and `mcp_server.py` files should be in the same directory for the client to find the server.

Verified SafeView Analysis

The code uses `yfinance` to fetch data from Yahoo Finance. While `yfinance` is a common library, relying on external APIs always introduces dependency risks. No 'eval', hardcoded secrets, or obvious malicious patterns were found. The server communicates via stdio, limiting direct external network exposure.

Updated: 2025-12-03GitHub→

Low Cost

solidityscan-mcp-server

by Credshields

Sec7

An MCP server exposing SolidityScan for smart contract security analysis and reporting for integration with MCP-capable clients.

Setup Requirements

⚠️Requires Node.js 18+
⚠️Requires a SolidityScan API key (SOLIDITYSCAN_API_KEY) which may involve a paid subscription.
⚠️Requires an MCP-capable client (e.g., Claude Desktop, Cursor) to interact with it.

Verified SafeView Analysis

The server's `scan_local_directory` tool allows scanning local file paths provided by the client. If the server is deployed in an untrusted environment and exposed to arbitrary users, this could lead to information disclosure or unintended file system access on the server's host. However, given its intended use as an 'MCP Server' for developer clients (e.g., Claude Desktop, Cursor) running locally or in a trusted setup, this functionality is likely a feature for local code analysis. There are no obvious signs of 'eval', obfuscation, or hardcoded secrets. The `request` dependency (used by the underlying SolidityScan SDK) is deprecated, which can be a minor maintenance and security risk over time due to lack of updates.

Updated: 2026-01-16GitHub→

Low Cost

shopify-mcp-server

by bcsgarcia

Sec4

A middleware HTTP API designed to simplify, build, and execute Shopify GraphQL search queries for automation tools.

Setup Requirements

⚠️Requires Shopify Admin API access token (SHOPIFY_ACCESS_TOKEN) with necessary read/write permissions for products and orders.
⚠️Requires a custom API key (MCP_API_KEY) for server authentication; deploying without it will leave all endpoints (except / and /health) publicly accessible.
⚠️Requires a Node.js 14.17+ environment or Docker.

Review RequiredView Analysis

Authentication middleware is explicitly disabled if the `MCP_API_KEY` environment variable is not set, leading to unauthenticated access to all endpoints. This is a critical vulnerability. The query builder uses direct string concatenation to construct Shopify's search query parameters, which, while relying on Shopify's internal sanitization for search input, could potentially be vulnerable to unexpected query behavior or injection if specific malicious patterns are not fully neutralized. The `/api/execute-query` endpoint allows executing arbitrary GraphQL queries, making it a powerful endpoint that requires robust protection by the API key.

Updated: 2025-12-15GitHub→

Medium Cost

garmin-mcp-ts

by sedoglia

Sec9

Connects Claude Desktop to Garmin Connect, enabling natural language queries, analysis, and management of fitness activities, health metrics, sleep data, and device information.

Setup Requirements

⚠️Requires Node.js 18.0 or higher.
⚠️Optional but recommended installation of 'keytar' for native OS vault integration (otherwise, it defaults to file-based key storage, which is also encrypted).
⚠️For manual repository clones, requires editing Claude Desktop's 'claude_desktop_config.json' file (installation via .mcpb bundle handles this automatically).
⚠️Garmin OAuth API has known limitations, such as inability to add activity comments and partial support for activity privacy ('followers' option is not supported and returns an error).

Verified SafeView Analysis

The server prioritizes robust security for credentials and OAuth tokens. It uses AES-256-GCM encryption, storing the encryption key in the operating system's native secure vault (e.g., Windows Credential Manager, macOS Keychain) via 'keytar' or falling back to a permissions-restricted local file if 'keytar' is unavailable. There are no hardcoded secrets, and sensitive data is handled locally. The dynamic import of 'keytar' using 'new Function("return import(\"keytar\")")' is a controlled pattern for optional dependency loading and not a general 'eval' risk. Logging is strictly to stderr to prevent contaminating stdout, which is reserved for MCP JSON-RPC communication. Potential minor risks include misconfigured file permissions for the fallback key file or users manually overriding secure setup by storing plain-text credentials in the .env file.

Updated: 2026-01-16GitHub→

Medium Cost

pinocchio

by tomblancdev

Sec9

An MCP server that spawns autonomous Claude Code agents in isolated Docker containers for secure code analysis, development, and modification.

Setup Requirements

⚠️Requires Docker & Docker Compose to be installed and running.
⚠️Requires Claude Code CLI (`claude` command) and authenticated Claude API credentials (`~/.claude/.credentials.json`).
⚠️Initial workspace paths require explicit approval via the `manage_config` tool for security.
⚠️Docker Socket Proxy may occasionally become 'unhealthy', requiring a restart.

Verified SafeView Analysis

The project demonstrates a robust defense-in-depth security model. Key mitigations include a Docker Socket Proxy to block dangerous operations (BUILD, COMMIT, EXEC, VOLUMES, SECRETS), a workspace allowlist with symlink resolution (fs.realpath) and explicit path/glob validation (including a dangerous glob blocklist), read-only workspace mounts by default with granular write access, container hardening (non-root, CAP_DROP ALL, memory/CPU limits, no-new-privileges), secure handling of GitHub tokens via temporary files with restrictive permissions, rate limiting for concurrent agents and spawn frequency, and comprehensive input validation for container names, tasks, and agent IDs. Audit logging tracks security-relevant events. There are no obvious 'eval' or obfuscation patterns. The main remaining considerations are the inherent prompt injection risk common to LLMs operating in 'YOLO' mode and that agent containers run with `ReadonlyRootfs: false` (necessary for dynamic package installation) and default network access (needed for LLM API communication).

Updated: 2026-01-18GitHub→

Low Cost

sbol-mcp-server

by Glebasta33

Sec1

Assists Android developers with generating Clean Architecture layers, managing tasks, and resolving Gradle build errors by interacting with an MCP client.

Setup Requirements

⚠️Requires Java 17+ and Kotlin 2.2.0+
⚠️Assumes a local Gradle environment for compiler tools, including the `gradlew` wrapper in the project root.
⚠️The server communicates via standard I/O (stdin/stdout), not network ports.

Review RequiredView Analysis

CRITICAL: The `compilerTools.kt` file, specifically the `runGradleBuild` function, constructs shell commands (`./gradlew :$nameModule$buildType`) using user-provided input (`nameModule`, `buildType`) without proper sanitization. This allows for command injection, where a malicious user could embed arbitrary shell commands within the `nameModule` argument, leading to remote code execution on the server's host system. For example, providing `my_module; rm -rf /;` as the module name would execute `rm -rf /`.

Updated: 2025-12-17GitHub→

High Cost

htm-mcp-server

by cserock

Sec4

Deploys a user-friendly Streamlit interface for a LangGraph ReAct AI agent to interact with various external tools and data sources via the Model Context Protocol (MCP).

Setup Requirements

⚠️Requires OpenAI and/or Anthropic API Key (Paid Services) for LLM access, and an Upstage API Key for embeddings (for the RAG tool).
⚠️Python 3.12 or newer is required as per `pyproject.toml`.
⚠️Docker Desktop is recommended for easy setup and running all components, otherwise manual virtual environment setup is needed.
⚠️The `allow_dangerous_deserialization=True` flag in FAISS loading poses a security risk and should be carefully evaluated regarding data source trust.

Review RequiredView Analysis

The project uses `allow_dangerous_deserialization=True` when loading FAISS vector stores (in `resources/mcp_rag_kbs/rag/kbs.py`), which is a critical security vulnerability if the serialized data comes from an untrusted source, potentially leading to arbitrary code execution. While currently loading from internal project paths, this pattern is highly risky. Additionally, MCP servers bind to `0.0.0.0` (e.g., `mcp_server_time.py`), making them accessible from any network interface if not adequately protected by a firewall.

Updated: 2025-11-25GitHub→

PreviousPage 586 of 760Next