Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
ntodd icon

watson

by ntodd

Sec9

Provides code intelligence and a searchable call graph for Elixir/Phoenix projects, specifically designed for LLM coding agents.

Setup Requirements

  • ⚠️Requires Elixir and a Mix project setup where 'watson' is added as a dev dependency.
  • ⚠️Requires manual configuration in '~/.claude/mcp.json' with the 'cwd' pointing to the root of your Elixir project.
Verified SafeView Analysis
This is a local development tool designed to process a user's own project source code. It performs static analysis (parsing code, building call graphs, extracting types). No apparent network risks or mechanisms for executing arbitrary external code. The primary risk would be if the underlying parsing library itself had vulnerabilities when processing malicious Elixir code, which is inherent to any static analysis tool. Requires careful configuration of 'cwd' to prevent unintended access.
Updated: 2026-01-18GitHub→
0
0
Medium Cost
SureshAmal icon

mmcopilot-mcp

by SureshAmal

Sec2

The MMCopilot MCP Server provides trading tools for the MarketMaya platform, allowing users to create, manage, and backtest trading strategies, access account information, and search a knowledge base.

Setup Requirements

  • ⚠️Requires BEARER_TOKEN environment variable for MarketMaya API authentication.
  • ⚠️Requires FETCH_BEARER_TOKEN environment variable for dynamically fetching tool definitions from MarketMaya API.
  • ⚠️Requires GEMINI_API_KEY environment variable for Google Gemini API access, used by the knowledge base tool.
  • ⚠️Requires Python 3.10 or higher.
  • ⚠️Relies heavily on external MarketMaya APIs for core functionality (strategy creation, management, account, backtest) and for dynamic tool definitions. Also depends on Google Gemini API for knowledge base services.
Review RequiredView Analysis
CRITICAL: The server uses `exec()` to dynamically load and register tool functions whose code is generated from definitions fetched from an external API (MarketMaya). While there are attempts at sanitization for identifiers and descriptions (`escape_string_for_python`, `sanitize_identifier`), dynamically executing code from an untrusted source, even a 'trusted' API that could be compromised, is an extreme security risk. A malicious or compromised external API could inject arbitrary Python code, leading to remote code execution on the MCP server. This vulnerability significantly lowers the security score.
Updated: 2025-12-24GitHub→
0
0
Medium Cost
frankxiao008 icon

finnhub-mcp-server

by frankxiao008

Sec9

A Model Context Protocol (MCP) server that provides LLMs with access to Finnhub's financial data API for real-time stock quotes, company profiles, news, and financial metrics.

Setup Requirements

  • ⚠️Requires Finnhub API Key (free tier available but has rate limits and feature restrictions)
  • ⚠️Requires Node.js 18+
Verified SafeView Analysis
The server explicitly requires a Finnhub API key via environment variables and validates its presence. It uses Zod for input schema validation, which helps prevent malformed inputs. API requests are made using standard `fetch` to a known legitimate endpoint (`finnhub.io`), and includes robust error handling for API-specific issues like rate limits (429), invalid API key (401), and forbidden access (403). No 'eval' or other dynamic code execution from untrusted input is observed. Response content is formatted using internal utilities, and long outputs are truncated to prevent excessive token usage, also reducing potential for large data injection issues.
Updated: 2025-11-21GitHub→
0
0
Medium Cost
s3midetnov icon

mcpArendServer

by s3midetnov

Sec7

Integrates Arend dependent typechecking and language specification generation with LLMs via the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires a separate 'typecheckerServer' process to be running and fully initialized with the Arend library before the MCP server can be used.
  • ⚠️The 'typecheckerServer' needs a path to an Arend library, which defaults to a user-specific hardcoded path ('/Users/artem.semidetnov/Documents/DatasetGenerator/Arend/arend-lib') that must be configured for other users.
  • ⚠️Requires Gradle and a Java Development Kit (JDK) to build the executables using the `installDist` task.
Review RequiredView Analysis
The MCP server forwards arbitrary Arend definitions directly to a local typechecker server for execution. While Arend's typechecker is generally considered a safe sandbox, the primary security risk lies in whether a maliciously crafted Arend definition could exploit the underlying Arend library for arbitrary code execution. The typechecker server listens on localhost:9999 without authentication, meaning any local process can submit code for typechecking. The 'Generate_specification' tool uses a whitelist for topic names, mitigating arbitrary file reads for that specific function. No 'eval' or explicit arbitrary command execution is present in the provided code, and Base64 encoding is used for data transfer, not obfuscation or encryption.
Updated: 2026-01-17GitHub→
0
0
Medium Cost
BjornMelin icon

skillhub

by BjornMelin

Sec9

Skillhub acts as a local tool runner, reducing LLM context by executing heavy integrations (MCP & direct APIs) via scripts and condensing outputs.

Setup Requirements

  • ⚠️Requires Python 3.11+ (Python 3.13 recommended).
  • ⚠️Requires Node.js and npm/npx for certain MCP servers (e.g., `next-devtools-mcp`, `shadcn/ui`, `context7_stdio`).
  • ⚠️Requires external accounts/API keys for all integrated services (Exa, Firecrawl, Vercel, Supabase, Context7), which may incur costs.
Verified SafeView Analysis
The project demonstrates strong security posture with explicit confirmation gates for mutating/high-impact operations (e.g., Firecrawl crawls, Exa research tasks), strict token budgeting to prevent context bloat and prompt injection from raw outputs, and careful environment variable handling. Subprocess calls explicitly use `shell=False`. No hardcoded secrets were found; all API keys are sourced from environment variables. The design actively mitigates risks inherent to LLM-bridged API calls by filtering and condensing outputs.
Updated: 2025-12-14GitHub→
0
0
Medium Cost

clover-bridge

by transform-ia

Sec9

Provides a dual-interface (MCP for AI agents and GraphQL for web applications) Go server to integrate with and expose Clover POS API data.

Setup Requirements

  • ⚠️Requires Go 1.23+ to build and run locally.
  • ⚠️Requires a Kubernetes cluster for deployment via Helm/ArgoCD.
  • ⚠️The GraphQL interface requires `make generate` to be run if `schema.graphql` or `gqlgen.yml` are modified, before building.
  • ⚠️Requires `CLOVER_TOKEN` and `CLOVER_MERCHANT_ID` environment variables or Kubernetes secrets for Clover API authentication.
Verified SafeView Analysis
The project uses Kubernetes secrets for sensitive information (Clover API token, merchant ID), which is a good practice. It implements OpenTelemetry for comprehensive observability (metrics, traces, logs), aiding in security monitoring. HTTP requests are made with context and include exponential backoff and rate limiting. No 'eval' or similar dangerous dynamic code execution patterns were found in the runtime code. The GraphQL setup uses gqlgen for code generation, preventing runtime schema manipulation risks. The build-time scripts (`update_handlers.sh`, `instrument_handlers.py`) use standard shell and Python string manipulation, not code execution. The project follows general good security hygiene for a Go service.
Updated: 2025-11-24GitHub→
0
0
Low Cost
LDTorres icon
Sec8

Provides real-time dollar exchange rates in Argentina via a Model Context Protocol (MCP) server.

Setup Requirements

  • ⚠️Requires pnpm package manager to install dependencies and run scripts.
Verified SafeView Analysis
The server fetches data from an external API (dolarapi.com), which introduces a dependency on an external service. However, there are no apparent code vulnerabilities such as 'eval' usage, obfuscation, hardcoded secrets, or direct malicious patterns in the provided source code. The external API call uses standard fetch, and the server communicates via stdio, not exposing a typical network interface directly.
Updated: 2025-11-25GitHub→
0
0
Medium Cost
9506hqwy icon
Sec9

Provides a Model Context Protocol (MCP) server that exposes SonarQube API functionalities, allowing external tools, such as AI agents, to interact with and manage SonarQube instances.

Setup Requirements

  • ⚠️Requires a running SonarQube server to connect to.
  • ⚠️Requires valid SonarQube API credentials (token or username/password) with appropriate permissions for the desired operations.
  • ⚠️Building from source requires Go (version not specified, but typically recent stable), while running pre-built images requires Docker.
Verified SafeView Analysis
The server acts as a proxy for SonarQube APIs. It is implemented in Go, following standard coding practices. Credentials (URL, username, password, token) are handled at runtime via command-line flags or environment variables and are not hardcoded. It supports both basic and bearer token authentication. A 'readonly' flag is available (defaulting to true) to restrict operations to HTTP GET methods only, enhancing security by preventing write operations. The server itself does not introduce complex parsing or arbitrary code execution risks. The primary security considerations depend on the trustworthiness of the SonarQube instance it connects to and the secure management of the credentials provided to this server.
Updated: 2025-12-08GitHub→
0
0
Low Cost
Ifrazahoor icon

GeminiMcpServer

by Ifrazahoor

Sec1

The provided source code is a GitHub profile markdown file, not an MCP server. Cannot determine the server's use case.

Setup Requirements

  • ⚠️Actual server source code for 'GeminiMcpServer' is missing and only a GitHub profile markdown file was provided.
Review RequiredView Analysis
The provided 'SOURCE CODE' only contains a GitHub profile markdown file (`ifrazahoor.md`) and no actual server code for 'GeminiMcpServer'. Therefore, a security audit of the server itself is not possible. The markdown file itself contains no executable code or inherent security risks, but the server's actual security posture is completely unknown.
Updated: 2025-12-05GitHub→
0
0
High Cost
BigBang142 icon

Tor-Search-MCP

by BigBang142

Sec8

Browse the web and search anonymously using the Tor network, fetching full page content from search results or specific URLs while maintaining privacy.

Setup Requirements

  • ⚠️Requires Python 3.11+.
  • ⚠️Requires Tor Browser to be installed and its profile initialized (the installer attempts to automate this, but a manual launch of Tor Browser might be necessary once).
  • ⚠️On Linux, for headless execution (without a graphical display), `pyvirtualdisplay` and `xvfb` must be installed (e.g., `pip install pyvirtualdisplay && sudo apt-get install xvfb`).
Verified SafeView Analysis
The server and installer use `subprocess.run` to manage the Python virtual environment, install dependencies, and interact with external browser automation tools (Tor Browser, geckodriver). These binaries are downloaded from official and trusted sources. No 'eval', hardcoded secrets, or obvious malicious patterns were found in the provided source code. The security largely depends on the integrity of the downloaded Tor Browser and geckodriver binaries and the underlying operating system.
Updated: 2026-01-19GitHub→
0
0
Low Cost
iamthite icon
Sec9

Provides basic arithmetic operations and random number generation via a simple API.

Setup Requirements

  • ⚠️Requires Python 3.14 or higher
Verified SafeView Analysis
The server's code is minimal and performs only basic, contained operations (addition, random number generation, self-info). There are no external dependencies beyond standard library functions, no file system access, no 'eval' or other dynamic code execution, and no hardcoded secrets. The operations are inherently safe. Running on 0.0.0.0 makes it accessible from all interfaces, which is a standard deployment configuration, but requires proper network isolation in a production environment; however, this is an infrastructure concern, not a code vulnerability.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
robertalv icon

loops-mcp-server

by robertalv

Sec9

Integrate Loops.so email marketing API into MCP-compatible clients like Claude Desktop, Cursor, or VS Code to manage contacts, send events, and transactional emails.

Setup Requirements

  • ⚠️Requires a Loops.so API Key (obtained from your Loops.so account settings)
  • ⚠️Requires Node.js version 18.0.0 or higher
  • ⚠️Requires an MCP-compatible client (e.g., Claude Desktop, Cursor, VS Code with MCP extension) for interaction
Verified SafeView Analysis
The server correctly retrieves the LOOPS_API_KEY from environment variables, preventing hardcoding. It uses standard fetch for API calls and handles errors gracefully. It operates over stdio, mitigating typical network attack vectors for the server itself. No 'eval' or other inherently dangerous functions are used. The primary security consideration for users is ensuring their LOOPS_API_KEY is stored securely in their environment.
Updated: 2025-11-26GitHub→
PreviousPage 587 of 760Next