Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
agorski icon
Sec9

A template for developing custom Model Context Protocol (MCP) servers in JavaScript for integration with Claude Desktop, providing tools for server information, basic greetings, weather lookups, and historical stock data.

Setup Requirements

  • ⚠️Node.js (v16 or later) is required.
  • ⚠️Requires manual configuration in Claude Desktop's `claude_desktop_config.json` file.
  • ⚠️Relies on external public APIs (Open-Meteo and Yahoo Finance) for weather and stock data, which could experience downtime or changes.
Verified SafeView Analysis
The server code does not use 'eval' or any obfuscation. It performs external network requests for its 'weather' and 'stock' tools to public APIs (Open-Meteo and Yahoo Finance), which is expected functionality for these tools. There are no apparent hardcoded secrets or malicious patterns. Basic error handling is implemented for tool arguments and external API failures. The server is designed for local execution and communication via standard I/O.
Updated: 2025-12-14GitHub→
0
0
Medium Cost
nikosolihin icon
Sec8

A remote MCP server that extracts transcripts, titles, descriptions, and comments from Loom videos to augment AI agent capabilities.

Setup Requirements

  • ⚠️Requires a Cloudflare Workers account for deployment.
  • ⚠️Requires Cloudflare Wrangler CLI configured.
Verified SafeView Analysis
The server is explicitly 'authless', meaning it does not implement its own authentication or authorization. Anyone with the deployed server's URL can query it. While this is intentional for accessing public Loom video data, it means there are no access controls on who can trigger these Loom API calls. No hardcoded secrets, 'eval', or obvious malicious patterns are present in the source code. Network requests are limited to the legitimate Loom GraphQL API.
Updated: 2026-01-19GitHub→
0
0
High Cost
parthashirolkar icon

stock-analysis-mcp

by parthashirolkar

Sec9

Provides comprehensive Indian stock market analysis, including real-time data, fundamentals, technical indicators, and time-series forecasting, integrated as an an MCP server for AI agents like Claude Desktop.

Setup Requirements

  • ⚠️Requires Docker Desktop installed and running on Windows (or a Docker environment) for the recommended setup outlined in README-Docker.md.
  • ⚠️Requires Claude Desktop for integration as an MCP server. Configuration involves editing a JSON file with an absolute path.
  • ⚠️Python 3.13 or higher is a prerequisite for local installation.
  • ⚠️The functionality relies on the Yahoo Finance API, which may be subject to rate limits or data availability issues. Market timing (IST) is critical for real-time data accuracy.
Verified SafeView Analysis
The server relies on the `yfinance` library for data fetching, a reputable external API dependency. The Docker container setup prioritizes security with no exposed ports (STDIO transport), running as a non-root user (`mcp`), and utilizing a minimal Python 3.13-slim base image. Resource limits are applied to prevent resource exhaustion. No hardcoded secrets, `eval` calls, or obvious malicious patterns were detected in the provided source code. External dependency on Yahoo Finance API's reliability and data quality should be noted.
Updated: 2026-01-02GitHub→
0
0
Medium Cost
rahulkr icon
Sec8

Provides a comprehensive set of tools to control Android devices via ADB, specifically designed for Flutter/Android development, UI testing, debugging, and visual QA workflows.

Setup Requirements

  • ⚠️Requires ADB (Android Debug Bridge) to be installed and accessible in the system PATH.
  • ⚠️Requires an Android device or emulator to be connected with USB debugging enabled.
Verified SafeView Analysis
The server's core functionality involves executing ADB commands via `subprocess.run`. The implementation uses `list[str]` for command arguments, which correctly prevents common shell injection vulnerabilities. No `eval` calls, hardcoded secrets, or direct external network listener risks were identified within the provided source. The primary security consideration is controlling access to the MCP client that can invoke these powerful ADB commands on a connected device.
Updated: 2025-12-02GitHub→
0
0
Medium Cost
Sec8

Provides AI assistants with a standardized Model Context Protocol (MCP) interface to interact with Redmine project management software via its REST API.

Setup Requirements

  • ⚠️Requires Ruby 3.1 or higher.
  • ⚠️Requires access to a Redmine instance (5.0+) with its REST API enabled and a Redmine API key.
  • ⚠️Advanced features (Custom Fields CRUD, Queries CRUD, Bulk Time Entries) require the 'Redmine Extended API plugin' to be installed on the Redmine instance.
Verified SafeView Analysis
The server uses standard API key-based authentication for Redmine interactions. There are no obvious code execution vulnerabilities or 'eval' usages mentioned. The primary security consideration is managing the Redmine API key's permissions, as the AI client gains all permissions granted to that key. The `batch_execute` tool allows multiple Redmine operations in a single request, which should be considered in terms of rate limiting or excessive access if exposed to untrusted clients.
Updated: 2025-11-17GitHub→
0
0
Medium Cost
grymmjack icon

qb64pe-mcp-server

by grymmjack

Sec4

This project is a Model Context Protocol (MCP) server for QB64PE development, providing an extensive set of tools for code analysis, compilation, debugging, porting, and system integration, optimized for interaction with large language models.

Setup Requirements

  • ⚠️Requires QB64PE compiler installed and accessible in system PATH (or specified path)
  • ⚠️Relies on external CLI screenshot tools (e.g., `screencapture` on macOS, `import`/`gnome-screenshot`/`scrot`/`xwd` on Linux) which may need to be installed
  • ⚠️Requires Node.js version 18.0.0 or higher
Review RequiredView Analysis
**High Risk - Command Injection Vulnerability**: The `compile_and_verify_qb64pe` tool, located in `src/services/compiler-service.ts`, constructs and executes shell commands using user-provided `sourceFilePath`, `qb64pePath`, and `compilerFlags`. Without robust input sanitization, a malicious actor could inject arbitrary commands (e.g., `'; rm -rf /;'`) via these parameters, leading to severe system compromise. **Medium Risk - Arbitrary File Overwrite/Execution**: The `ScreenshotService` uses user-provided `outputPath` directly in shell commands (e.g., `screencapture`). A malicious path could lead to overwriting critical system files or, if combined with other vulnerabilities, lead to command execution. **Local Data Storage**: Session problem logs are stored locally in the user's home directory (`~/.qb64pe-mcp/session-problems`). While local, the content is not controlled and could potentially contain sensitive information or be manipulated by other local processes.
Updated: 2026-01-18GitHub→
0
0
Medium Cost
jayfoeelite icon

global-mcp-servers

by jayfoeelite

Sec2

Fetches documentation for a specified library to extend AI capabilities for information retrieval.

Setup Requirements

  • ⚠️Requires Brave Search API Key (hardcoded in source, should be externalized)
  • ⚠️Requires Node.js environment
  • ⚠️Requires active internet connection for API and web content fetching
Review RequiredView Analysis
CRITICAL: The `BRAVE_API_KEY` is hardcoded directly in the `index.js` file (`BSAgFFoQcVVFuYIiBmjl9DIgUsuXiBb`), which is a severe security vulnerability as it exposes a sensitive credential. The script also makes external network requests to an arbitrary documentation URL, which could expose the system to content from untrusted sources, although `encodeURIComponent` is used for the initial search query. There are no obvious `eval` or obfuscation patterns.
Updated: 2025-12-05GitHub→
0
0
Low Cost

linea-mcp

by 0xredeth

Sec3

A lightweight, in-memory HTTP key-value store server, primarily designed for development, testing, or simple data caching within trusted environments where data persistence and strong authentication are not critical requirements.

Setup Requirements

  • ⚠️By default, there is NO authentication configured, allowing unauthenticated access to all data.
  • ⚠️Data is stored only in-memory and will be lost if the server restarts or crashes.
Review RequiredView Analysis
CRITICAL: The server explicitly implements a 'NoOpAuth' (no-operation authentication) and provides no other authentication mechanisms in the current codebase. This means any client with network access can read, write, and delete data without any form of authentication or authorization. This is highly insecure for production environments or any setup exposed to untrusted networks. No other major risks like 'eval', obfuscation, hardcoded secrets, or command injection were found in the provided snippets.
Updated: 2025-11-29GitHub→
0
0
Medium Cost
rcx86 icon
Sec8

Enables LLMs to interact with and inspect local Git repositories to retrieve commit history, messages, diffs, and changed files.

Setup Requirements

  • ⚠️Requires 'git' command-line tool to be installed and accessible in the system's PATH.
  • ⚠️Requires Python 3.10 or newer.
Verified SafeView Analysis
The server executes Git commands using `subprocess.run` with a list of arguments, which prevents direct shell injection vulnerabilities. Inputs like commit hashes and working directories are passed as literal arguments to the Git command, not interpreted by a shell. There are no 'eval' or similar dangerous patterns, nor any hardcoded secrets. The primary remaining risk is if an LLM is prompted to provide malicious `cwd` values that could lead to unintended Git operations or access to sensitive repository data, but this is an LLM interaction risk rather than a code vulnerability. Note: The `git_is_git_repo` function contains a functional bug where it may always return `True` due to how `run_git_command` handles errors (by returning a string, not raising an exception), but this is not a security vulnerability.
Updated: 2025-12-06GitHub→
0
0
Low Cost
asingh49-cmd icon
Sec3

Enables Claude Desktop to interact with a Snowflake database using natural-language SQL via a local Model Context Protocol (MCP) server.

Setup Requirements

  • ⚠️Requires Python 3.10+
  • ⚠️Requires specific environment variables for Snowflake connection (SF_ACCOUNT, SF_USER, etc.) to be set either in a .env file or directly in the Claude Desktop configuration.
  • ⚠️Requires Claude Desktop and manual configuration of its `claude_desktop_config.json` to integrate the MCP server.
Review RequiredView Analysis
The `run_sql` tool directly executes the `query` string received from the LLM without any sanitization or validation. This poses a significant SQL injection vulnerability if an adversarial user can prompt the LLM to generate malicious SQL, potentially leading to unauthorized data access, modification, or deletion. No other obvious 'eval' or malicious patterns were found, and credentials are handled via environment variables, but the direct SQL execution is a critical flaw.
Updated: 2025-12-05GitHub→
0
0
Medium Cost
Olbrasoft icon

opencode

by Olbrasoft

Sec9

Automates session and task tracking for OpenCode interactions with a VirtualAssistant Hub API, enabling centralized task management across AI agents.

Setup Requirements

  • ⚠️Requires `VirtualAssistant Hub API` to be running and accessible, typically at `http://localhost:5055`.
  • ⚠️Requires `OpenCode` to be running and configured to use this as an MCP server.
  • ⚠️Unlike standard plugins, this is configured as an MCP server (JSON-RPC over stdio) in `~/.config/opencode/opencode.json` rather than directly installed as a plugin, which is a more involved setup.
Verified SafeView Analysis
The server primarily communicates with a configurable Hub API, defaulting to localhost. File system operations are limited to safe logging within the /tmp directory. No 'eval', dynamic code execution, or hardcoded secrets were found. The primary security consideration is ensuring the configured `OPENCODE_HUB_URL` points to a trusted endpoint if not `localhost`.
Updated: 2026-01-14GitHub→
0
0
Low Cost
devdarcom icon

ollama-mcp-server

by devdarcom

Sec8

Provides a Model Context Protocol (MCP) server for integrating local Ollama large language models and their capabilities with other applications.

Setup Requirements

  • ⚠️Node.js (LTS version) required
  • ⚠️npm (Node.js package manager) required
  • ⚠️Ollama must be installed and running on the local system
Verified SafeView Analysis
The server primarily acts as an adapter, communicating via standard I/O (stdio) rather than opening network ports, which reduces direct external attack surface. It relies on the '@modelcontextprotocol/sdk' and 'ollama' client library. Input validation for tool arguments is implicitly handled by the Zod schemas from the SDK (CallToolRequestSchema), although the internal handling uses `as any`, placing trust on the Ollama client library to safely process model inputs (e.g., prompts and messages) as data rather than executable code. No 'eval' or direct 'child_process' execution is visible in the provided source. No hardcoded credentials or obvious malicious patterns found.
Updated: 2025-12-01GitHub→
PreviousPage 597 of 760Next