Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
devbrother2024 icon

my-mcp-server-251127

by devbrother2024

Sec8

This server acts as a Model Context Protocol (MCP) endpoint, providing various utility tools (greeting, calculator, current time, image generation) and a server information resource, serving as a boilerplate for MCP server development in TypeScript.

Setup Requirements

  • ⚠️Requires `HF_TOKEN` environment variable or Smithery configuration for image generation functionality. Without it, image generation requests will fail.
  • ⚠️Requires Node.js (version 18 or higher recommended by dependencies) and npm for setup and execution.
  • ⚠️Uses the `smithery` CLI for its `build` and `dev` scripts, requiring familiarity with this tool for standard development workflows.
Verified SafeView Analysis
The server correctly handles secrets like `HF_TOKEN` by retrieving it from environment variables or a configuration object, preventing hardcoding. It uses well-established libraries (`@modelcontextprotocol/sdk`, `zod`, `@huggingface/inference`). There are no visible 'eval' calls or direct execution of arbitrary user input that would indicate immediate code injection vulnerabilities. Network calls are restricted to the Hugging Face Inference API for image generation. The primary security consideration would be securing the `HF_TOKEN` itself and monitoring usage, as image generation can incur costs. As a boilerplate, custom additions would need careful security review.
Updated: 2025-11-27GitHub→
0
0
High Cost
dangordon1 icon

aneya-backend

by dangordon1

Sec6

A FastAPI backend for a healthcare platform (Aneya) providing AI-powered clinical decision support, medical form management, and consultation analysis (including transcription, diarization, speaker role identification, and summarization). It integrates with multiple external medical knowledge bases and offers user authentication and custom form generation.

Setup Requirements

  • ⚠️Requires `ANTHROPIC_API_KEY` for all core AI functionalities (analysis, summarization, classification).
  • ⚠️Requires a configured Supabase project with `SUPABASE_URL` and `SUPABASE_SERVICE_ROLE_KEY` for database, user authentication, and custom forms.
  • ⚠️Requires API keys for various external services including `RESEND_API_KEY` (email), `SCOPUS_API_KEY` (medical literature), `SARVAM_API_KEY` (diarization), `ELEVENLABS_API_KEY` (transcription), and optionally `NCBI_API_KEY` (PubMed).
  • ⚠️Clinical analysis often exceeds Vercel Hobby plan limits (10-second timeout), recommending a Pro plan (60 seconds) or deployment to Google Cloud Run (300 seconds, 4Gi memory) for robust performance, especially with voice transcription.
  • ⚠️Local development requires Python 3.9+ and all listed dependencies (e.g., FastAPI, Pydantic, anthropic, httpx, beautifulsoup4, fastmcp, supabase, resend, sarvamai, elevenlabs).
Review RequiredView Analysis
The serverless version (api/index.py) explicitly sets `allow_origins=["*"]` for CORS, which is a significant security risk for production environments if not updated. The OTP email generation (`routers/auth.py`) embeds user-provided `name` directly into HTML, which could lead to Cross-Site Scripting (XSS) if the `name` is not rigorously sanitized. Extensive use of web scraping in MCP servers could introduce vulnerabilities if fetched content is not sanitized before use. Hardcoded default values for `user_id` are found in `api.py` during `auto-fill-consultation-form` in certain branches which is concerning.
Updated: 2026-01-19GitHub→
0
0
Low Cost
mustafabutt-dev icon

autonomous-blog-agent

by mustafabutt-dev

Sec7

This server fetches and analyzes existing blog posts or external web content to suggest related topics, supporting a blog generation agent in creating contextually rich 'Read More' sections.

Setup Requirements

  • ⚠️Requires Python dependencies `fastmcp`, `httpx`, `beautifulsoup4` (typically managed by `mcp-servers/requirements.txt`).
  • ⚠️Performance can vary based on external website response times and the complexity of scraped content, potentially affecting I/O bound operations.
  • ⚠️Input `category_url` should be from trusted sources or undergo strict validation to mitigate potential SSRF risks.
Verified SafeView Analysis
The server uses `httpx` and `BeautifulSoup` for making external HTTP requests and parsing HTML, which inherently carries network risks. Without the full source code for `get_category_related_posts` and its helper functions (e.g., `extract_keywords`, `calculate_topic_similarity`), a comprehensive security audit is limited. Specific concerns include potential Server-Side Request Forgery (SSRF) if `category_url` input is not strictly validated, and unmanaged rate limits when interacting with external websites. No obvious hardcoded secrets or malicious patterns (like `eval` with arbitrary input) are visible in the truncated code.
Updated: 2025-12-26GitHub→
0
0
Low Cost
vweiss960 icon

pg_mcp_server

by vweiss960

Sec1

This server likely manages and provides an API for data stored in a PostgreSQL database, serving as a backend component for an application.

Setup Requirements

  • ⚠️Requires a running PostgreSQL database instance.
Review RequiredView Analysis
No source code was provided for analysis, making a security audit impossible. Without code review, it is unsafe to run as potential vulnerabilities cannot be assessed.
Updated: 2025-12-01GitHub→
0
0
Medium Cost
michael-denyer icon

memory-mcp

by michael-denyer

Sec8

Provides Claude with persistent 'two-tier' memory (hot cache for zero-latency access, cold storage for semantic search) and automatic pattern mining from outputs to enhance long-term context and reduce token usage.

Setup Requirements

  • ⚠️Requires Python 3.10+.
  • ⚠️Embedding model (~90MB) downloads automatically on first run, causing a 30-60 second startup delay.
  • ⚠️Manual setup of a Claude Code Stop hook in ~/.claude/settings.json is required for automatic output logging and pattern mining.
  • ⚠️Optional Apple Silicon (MLX) optimization requires manual installation of 'mlx' and 'mlx-lm' if not already present, otherwise falls back to CPU-based Sentence Transformers.
Verified SafeView Analysis
The server explicitly states it is for 'local use only' and runs unauthenticated over STDIO, warning against exposure to networks. Input content is validated for length (`max_content_length`) to prevent excessive resource consumption. SQLite queries use parameterized statements to prevent SQL injection. External ML models are downloaded from trusted sources (Hugging Face, mlx-community), which introduces a dependency risk, but is common practice. No obvious malicious patterns or hardcoded secrets were found.
Updated: 2026-01-19GitHub→
0
0
Low Cost
sankar-v icon
Sec8

An AWS Lambda-compatible Model Context Protocol (MCP) server providing weather forecast and alerts tools by integrating with the National Weather Service (NWS) API, primarily for consumption by AI models and agents.

Setup Requirements

  • ⚠️Requires an AWS account with configured AWS Lambda and API Gateway services, which are paid services.
  • ⚠️Manual configuration of AWS API Gateway is necessary, including creating a REST API, defining `/mcp` resource with POST, GET, and DELETE methods, setting up Lambda integrations, and deploying the API.
  • ⚠️The AWS Lambda implementation uses in-memory session storage, which will be reset on Lambda cold starts; a persistent session storage solution (e.g., AWS DynamoDB) is required for production use to maintain session state.
  • ⚠️AWS API Gateway may have timeout limitations for Server-Sent Events (SSE) connections; WebSockets are suggested in the README for truly persistent connections.
Verified SafeView Analysis
The server implements robust input validation for its tools using `zod`, which is excellent for preventing common injection vulnerabilities and ensuring data integrity when interacting with the external NWS API. It uses `randomUUID()` for generating session IDs, promoting uniqueness. Error handling is structured to prevent exposing sensitive internal details. No explicit use of `eval` or intentional code obfuscation was detected. No hardcoded sensitive API keys or credentials were found within the server's runtime code. The main security concern, as noted in the README, is the use of in-memory session storage in a serverless AWS Lambda environment, leading to session resets on cold starts. For production, persistent storage like DynamoDB is recommended, addressing a functional rather than a direct security vulnerability.
Updated: 2025-11-30GitHub→
0
0
Medium Cost
avirupahomoeo icon

avirupa-mcp-server

by avirupahomoeo

Sec8

A backend server for a multi-channel communication platform, managing user conversations, integrating with external messaging services, storing user data, and facilitating interactions with AI models and e-commerce platforms.

Setup Requirements

  • ⚠️Requires a Redis instance for session memory (REDIS_URL).
  • ⚠️Requires a Supabase project (SUPABASE_URL, SUPABASE_KEY) for persistent user data.
  • ⚠️Requires WooCommerce API credentials (WOOCOMERCE_BASE, WOOCONSUMERKEY, WOOCONSUMERSECRET) for e-commerce integration.
  • ⚠️Requires an OpenAI API Key (OPENAI_API_KEY) for the '/ask-model' endpoint to function with an actual LLM.
Verified SafeView Analysis
The application correctly uses environment variables for sensitive credentials. No 'eval' or similar dangerous functions are used. Standard web application security practices like robust input validation and rate limiting would be necessary for production, but are not unique critical flaws in this snippet. The exposure of various third-party APIs (Supabase, Redis, WooCommerce, potentially OpenAI, n8n) requires careful configuration and access control in a production environment.
Updated: 2025-11-22GitHub→
0
0
Medium Cost
WebDev70 icon

MCP_Server5

by WebDev70

Sec9

An MCP server enabling LLMs to accurately answer complex questions about U.S. federal award spending by integrating with USAspending.gov API v2.

Setup Requirements

  • ⚠️uv package manager required
  • ⚠️Python 3.12+ required
  • ⚠️Docker required (for integration tests and containerization)
  • ⚠️Google Cloud SDK required (for Cloud Run deployment)
Verified SafeView Analysis
The server implements robust error handling, retries, and a circuit breaker for external API calls. CI/CD includes explicit security scanning for dependencies and secrets (gitleaks, pip-audit, trivy). No hardcoded secrets or malicious patterns observed. The primary risk is inherent to interaction with external public APIs.
Updated: 2026-01-19GitHub→
0
0
Low Cost
crazi-co icon

clara-mcp-server

by crazi-co

Sec3

Exposes Clara backend APIs as tools for AI agents using the Model Context Protocol (MCP).

Setup Requirements

  • ⚠️Requires a separate Clara API backend server to be running for core functionality.
  • ⚠️All MCP server interactions (including those intended for backend API endpoints that might otherwise be public like `/health`) require `USER_ID` and `API_KEY_TOKEN` to be provided either via environment variables or `Authorization` and `User-Id` HTTP headers.
  • ⚠️The `file_path` parameter in `agent.analysis` refers to a file located on the server hosting this MCP, not a file uploaded directly by the client, which demands careful management of server-side paths.
Review RequiredView Analysis
Critical path traversal vulnerability exists in the `agent.analysis` tool. The `file_path` parameter, if an AI agent can control its value without sanitization, allows reading arbitrary local files from the server's filesystem and subsequently uploading them to the backend Clara API. This presents a severe risk of data exfiltration or unauthorized access to server resources. Additionally, the server uses global mutable variables (`app.data.user_id`, `app.data.api_key_token`) for authentication context. In a concurrent environment, these global variables could be overwritten by a different request during processing, potentially leading to incorrect or leaked credentials being used by a request. The default `log_level` for Uvicorn is set to 'error', which may hinder effective security incident detection and debugging.
Updated: 2025-11-29GitHub→
0
0
Medium Cost
kbrimijoin icon

nyt_mcp

by kbrimijoin

Sec8

This server provides a Model Context Protocol (MCP) interface for searching New York Times articles, intended for integration with MCP clients like Claude Desktop, potentially for saving results to spreadsheets.

Setup Requirements

  • ⚠️Requires a valid NYT_API_KEY (typically a paid API subscription or developer key).
  • ⚠️Requires Python 3.10 or newer.
  • ⚠️NYT_API_BASE_URL environment variable must be set (default to NYT search API endpoint).
Verified SafeView Analysis
The server correctly uses environment variables for API keys, preventing hardcoded secrets. It employs `httpx` with explicit timeouts for external API calls and includes basic error handling for network requests by catching broad exceptions and returning `None`. There is no use of `eval` or obvious malicious patterns. The scope is limited to API proxying, reducing attack surface. A minor improvement could be more specific exception handling instead of a general `except Exception` to differentiate network issues from other potential errors.
Updated: 2025-12-04GitHub→
0
0
Medium Cost
alucardeht icon

figma-mcp

by alucardeht

Sec9

MCP server for Figma API with intelligent context management, token optimization, and multi-agent context preparation.

Setup Requirements

  • ⚠️Requires a Figma API Token (FIGMA_API_TOKEN) to be set as an environment variable.
  • ⚠️Requires a paid Figma plan (Professional or Organization) for practical use, as free accounts have a very low API rate limit (6 requests/month for file content).
  • ⚠️Requires a Node.js environment (specifically Node.js v18.17.0, v20.3.0, or >=v21.0.0 due to 'sharp' dependency).
Verified SafeView Analysis
Uses `FIGMA_API_TOKEN` from environment variables, which is a secure practice. Relies on standard and well-maintained libraries (`axios`, `sharp`). No `eval` or obvious malicious patterns found in the truncated source code. The server explicitly checks for the `FIGMA_API_TOKEN` before making most API calls.
Updated: 2025-12-06GitHub→
0
0
Low Cost
pcjx8 icon
Sec9

A comprehensive Electronic Health Record (EHR) system for healthcare AI agent development, EHR integration testing, clinical workflow simulation, and medical AI training, mimicking EPIC-style operations.

Setup Requirements

  • ⚠️Requires Python 3.11+.
  • ⚠️Data (patients, appointments, etc.) is stored in-memory using mock_data.py and resets on server restart.
  • ⚠️Requires `pip install -r requirements.txt` to install Python dependencies.
Verified SafeView Analysis
The server implements JWT token-based authentication with HS256, password hashing (SHA-256), access/refresh tokens, and role-based access control. Test user passwords are hardcoded in `auth.py` for demo purposes. Sensitive operations are protected by permission checks. The in-memory storage for refresh tokens and revoked tokens, as well as all mock data, is not persistent and is explicitly noted in documentation as needing a database/Redis for production. Production deployment guides emphasize crucial security measures like environment variables for secrets, HTTPS/WSS, firewalls, and rate limiting. No obvious `eval` or malicious patterns found.
Updated: 2025-11-27GitHub→
PreviousPage 598 of 760Next